PHP inside ezpages

[finlander]

hey Glenn, yeah, now I'm a little confused, but things work fine.

I did wonder why that 'new_products = false' code was in there when I first looked at this file to add the not-home-page code, but the new products centerbox was displaying fine everywhere before adding the not-home-page code, and now is displaying fine everywhere except the home page, which is what we wanted.

So, yeah, I have no idea why that 'false' code doesn't interfere .. but the 'true' test below it is maybe reversing it (when Admin >> Config setting does have have New Prods centerbox set to display). This is what you are calling the 'resetting' test? Maybe that 'false' code is there so that this file's code simply makes sure that New Prods centerbox is totally off before running the main part of the code, which then turns the centerbox on.

[gjh42]

Since it does work correctly, I am sure that there is some testing code in the module file that is "required" after the "false" setting. That code in the other file will decide whether the sidebox should be displayed and return a true or false value accordingly.

[creamcrackers]

Not a Question, but I didn't know where else to post this.

I posted this in the infopages thread a while back. I have updated it to work with ezpages in 1.3.0

To allow PHP code to run inside a "page".

copy includes/templates/template_default/templates/tpl_page_default.php to
includes/templates/*your template*/templates/

Then edit the new copy as such
find between "<div></div>"

echo $var_pageDetails->fields['pages_html_text'];

and replace with:

$titlecheck=substr($var_pageDetails->fields[pages_title],0,9);
if ($titlecheck=="allowcode"){
eval(stripslashes($var_pageDetails->fields['pages_html_text']));}
else{echo $var_pageDetails->fields['pages_html_text']; }

Change "allocode" to whatever name you want your php code ezpages to have, or add more names or remove the if alltogether if you want. (dont forget to change ,0,9 to ,0,x where x is the length of your "allowcode" replacement string.

I hope this is helpful. (I notice that someone else was looking to use include in infopages or ezpages, That's exactly what I am doing. Apparently That person didn't dig deep enough in the other thread, it was 30+ pages long.)

HI
I cant understand
allowcode is my page title (ie the <h1> of my ezypage?) or is it the url /my_ezy_url ? That would be rewritten though because i use seo url mod

And the 0,9... what is that exactly? Change the 9 to the number of characters in my code? Does that include spaces?

[creamcrackers]

Also - with the second example

<div><?php eval(stripslashes('?>' . $var_pageDetails->fields['pages_html_text'])); ?></div>

Which he said is a security issue - is this just a security issue that someone with access to admin area could put some code into ezy pages or could a "customer" enter php somewhere and steal info from my database etc? Customers are able to enter details into ZC database and the file to edit ncludes/templates/template_default/templates/tpl_page_default.php is not just a ezy pages file its the main template default page for the whole site isnt it? Shouldnt it be changing the ezy page template file somewhere instead?

[apogeerockets]

So, at this point, the FCKEditor is apparently retired. While I can still download FCKEditor v2.6.6, the current editor is CKEditor 3.6.1 (3.4 for zencart). The CKEditor is still fracking up my PHP and adding code (!-- and -- to essentially comment it out) to make it not work. does anyone know if the FCKEditor hack mentioned at the beginning of the thread works for CKEditor too?

Ideally, what I'm trying to do in the end is be able to write in php into the EZpages and product page descriptions some php that allows specific products to be added to the cart from those non-standard pages.

[hermes369]

I created a directory under /templates/my_template/php. I can call requires from there so far using the get-template-dir method; I'm trying to put several SmugMug galleries on an ez-page. I'm using phpSmug but haven't made it too far.

I am wondering about security implications and even though my plan is to use OAuth, I remain somewhat concerned about injecting a third party within the template directory. I imagine there is a better, modular, way to enable this integration that's more secure; I just don't know what it is or how to do it. Any thoughts?

[makenoiz]

This thread was started quite a while ago so I wanted to get the current scoop on adding PHP to EZ-pages in .1.3.9h.
0) Can it still be done
1) Replace which code? Is the following still valid:

Originally Posted by TecBrat View Post
Not a Question, but I didn't know where else to post this.

I posted this in the infopages thread a while back. I have updated it to work with ezpages in 1.3.0

To allow PHP code to run inside a "page".

copy includes/templates/template_default/templates/tpl_page_default.php to
includes/templates/*your template*/templates/

Then edit the new copy as such
find between "<div></div>"
Code:

echo $var_pageDetails->fields['pages_html_text'];

and replace with:

Code:

$titlecheck=substr($var_pageDetails->fields[pages_title],0,9);
if ($titlecheck=="allowcode"){
eval(stripslashes($var_pageDetails->fields['pages_html_text']));}
else{echo $var_pageDetails->fields['pages_html_text']; }

Change "allocode" to whatever name you want your php code ezpages to have, or add more names or remove the if alltogether if you want. (dont forget to change ,0,9 to ,0,x where x is the length of your "allowcode" replacement string.

I hope this is helpful. (I notice that someone else was looking to use include in infopages or ezpages, That's exactly what I am doing. Apparently That person didn't dig deep enough in the other thread, it was 30+ pages long.)

2) FCKEditor?
3) Security Issues?

Thank you

[makenoiz]

Nevermind, I just did it using the simple method and its working great on 1.3.9h. Did not do anything with FCKeditor.

[David R]

The Eval approach has worked perfectly for me (since I reverted to the standard editor), but I'm having trouble using it to call any file that's not in the root directory. If I try to have the page code access anything in includes, etc., it comes back as an "access denied."

I suppose it may be OK to put files into the root directory, but I'm a little worried about it.

Some of the threads mention changing the .htaccess file, but I wasn't able to get that to produce any result.

What I'm doing is using the ez page to display member account data from an external service we provide them. So they can see their list of transactions when logged in to their Zen Cart account. If they aren't logged in, the page isn't accessible.

The php page to generate the display has to pull data from the MySQL database based on their customer number and use that to query the external system. So there are two systems worth of data access that I'd like to keep as protected as possible.

[DrByte]

Right. All php file access inside the includes folder is off-limits to scripts running from a browser.
I strongly suggest from a security standpoint that EZ-Pages is the WRONG place to be injecting PHP code. Period.

Call a file in the root directory. If it's not written with enough security to be put there, then it ought not to be on your site at all.