Image Handler 4 (for v1.5.x) Support Thread

[DivaVocals]

1. The very fact that this module installs/writes files and installer functions/files are not removed post successful installation is not secure.

The install function was INDEED written to "clean up" after the install and it most certainly does remove the auto-installer files. (there's posts in this support thread discussing this behavior) Is this not occurring for you??? If not you will need to provide more details.

I would think that anyone installing this module could certainly and more safely run an SQL patch.

Historically this app has never used an external SQL file for install or uninstall. We wanted to maintain this level of transparency with the new version..

2. The creating of filenames which have no associated function, such as .bak is a vulnerability and PCI fail.

Already aware of this and it there is already a planned modification to address this in the next version..

There is no need for this as certainly we do not want to be overwriting existing template files anyhow. Detailed merging instructions should likely be included in the place of the "installer"

The 3 override files being overwritten are not files typically overwritten by any other add-ons -- with the exception of the two popular lightbox add-ons.. For many shopowners this is the only modification made to the 3 core files that this add-on overridess.

Nevertheless, we have no plans to replace the auto-installer simply because of this. File merging is covered in the advanced section of the install instructions. We will however be revisiting changes to the main install instructions in the next release (which should be the next day or two).

Additionally, this thread is not listed in the documentation and should be added, as the instructions for using the installer are quite complicated.... More so than just installing the module without it would be.

Chicken/egg scenario.. The support thread was created after the add-on was submitted. So there's no way I COULD HAVE included the link to the support thread in the readme..

For the record, there's a TON of add-ons that don't provide links to the support thread in their readme files AT ALL let alone a link to the support thread in the add-on description.

That all said, the plan all along was to update the readme with the next release to include this information..

I find it troubling that once installed even, deletion of these .bak files disables the module.

Not one person in testing reported anything close to this as an issue, and I can't replicate this particular behavior.. I will test again tonight to see if this bears out.. In the meantime, more details would be appreciated..