wishlists 0.6

[Danielle]

I've noticed a bug with this mod. If I add an item to my wishlist that has an attribute (e.g. Size:12-18 months), it works great. If I try and add the same item again but with a different attribute (e.g. Size: 7T), it takes me to the wishlist but does not add the product with the new attribute. I think this could be a real problem, I know for myself I often like to buy matching clothes for my two boys and I would like to be able to put the same item in different sizes in my wishlist.

Any thoughts on how to fix this?

[tyankee]

In 1.51. there is NO setting in the Admin for this. I have it working on my site but have no idea what settings i'm missing? plus, where does the user go to see their Wishlists?? i can add to wishlist from a products page but under My Acccount, there is no llink for Wishlists.

[mvstudio]

Sorry if this is not the correct thread.

I'm running wishlist on one of my websites, and McAffee is throwing a Web Application Cross Site Scripting vulnerability on tpl_wishlist_find_form.php

Has anyone been able to fix this issue?

Thanks in advance for any help.

[waterbender]

Hi, is this module on the plugin page still compatible with the latest zen cart v1.5.1?

[bumba000]

So there appear to be some security issues with this module. The main holes only appear to customers logged in. That doesn't mean they have to be nice customer with all the right intentions. Simply an account and then in the name and comments area for the wish list is available and avenue for XSS. On top of that, the visitor could also put in some other code and it would be stored in the db until someone views that wishlist in their browser and the code is executed.

I'm pretty sure I have everything is buttoned up tight now. So it appears that zen_sanitize_string() will do the trick. This function needs to wrap every $_POST that is being used for echo to screen or entry into db. those $_POST being used for comparisons are not important.

There are 8 files that deal with $_POST and 6 or 7 of them need updated for security!

[lidlchris]

So there appear to be some security issues with this module. The main holes only appear to customers logged in. That doesn't mean they have to be nice customer with all the right intentions. Simply an account and then in the name and comments area for the wish list is available and avenue for XSS. On top of that, the visitor could also put in some other code and it would be stored in the db until someone views that wishlist in their browser and the code is executed.

I'm pretty sure I have everything is buttoned up tight now. So it appears that zen_sanitize_string() will do the trick. This function needs to wrap every $_POST that is being used for echo to screen or entry into db. those $_POST being used for comparisons are not important.

There are 8 files that deal with $_POST and 6 or 7 of them need updated for security!

can someone please put this into simple language for the non-technical of us.. step by step.. thanks.

[Lackew]

I found how to show the css button instead of the Log In TEXT
in tpl_product_info_display

find: echo UN_BOX_WISHLIST_LOGIN_TEXT;

replace with: echo zen_image_submit(UN_BUTTON_IMAGE_WISHLIST_ADD, UN_BUTTON_WISHLIST_ADD_ALT);

the button will show even if the customer is Not logged in.

[designsbytrina]

I don't know if it's because I'm running ZC 1.5.1, or if it's because I'm using a responsive template, but this plugin doesn't work for me. When I place the code below the Add to Cart code, it shows the text "UN_BUTTON_IMAGE_WISHLIST_ADD". That text is clickable, and then it adds the product to the shopping cart. There is no link on the site that I can click to view my wishlist.

I've been reading this thread and I don't see a solution for these problems. If there's an answer here, I'm sorry...just got tired of looking, seeing the problem, then either there's no answer or the answer doesn't work.

[DarkAngel]

I don't know if it's because I'm running ZC 1.5.1, or if it's because I'm using a responsive template, but this plugin doesn't work for me. When I place the code below the Add to Cart code, it shows the text "UN_BUTTON_IMAGE_WISHLIST_ADD". That text is clickable, and then it adds the product to the shopping cart. There is no link on the site that I can click to view my wishlist.

I've been reading this thread and I don't see a solution for these problems. If there's an answer here, I'm sorry...just got tired of looking, seeing the problem, then either there's no answer or the answer doesn't work.

this is the link i used for getting a link to view the wishlist. use your sites url then add this to it and you can add it to the drop down menus if you have it or a sidebox if you have links to the side


http://your url/remove this if not within another folder/index.php?main_page=wishlist

I have mine in the drop down menu under the Account area.

the button not showing, take a look at the files to make sure you installed the button for it or do what i did and just go to css buttons (I think that is what I did) so that my naughty buttons that i went to the trouble to make would not give me a headache for not showing too.

Maybe the responsive template---if it is not one that is offered here---could be. but it should work. but check to make sure the buttons were loaded to the server and in the right spot too.

[wtashby]

How can I adjust the left to right (horizontal) alignment of the wishlist button?

Thanks