Funny / Useless / Horrible code from Magento Extensions

Question

Since Let's make this fun(-ish) turned out to be a real success and after a discussion from last week on Twitter, WE decided (there are more of us) that was a nice idea to continue "the fun" with funny / useless / horrible code from third party magento extensions.
Since nobody else wanted to create the thread (myself included), the screenshot I saw today made me do it.

All code you provide must be verifiable. It should come with a link to the extension repository or at least an extension name.

But be careful of what you post. Read the module licence first and see if you are allowed to post it.

GO!

Answer 1

OK. I'll get the ball rolling.
The following code is the result of an investigation I "conducted" for this question: Hidden values in an extension - encode decode data transaction.

You can find the extension here. Somewhere in the config.xml of the extension is this:

<sdatacode>
    ZXZhbChnemluZmxhdGUoYmFzZTY0X2RlY29kZSgnalpBeGI4TWdFSVhuK0ZmUUNCbDdxTDFVSFJMUkRGR2tMbFdqT00wU1ZSSEJWNE5xd0lLTHFxcktmeTg0UzlNdVhlRGdjZDk3QnpXaUk1eFFWRHJjUG5TQVQ2SURpMjRIUG1obmkzS2VVZVBhcXlmUDYrVlBXVjJKeTVOdjBIbDQ4WDFVSjVPTWhxaFBvdzMvb25FOTV4R1hTdGVlYzJXRmdYaFE1MXhJakVBdUZjajNhYVMyQWtWc1BJb0E5M2NIc05LMVVOQXdHaVppY1FObXdNK0NIcHJWWnJmYTdObmpkcnR1Mkd0Sjhwejh1ZVdjTTJkWnVXQUtjUWhzTnU0czBrNitUd09vVUxGWlhXdUw0TFh6SDNCc0llak9WdEtaMmx3K3BYYUQ3TFVFR3lDVmw4alZvSVpGU0hFNXE4Ylk4MHkvRldsQUlKd1RoaENRbGIrTmVpZEZyMXpBLzBLL0FRPT0nKSkpOw==
</sdatacode>

The value is later used for...

eval(gzinflate(base64_decode('jZAxb8MgEIXn+FfQCBl7qL1UHRLRDFGkLlWjOM0SVRHBV4NqwIKLqqrKfy84S9MuXeDgcd97BzWiI5xQVDrcPnSAT6IDi24HPmhni3KeUePaqyfP6+VPWV2Jy5Nv0Hl48X1UJ5OMhqhPow3/onE95xGXSteec2WFgXhQ51xIjEAuFcj3aaS2AkVsPIoA93cHsNK1UNAwGiZicQNmwM+CHprVZrfa7Nnjdrtu2GtJ8pz8ueWcM2dZuWAKcQhsNu4s0k6+TwOoULFZXWuL4LXzH3BsIejOVtKZ2lw+pXaD7LUEGyCVl8jVoIZFSHE5q8bY80y/FWlAIJwThhCQlb+NeidFr1zA/0K/AQ==')));

Yep...there's an eval there..,The evaluation translates into:

$mag = $this->getMagentoVersion(); 
$mod = $this->getOPCVersion(); 
$h = $this->getCurStoreUrl(); 
$s = "mag={$mag}&mod={$mod}&hname={$h}&action=check"; 
$data = base64_encode($s); 
$hs = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS']==='on')?'https':'http'; 
$url = $hs.'://interiorwebdesign.com/magento/opclicense/opcaction.php?sdata='.$data; 
if($mode == 'test') 
    $url = $hs.'://localhost/opclicense/opcaction.php?sdata='.$data;

... you guessed it. It's a way of phoning home.

Answer 2

Handling credit card details when you shouldn't and who needs SSL anyways:

        if ($payment && $payment->getMethod() == Mage::getModel('authorizenet/directpost')->getCode()) {

            $requestToPaygate = $payment->getMethodInstance()->generateRequestFromOrder($order);
            $requestToPaygate->setControllerActionName('onepage');
            $requestToPaygate->setIsSecure((string)Mage::app()->getStore()->isCurrentlySecure());

            $dataToDPM = $requestToPaygate->getData();
            $year = $paymentData['cc_exp_year'];
            if (strlen($year) > 2) {
                $year = substr($year, -2);
            }
            $month = $paymentData['cc_exp_month'];
            if (strlen($month) < 10) {
                $month = '0' . $month;
            }
            $dataToDPM['x_exp_date'] = $month . '/' . $year;
            $dataToDPM['x_card_num'] = $paymentData['cc_number'];

            $requestQuery = http_build_query($dataToDPM);

            $ch = curl_init();
            curl_setopt($ch, CURLOPT_VERBOSE, 1);
            curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
            curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
            curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
            curl_setopt($ch, CURLOPT_POST, 1);
            curl_setopt($ch, CURLOPT_TIMEOUT, 30);
            curl_setopt($ch, CURLOPT_HTTPHEADER, Array("Content-Type: application/x-www-form-urlencoded"));
            curl_setopt($ch, CURLOPT_HEADER, 0);
            curl_setopt($ch, CURLOPT_URL, $order->getPayment()->getMethodInstance()->getCgiUrl());
            curl_setopt($ch, CURLOPT_POSTFIELDS, $requestQuery);

            $httpResponse = curl_exec($ch);

            return $this->_processAuthorizenetDirectPostResponse($httpResponse);
        }

Answer 3

Inheritance 101:

public function _prepareLayout()
{
    return parent::_prepareLayout();
}

From Featured products slider

Answer 4

Always do queries inside loop to support sales of full page cache extensions:

foreach($collection as $attribute){

            $option_images = array();

            $attribute_id = $attribute->getId();

            $_option_images = $connection->fetchAll("SELECT `option_id`, `filename` FROM {$table} WHERE `attribute_id` = {$attribute_id};");

            foreach($_option_images as $imageInfo){

                $option_images[$imageInfo['option_id']] = $imageInfo['filename'];

            }

            $attribute->setOptionImages($option_images);


        } 

The code is from one layered navigation extension.

Answer 5

Something I failed to understand, although it seems strange anyway:

Why there is a unsubscribe from product in a product stock alert e-mail?

Answer 6

Make sure, the observer doesn't run if a special block is there.

foreach (debug_backtrace() as $step) {
    if ($step['function'] == 'addOptionsToResult' || 
     (isset($step['class']) && $step['class'] == 'Mage_Adminhtml_Block_Sales_Order_Create_Search_Grid' 
     && $step['function'] == '_prepareCollection')) {
         $addOptions = true;
         break;       
    }  
}