IMPORTANT: SQL Injection fix for J2Store 3.3.3 to 3.3.6

product.php

//SQL Injection fix for J2Store 3.3.3 to 3.3.6

//File path: /administrator/components/com_j2store/helpers/product.php

//around line number 1139, you will find

     if(is_array($option_value)){
         $option_value = implode(',',$option_value);
      }


//Change this to

if(is_array($option_value)){
        JArrayHelper::toInteger($option_value);
        $option_value = implode(',',$option_value);
      }else {
        $option_value = intval($option_value);
      }

//Save

//Around line 1149, you will find

$query->where('pov.j2store_product_optionvalue_id='.$option_value);
			$query->where('pov.productoption_id='.$product_option_id);

//Change this to

$query->where('pov.j2store_product_optionvalue_id='.$db->q($option_value));
$query->where('pov.productoption_id='.$db->q($product_option_id));