Image Handler 2 (for ZC v1.3.8 ONLY) Support

[tpeck]

I really want to believe in this mod, and I have set it up yet again - and it worked (without actually using the image manager) - but what use is it if I now get errors trying to upload a simple image? Let alone the security issues you guys now bring up...

I think a lot of effort has gone into the project, but it shouldn't just be dumped and left half-broken.

[DivaVocals]

dumped and broken is a LOT of an exxageration.. Posted my findings, and have already gotten confirmation from 1 person that the fixes I made for the two issues (bmz_cache folder permissions and watermarking additional large images) works.

tpeck, the error you reported sounds like an incomplete/incorrect install.. I have installed IH2with the posted changes on a FRESH VANILLA Zen Cart install with the new fileset. You can see it in action here:
http:// zen138 . overthehillweb . com/index.php?main_page=product_info&cPath=1&products_id=1

I really want to believe in this mod, and I have set it up yet again - and it worked (without actually using the image manager) - but what use is it if I now get errors trying to upload a simple image? Let alone the security issues you guys now bring up...

I think a lot of effort has gone into the project, but it shouldn't just be dumped and left half-broken.

That's up to you.. The fix I posted solves the folder permissions issue.. (which BTW I have confirmed based on the sites I've examined only affects SOME webhosts -- your included) As for the so-called controversy, I think that's a bit of an exaggeration.. We'll have to agree to disagree on that point..

Thank you for the offer DivaVocals but I will politely decline. I have decided to manage my images the old fashioned manual way. It feels to me that image handler has too much controversy about it at the moment. I have asked my hosting provide to give me advice on this thread and they confirmed their concerns over security and advised me to not use any system, add on, module etc that uses chmod 777 for directories.

I would rather be safe than sorry.
All the best
Michael

[DivaVocals]

default template?? You mean classic?? Did you rename the custom_template directories to match the name of your template directory??

Hm, I'm having the same problems again with additional images not showing up. This is on a new install, default template.

I'll try again tomorrow, too late tonight to try any more.

*Removing image handler from database in IH admin got additional images to appear on the webpage.

[blackhalo]

dumped and broken is a LOT of an exxageration.

I have to agree...
while I'm not exactly thrilled with IH2 and it's apparent flaky'ness,
it has been working well for years now.

On top of that, to everyone...
the developers on here aren't getting paid to take everyone's crap...
about a mod that's totally free.

Lastly, (in defense of the crap-givers)...
ZenCart may be an experiment/learning experience to some developers, but it's still an eCommerce system...
that means some people's entire livelyhood ride on this... tempers run high, because there's a LOT at stake sometimes.

Anyway, I would hope the ZenCart team have integrated IH2 (hover / lightbox) functionality in the next major release...
it's honestly getting harder to deal with ZC these days... there are a handful of Web 3.0 options out there now, while ZenCart is still stuck in Web 1.5... and limping.

500 page support threads on an image/hover mod is absolutely ridiculous.

[nwms8]

default template?? You mean classic?? Did you rename the custom_template directories to match the name of your template directory??

Yeah, created a brand new zencart + IH v8c and renamed all cases of 'custom_template' into my custom name.

includes/templates/custom_template
modules/custom_template

Used the default template first and had problems with additional images showing up. Created a custom template, and also didn't work. When I turn uninstall IH from admin folder, the additional images then show up. I tried again with v8b and it worked fine; going to try again later tonight when I get back from a celebration.

well im far to hung over to be doing this.. but I will any way

I'm sure I must take your argument seriously because you wrote this nice disclaimer.

However, I would like to point you to this forum
http://www.simplemachines.org/commun...p?topic=2987.0

and this other post
http://www.simplemachines.org/commun...6205#msg246205

Which very clearly explain why having a folder run with 777 is not a security risk.

If you're afraid of outside links, here are some tidbits.

- But... wait a minute. The three numbers stand for "Owner," "Group," and "Everyone." Doesn't that mean anyone can write to the files if I make it 777? (writable by all!?)
Well, technically, yes. But, the person first has to get into your server and be able to touch the file in the first place. They also have to have access to the directory the file is in, and the directory that file is in. At some point, you should have a directory (probably your username) which isn't 777.

- Isn't it safer, at least, not to use 777? What if a hacker got in?!
If a hacker gets in and wants to cause you trouble.... there is nothing you can do. You can have the file permissions as strict as you want, but the database will be wide open. So, yeah... you can protect the files that don't change from being deleted, but not your images.
Which is more important? The files you can download again from here or the data you cannot get back?

- Isn't it unlikely a hacker would get into my server so much they could delete posts?
Not that unlikely, but no more or less likely than if they could use 777 to their advantage. Think of the database as ALWAYS 777.
___
The reason it's okay to have it 777 when you can is because the permissions on the folder it's in matter too. Typically, you'll have a structure like this:

/home/username/public_html

Now, here /home will be 755 or so, meaning everyone can access it but not everyone can create folders/files in it. It'd be owned by the server administrator. So far so good. Next, /home/username should DEFINATELY be owned by username (you) and no one else. The trick is, you can say that your "friend" is "nobody". So, then you make the /home/username directory 770 - this means only YOU and Apache/PHP can access your files, no one else.

From that point, you own every file and directory exclusively, so if a file is 770, nobody won't have access. The above tactic is used to change the "everyone" position to "PHP" instead. It's very very common, and most hosts use it.

In any case, your host requires the use of 755, not 777.
___

Anyway, I'm very glad IH exists and DivaVocals has been giving so much support on this forum. I don't see why you are complaining when they have heard you and addressed your concerns.

[DivaVocals]

I have to agree...
while I'm not exactly thrilled with IH2 and it's apparent flaky'ness,
it has been working well for years now.

Exactly!!!

Plus consider that other than the many posted and implemented tweaks to the javascript, scant little of Tim's original code has changed in all the many IH2 updates.

Lastly, (in defense of the crap-givers)...
ZenCart may be an experiment/learning experience to some developers, but it's still an eCommerce system...
that means some people's entire livelyhood ride on this... tempers run high, because there's a LOT at stake sometimes.

Speaking only for myself, this not an experiment for me. I always want to make sure I offer my client's the best available options for their website's because their livelihoods depend on it, and so I can't experiment with their sites.

My contribution to this mod since Rev 7 has always been about improving the readme documentation because I learned from experience that the key to IH2 success is in the configuration. The readme left much to be desired on that score so I wanted to make it better. So when ckosloff volunteered to undertake updating IH2, I volunteered to help with the documentation..

However, that said, I also firmly do not believe that any of the developers who have worked on IH2 since Tim's original release in 2006 were using this as a learning experience/experiment. Looking at the list of names, these are all skilled folks who's livelihoods also depend on IH2 working correctly..

Simply put it was overlooked or not fully considered that some of Tim's code now no longer works well for current hosting configurations. (which are very different from the world in which IH2/Zen Cart was born) The fact that it worked for them gave NO indication that any issues might exist for others.. So it was never looked into.. This happens ALL THE TIME in software development be it open source or commercial software.. Developers are not perfect..

No hot tempers here for me.. I'm more interested in making sure we have a good solution. Petty arguments about WHY this happened or who's at fault are not helpful. Here's what is important.. Found the issue, found the cause, so let's address it, publish it and move on.. (at least that's MY plan!)

Anyway, I would hope the ZenCart team have integrated IH2 (hover / lightbox) functionality in the next major release...
it's honestly getting harder to deal with ZC these days... there are a handful of Web 3.0 options out there now, while ZenCart is still stuck in Web 1.5... and limping.

500 page support threads on an image/hover mod is absolutely ridiculous.

Respectfully I have to agree and disagree with this..

While I think that image hovering, watermarks and such are nice features, I'm less concerned about them over the core IH2 functionality..

IMO the MOST compelling reason to install IH2 is the image management/image performance features.. The reason I install it for all of my clients is simple. Trying to explain naming conventions and how additional images have to be setup for Zen Cart to recognize them goes over all my client's heads.. Having IH2 means they don't have to know how to name their image files to add additional images to a product. IH2 does the heavy lifting for them on that score.. All I have to do is make sure they know that all the filetypes have to be the same and show them how to upload images. Easy peezy..

As for fancy hovers and lightboxes, IMHO I think the real issue is this.. To really incorporate hover and lightbox capabilities into IH2 either requires a the development of a separate module with these capabilities built in that is designed specifically to work WITH IH2

or

IH2 has to be re-written to include this functionality. Either way, since module development is a volunteer effort it will require that a volunteer decide to dedicate some time to develop such a module and then contribute it to the community.. This would be a fair amount of development, and not many are willing to devote such time to a volunteer effort.. I have paid for custom module development for other clients, and I have been giving some thought to paying a developer to extend IH2's functionality for me..

[DivaVocals]

Yeah, created a brand new zencart + IH v8c and renamed all cases of 'custom_template' into my custom name.

includes/templates/custom_template
modules/custom_template

Used the default template first and had problems with additional images showing up. Created a custom template, and also didn't work. When I turn uninstall IH from admin folder, the additional images then show up. I tried again with v8b and it worked fine; going to try again later tonight when I get back from a celebration.

Interesting.. The ONLY difference between Rev8b and the Rev8c files you now have is two files were changed to address the following:

1. Fix the issue with watermarks on large additional images
2. Possible issues with some hosts not setting the file permissions of the bmz_cache folders correctly.

Honest to goodness, I installed that same fileset on a VIRGIN Zen Cart install, turned it on and it worked.. Hmmmm..

Okay.. well go enjoy your celebration.. Try again later.. Gonna send you a PM too..

[Shane78]

no offence... But when it comes to topics of web security i will listen to the people that manage my 4 servers over anyone here, including Dr Byte.

as for 'crap giver' if i wanted to damage ZC or IH2 i would happily go about the internet slagging it off.. but i dont... how's about pulling your head out of your arse hole and checking the link in my sig?

i get frustrated with arrogance... and have found DV to be extremely arrogant over the 6 months. I have pointed out flaws, it takes constant nagging for these to get noticed... and only by my blackening of the IH2 name has DV arsed herself to look deeper.

UKF, UH and Don have all replied to my support ticket, reviewing this thread. Each have stated in their personal opinion that the 777 setting this current IH2 mod is creating is a security risk. UKF have even listed possible methods of attacking folders with 777.

Let me be clear, I dont use IH2, but I do care that a mod that is popular MAY be a cause for even the most minor of security problems when it can be avoided. Ask your self this.. would this 777 problem have been looked onto if I had not gone on and on and on...

WOULD IT F***!

NB, webfusion have not yet responded to my ticket, but then that the only account i have sharded server..;. it normally take 48 hrs..

now you can all get back to brown nosing DV. I dont care if i have annoyed upset ppl in this thread.. simply because i feel it was nessessary to get the dam thing looked into.. and it worked!

[tpeck]

I have no wish to tread on anyone's toes or make people upset who have spent hundred's of hours on this mod, but the truth sometimes hurts.

If I install zencart 1.3.9d and the latest version of IH2 only to get an error AFTER FOLLOWING THE INSTALL DIRECTIONS EXACTLY, then am I to blame?

It actually does work for me - as I reported - but now if I try to organise my images (which is the reason for bothering with it in the first place) I get an error.

This is a problem with the mod, and it is maddening to hear otherwise.

Don't forget, I and many others, have persevered with this for many years.

Why is it our fault? Oh, it's free...well, I should be so lucky.

scant little of Tim's original code has changed in all the many IH2 updates.

...but in the end it DOESN'T WORK!

So why not get it up and running properly?

[tpeck]

blackhalo wrote:

while I'm not exactly thrilled with IH2 and it's apparent flaky'ness,
it has been working well for years now

and

500 page support threads on an image/hover mod is absolutely ridiculous.

...doesn't this tell you something?

Oh, but it's free so we should be all happy about it.

Look. It doesn't work 100% - end of story.

or why do so many of us get the error:

Error!

Unable to determine the page link!

Function used:

zen_href_link('', '', 'NONSSL')

Dozens of people have written in about this - and got no answers.

The mod is flawed.