From 580e201c48cee8214bb997e86dd18c3e2db961b8 Mon Sep 17 00:00:00 2001
From: Jerome Nadaud <jerome.nadaud@prestashop.com>
Date: Tue, 29 Oct 2013 11:38:48 +0100
Subject: [PATCH] [-] BO : FixBug #PSCFV-9319 - display only valid order id

---
 .../controllers/customer_threads/message.tpl  | 35 ++++++++++---------
 .../admin/AdminCustomerThreadsController.php  |  9 ++++-
 2 files changed, 26 insertions(+), 18 deletions(-)

diff --git a/admin-dev/themes/default/template/controllers/customer_threads/message.tpl b/admin-dev/themes/default/template/controllers/customer_threads/message.tpl
index 533d12610..a181a2f79 100644
--- a/admin-dev/themes/default/template/controllers/customer_threads/message.tpl
+++ b/admin-dev/themes/default/template/controllers/customer_threads/message.tpl
@@ -57,14 +57,14 @@
 			
 			<dl>			
 				<dt>{l s='Sent on:'}</dt>
-				<dd>{$message.date_add}</dd> 
+				<dd>{$message.date_add}&nbsp;</dd> 
 			
 			</dl>
 
 			{if empty($message.id_employee)}
 			<dl>
 				<dt>{l s='Browser:'}</dt>
-				<dd>{$message.user_agent}</dd>
+				<dd>{$message.user_agent}&nbsp;</dd>
 			</dl>
 			{/if}
 
@@ -79,34 +79,35 @@
 			</dl>
 			{/if}
 
-			{if !empty($message.id_order) && empty($message.id_employee)}
+			{if !empty($message.id_order) && $is_valid_order_id && empty($message.id_employee)}
 				<dl>
 					<dt>{l s='Order #'}</dt> 
-					<dd><a href="index.php?tab=AdminOrders&id_order={$message.id_order}&vieworder&token={getAdminToken tab='AdminOrders'}" title="{l s='View order'}">
-					{$message.id_order} <img src="../img/admin/search.gif" alt="{l s='View'}" />
-				</a></dd>
+					<dd><a href="index.php?tab=AdminOrders&id_order={$message.id_order}&vieworder&token={getAdminToken tab='AdminOrders'}" title="{l s='View order'}">{$message.id_order} <img src="../img/admin/search.gif" alt="{l s='View'}" /></a>
+					</dd>
 				</dl>
 			{/if}
 
 			{if !empty($message.id_product) && empty($message.id_employee)}
 				<dl>
 					<dt>{l s='Product #'}</dt> 
-					<dd><a href="index.php?tab=AdminProducts&id_product={$message.id_product}&updateproduct&token={getAdminToken tab='AdminProducts'}" title="{l s='View order'}">
-					{$message.id_product} <img src="../img/admin/search.gif" alt="{l s='View'}" />
-				</a></dd>
+					<dd><a href="index.php?tab=AdminProducts&id_product={$message.id_product}&updateproduct&token={getAdminToken tab='AdminProducts'}" title="{l s='View order'}">{$message.id_product} <img src="../img/admin/search.gif" alt="{l s='View'}" /></a></dd>
 				</dl>
 			{/if}
 			
 				<form action="{$current}&token={$token}&id_customer_thread={$message.id_customer_thread}&viewcustomer_thread" method="post">
-				<b>{l s='Subject:'}</b>
 				<input type="hidden" name="id_customer_message" value="{$message.id_customer_message}" />
-				<select name="id_contact" onchange="this.form.submit();">
-					{foreach $contacts as $contact}
-						<option value="{$contact.id_contact}" {if $contact.id_contact == $message.id_contact}selected="selected"{/if}>
-							{$contact.name}
-						</option>
-					{/foreach}
-				</select>
+				<dl>
+					<dt>{l s='Subject:'}</dt>
+					<dd>
+						<select name="id_contact" onchange="this.form.submit();">
+							{foreach $contacts as $contact}
+								<option value="{$contact.id_contact}" {if $contact.id_contact == $message.id_contact}selected="selected"{/if}>
+									{$contact.name}
+								</option>
+							{/foreach}
+						</select>
+					</dd>
+				</dl>
 			</form>
 
 
diff --git a/controllers/admin/AdminCustomerThreadsController.php b/controllers/admin/AdminCustomerThreadsController.php
index c53945a5b..da3f4b15c 100644
--- a/controllers/admin/AdminCustomerThreadsController.php
+++ b/controllers/admin/AdminCustomerThreadsController.php
@@ -605,6 +605,12 @@ class AdminCustomerThreadsControllerCore extends AdminController
 			ENT_QUOTES, 'UTF-8')
 		);
 
+		$is_valid_order_id = true;
+		$order = new Order((int)$message['id_order']);
+
+		if (!Validate::isLoadedObject($order))
+			$is_valid_order_id = false;
+
 		$tpl->assign(array(
 			'current' => self::$currentIndex,
 			'token' => $this->token,
@@ -615,7 +621,8 @@ class AdminCustomerThreadsControllerCore extends AdminController
 			'PS_SHOP_NAME' => Configuration::get('PS_SHOP_NAME'),
 			'file_name' => file_exists(_PS_UPLOAD_DIR_.$message['file_name']),
 			'contacts' => $contacts,
-			'PS_CUSTOMER_SERVICE_SIGNATURE' => str_replace('\r\n', "\n", Configuration::get('PS_CUSTOMER_SERVICE_SIGNATURE', $message['id_lang']))
+			'PS_CUSTOMER_SERVICE_SIGNATURE' => str_replace('\r\n', "\n", Configuration::get('PS_CUSTOMER_SERVICE_SIGNATURE', $message['id_lang'])),
+			'is_valid_order_id' => $is_valid_order_id
 		));
 
 		return $tpl->fetch();