Shopping Cart Crossing Over

hdpark · June 29th, 2009, 05:46 PM

Hi Imar,

I used Chapter 9 Webshop part of your book at my shopping site program. When my customer places on Order, he has his collegue's order item on his Shopping Cart screen. But I cannot generate same condition at my computer. Can you advise me how to approach to solve this problem?

Thanks,
HD

Imar · June 29th, 2009, 06:40 PM

Hi there,

This is absolutely not enough information for me to say something useful about it. Can you elaborate? Please be as specific as possible (the scenario that's been followed, systems setup, browsers used, the relation between the customer and the colleague (e.g. do they share the same login, browser, profile, PC and so on) etc etc. Also, please be clear about what you mean with "he has his collegue's order item on his Shopping Cart screen"/ An older order? From days ago? Weeks? Or the one the colleague is seeing on his screen at the same time?

Without all this information, I am in the same boat as you are ;-)

Imar

hdpark · June 29th, 2009, 08:40 PM

Hi Imar,

Thanks Imar for your kind reply.
The website is in IIS 7. Browser : IE7
They work at same office but different PC and different login.
His collegue's Order means; User A placed item A a few minutes ago, user B added his own items then user A's ordered item A appears in user B's Shopping Cart as well. But user A's screen is no problem. It looks user B's PC read user A's cookies.

Thanks agian Imar. You are always so kind to me and everyone.
HD

Imar · June 30th, 2009, 03:33 AM

Hi again,

That is really strange.... The ShoppingCart is stored in Session state which should be unique to a user. The only reasons for this behavior that I can think of are:

1. You (or another programmer) made changes to the Wrox WebShop code and now store the shopping cart somewhere else so users can share data.

2. You're using cookieless sessions, user A went to the site, got a session identifier in the query string, sent a link to user B which then took over user A's session. A long shot, I know.....

3. Very weird stuff on the systems of your clients. Cookies are supposed to be private so I can't understand how and why user B would be able to read user A's cookies. Just like you, impossible for me to reproduce here.

Sorry I can't help much further.

Cheers,

Imar

hdpark · July 1st, 2009, 01:18 PM

Hi Imar,

I modifed it for my application as follows:
1. Display many items on the screen (Default.aspx).
2. Enter multiple items' Quantity
3. Add to Cart
4. Continue Shopping then Goto 1.

A. To do this, I used array to enter multiple items' quantity. I placed this array under App_Code as Class. Does this make Crossing Over problem?

B. I moved this array from App_Code Class to Default.aspx where I display mutiple items. Is this safe and right then?

I attached codes below:

Public Shared Quantities(500, 4) As Integer '0:index, 1:quantity, 2:prodid, 3:errormask
Public Shared dliRowCount, dliQuantity As Integer

.
.
Protected Sub btnAddAll_Click(ByVal sender AsObject, ByVal e As System.EventArgs) Handles btnAddAll.Click
Dim i As Integer
Dim j As Integer = dliRowCount - 1
Dim errMessage As String = ""
For i = 0 To j
If Quantities(i, 3) Then 'Is ever set Error mark?
errMessage = errMessage & Titles(i, 0) & ", "
End If
Next
If errMessage <> ""Then
lblResults.Text = " Over-quantities in items " & Left(errMessage, Len(errMessage) - 2) & ". Please correct Quantities!!!"
Else
For i = 0 To dliRowCount - 1
If Quantities(i, 1) > 0 Then 'Add Product when Quantity > 0
Dim myProduct As Product = ShopManager.GetProduct(Quantities(i, 2))
For j = 0 To Quantities(i, 1) - 1 'Add upto Quantity or Available
ShopManager.AddProductToCart(myProduct)
Next j
End If
Next
Response.Redirect("~/Shop/ShoppingCart.aspx")
End If
End Sub

Thanks Imar,
HD

Imar · July 1st, 2009, 01:29 PM

Ah, that explains it. Take a look at this:

Code:

Public Shared Quantities(500, 4) AsInteger' 0:index

A Shared variable exists on the class where you define it. At any tme, there's only one instance of that property throughout the entire application domain. In other words: all users have access to the same variable. If user A adds an item and user B queries the Quantities property, she'll see stuff added by user A. This is a bad design choice, as you won't be able to differentiate among users anymore. Now, take another look at my ShoopingCart property:

Code:

 
Public Shared ReadOnly Property ShoppingCart() As ShoppingCart
  Get
    If HttpContext.Current.Session("ShoppingCart") Is Nothing Then
      HttpContext.Current.Session("ShoppingCart") = New ShoppingCart()
    End If
    Return CType(HttpContext.Current.Session("ShoppingCart"), ShoppingCart)
  End Get
End Property

Althrough the property itself is marked as shared, its backing store is user scoped. This gives each user a unique shopping cart which isn't shared by others.

Hope this helps,

Imar