So, I wasn't sure if this was just a version problem or something (using EE 2.7 and Store 1.6.4 - the latest).

When I try to add items to my cart, they aren't successfully added and the network inspector shows that the POST is being 302 redirected to a GET. I tried a variety of htaccess setups, including not having one at all putting the index.php back into the URL. Nothing seems to work.

Here's the POST data:

ACT 41
RET products/my-product-page
XID 32e30b64c0bdc8d9c5912d91c3764ad4b3c194b4
_params JklZbhzeb7aea+I4IB82StmfY1Bt/4jVC9XT2EbcV+2jeMX3Q7EKeZa1LWwiLh8f59h6n8Xsuaz6Rw0guwFpEcECKeZgLN+OS3uk8QTCaXfx0p5UR+jTgFl0uB/QVDedMkUuXXpki2aPaFrUgy3UT4unGSK+juDkn+zDQUrKRWqVjoHVguKqoxKI2LuFQJPELKTP0tPbhBFdXSYMUYw1213qV8VMWQPV4XKLmuTMyt4YprL/Kh8jy3AkiNaOem8JaClZfaunEZlM+ehf+9FG8SyzwmsRm4SefiwhY8V2wHI=
entry_id    40
item_qty    1
modifiers_3 10
return_url  store/checkout
site_id 1
submit  Add to Cart

The URL for both the POST and GET are exactly the same. No differing slashes or anything. Using PHP 5.3.22 and Apache.

  • I also took the plunge; upgraded to EE 2.7, store 1.6.4. I have the exact same error. I did a rollback, can't have a web shop where buying stuff is impossible...
    – okenathan
    Sep 6 '13 at 17:17

It appears EE 2.7 removed a check_xid() function from the Security controller.

I tried this only locally, but it appears to allow the items to be added to cart.

In the store/mod.store.php file, modify lines 243 and 591 by renaming the check_xid function to secure_forms_check as noted here:





Again, this was only tested locally so use at your own risk. I would still file a bug report with the Expresso Dev guys.

  • That fixed it. Thanks. As a note, I think 2.7 introduced some changes that certainly weren't mentioned in their changelog. fetch_site_index now has an parameter that is true by default that wasn't in prior versions.
    – jpea
    Sep 6 '13 at 22:58

Unfortunately it looks like some changes were made in EE 2.7 to how secure forms are handled, which aren't documented anywhere.

The solution by Nuno is correct, you can simply replace check_xid() with secure_forms_check() and it will mostly work as expected. The downside of this is that AJAX scripts which expect to be able to reuse the same XID for multiple requests will no longer work in EE 2.7.

There will be an official release to fix this issue very shortly.

UPDATE: This has been fixed in Store 1.6.5

  • Thanks for the tip Adrian. I'm kinda surprised that such a change happened in a point version without commenting on it in the changelog.
    – jpea
    Sep 7 '13 at 0:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.