Image Handler 4 (for v1.5.x) Support Thread

[DivaVocals]

While either of those approaches will prevent the abuse of rogue HTML characters from causing trouble (XSS), it doesn't prevent the risks of specifying a path to a file that exists outside expected image folder locations (CSRF). ie: one could just manually change the image filename on the URL from images/large/IMG123.jpg to includes/templates/template_default/images/down_for_maintenance.gif ... or something dangerous like ../../../../../../etc/passwords to attempt to access files entirely outside of the website and into the core operating system.
That said, attempts to access ../../../etc/passwords would fail to disclose the actual file contents to the browser because webservers won't output the contents of those files via an IMG tag.

But you *could* put a URL in there and use it to load a malicious image file from a COMPLETELY DIFFERENT SERVER, and have it run the rogue code in your browser, and thus infect your computer, taint your browser cache, start rogue sessions someplace, steal your cookie data, and trick you into disclosing admin or other password credentials.
Consider this:

http://example.com/index.php?main_pa.../test_demo.jpg
While that produces an image of 0 height or 0 width because the file can't be located on the local server, it does still set the src= value to the external URL because IH isn't verifying that the file exists on the local server, and is just allowing any random file to be loaded into that IMG tag, regardless of whether that file is malicious or not.

That's why the original ZC code at least runs file_exists() on $_GET['products_image_large_additional'] to make sure the file is present locally.

I'd suggest that if the previous code "change" is causing problems with finding the correct image and thus triggering the NoPicture response, that something's wrong with what's being passed as the image URL when the popup link is generated. So that's in the IH additional_images module or the template, not in the popup code which is where you were looking in the code questions you posted about today.

Which makes this issue OFFICIALLY over my head to fix.. So I'm hoping that someone in the community who is following this thread can provide some insight.. Because I got nothing here..

Thanks Dr Byte for weighing in here..

[DivaVocals]

Which makes this issue OFFICIALLY over my head to fix.. So I'm hoping that someone in the community who is following this thread can provide some insight.. Because I got nothing here..

Thanks Dr Byte for weighing in here..

So I still don't know the fix, but I THINK I possibly have found the offending line that is causing the problem... (from includes/modules/YOUR_TEMPLATE/additional_images.php highlighted in red)

//  Begin Image Handler changes 1 of 2
//next line is commented out for Image Handler
//  $flag_has_large = file_exists($products_image_large);
    $flag_has_large = true;
//  End Image Handler changes 1 of 2
    $products_image_large = ($flag_has_large ? $products_image_large : $products_image_directory . $file);
    $flag_display_large = (IMAGE_ADDITIONAL_DISPLAY_LINK_EVEN_WHEN_NO_LARGE == 'Yes' || $flag_has_large);
    $base_image = $products_image_directory . $file;
    $thumb_slashes = zen_image(addslashes($base_image), addslashes($products_name), SMALL_IMAGE_WIDTH, SMALL_IMAGE_HEIGHT);
//  Begin Image Handler changes 2 of 2
//  remove additional single quotes from image attributes (important!)
    $thumb_slashes = preg_replace("/([^\\\\])'/", '$1\\\'', $thumb_slashes);
//  End Image Handler changes 2 of 2

When I remove this IH line and un-comment the Zen Cart default, the popup works correctly, BUT it no longer pulls the image from the bmz_cache folder..

[mc12345678]

So I still don't know the fix, but I THINK I possibly have found the offending line that is causing the problem... (from includes/modules/YOUR_TEMPLATE/additional_images.php highlighted in red)

//  Begin Image Handler changes 1 of 2
//next line is commented out for Image Handler
//  $flag_has_large = file_exists($products_image_large);
    $flag_has_large = true;
//  End Image Handler changes 1 of 2
    $products_image_large = ($flag_has_large ? $products_image_large : $products_image_directory . $file);
    $flag_display_large = (IMAGE_ADDITIONAL_DISPLAY_LINK_EVEN_WHEN_NO_LARGE == 'Yes' || $flag_has_large);
    $base_image = $products_image_directory . $file;
    $thumb_slashes = zen_image(addslashes($base_image), addslashes($products_name), SMALL_IMAGE_WIDTH, SMALL_IMAGE_HEIGHT);
//  Begin Image Handler changes 2 of 2
//  remove additional single quotes from image attributes (important!)
    $thumb_slashes = preg_replace("/([^\\\\])'/", '$1\\\'', $thumb_slashes);
//  End Image Handler changes 2 of 2

When I remove this IH line and un-comment the Zen Cart default, the popup works correctly, BUT it no longer pulls the image from the bmz_cache folder..

So here is the code that works for the includes/modules/YOUR_TEMPLATE/additional_images.php:

  for ($i=0, $n=$num_images; $i<$n; $i++) {
    $file = $images_array[$i];
    $products_image_large = str_replace(DIR_WS_IMAGES, DIR_WS_IMAGES . 'large/', $products_image_directory) . str_replace($products_image_extension, '', $file) . IMAGE_SUFFIX_LARGE . $products_image_extension;
//  Begin Image Handler changes 1 of 2
//next line is commented out for Image Handler
	if (function_exists('handle_image')) {
		$newimg = handle_image($products_image_large, addslashes($products_name), LARGE_IMAGE_WIDTH, LARGE_IMAGE_HEIGHT);
		list($src, $alt, $width, $height, $parameters) = $newimg;

		$products_image_large = zen_output_string($src);
	} 
	
	$flag_has_large = file_exists($products_image_large);
//  End Image Handler changes 1 of 2

To be coupled with the following code in the includes/templates/YOUR_TEMPLATE/popup_image_additional/tpl_main_page.php file:

<?php
/**mod Image Handler 4.1
 * Override Template for common/tpl_main_page.php
 *
 * @package templateSystem
 * @copyright Copyright 2005-2006 Tim Kroeger
 * @copyright Copyright 2003-2005 Zen Cart Development Team
 * @copyright Portions Copyright 2003 osCommerce
 * @license http://www.zen-cart.com/license/2_0.txt GNU Public License V2.0
 * @version $Id: tpl_main_page.php,v 2.0 Rev 8 2010-05-31 23:46:5 DerManoMann Exp $
 */
?>
<body id="popupAdditionalImage" class="centeredContent" onload="resize();">
<div>
<?php
// $products_values->fields['products_image']
//Begin Image Handler changes 1 of 2
//the next line is commented out for Image Handler 3
  if (file_exists($_GET['products_image_large_additional'])) {
//End Image Handler changes 1 of 2
  echo '<a href="javascript:window.close()">' . zen_image($_GET['products_image_large_additional'], $products_values->fields['products_name'] . ' ' . TEXT_CLOSE_WINDOW) . '</a>';
//Begin Image Handler changes 2 of 2
//the next three lines are commented out for Image Handler 3
  } else {
    echo '<a href="javascript:window.close()">' . zen_image(DIR_WS_IMAGES . PRODUCTS_IMAGE_NO_IMAGE, POPUP_ADDITIONAL_NO_IMAGE . ' ' . TEXT_CLOSE_WINDOW) . '</a>'; /*v4.3.1c-lat9*/ 
  }
//End Image Handler changes 2 of 2
?>
</div>
</body>

The above code does a check for the existence of the file on the server, and goes to present an image which if the image path is wrong/a non-image on the server, would not display anything as indicated by Dr. Byte if I understood correctly.

There are changes that probably should be made to Zen Lightbox, which I have worked out some; however, that is to be carried on/over to the Zen Lightbox forum @ http://www.zen-cart.com/showthread.p...read&p=1215670. Something related to that may be posted in the next day or two as I have some prior commitments to engage in, so I apologize if it appears that I have abandoned the community on such an important issue.

BTW, this is still code that is in development and is provided for review by others that might be able to chime in on the validity/security of it's use. Use at your own risk. Test locally before applying to a live server.

[mc12345678]

Thank you for your suggestions.

Not to chaise my own tail for many hours to come, I installed zen cart and IH4 again afresh. The installation went as expected, and I do not see at the moment any problems. Currently, I do not have Lightbox installed but I will install it tomorrow after I see that the IH4 operates in all browsers as expected.

The only issue I currently have, which I have not experienced in my first installation of IH4, is that IH4 does not re-size the image when I am inserting it for a new product. Since I am inserting the largest image I have (about 180K) as my smallest/default image, IH4 inserts small, medium, and large images making them of the same size - 180K. This issue would not be a problem because I do not want to activate hover function, but this issue lets me know that something is wrong and has to be fixed before I go ahead and install Lightbox.

Could you please let me know what I am missing this time.

Thank you.

So, I know that DivaVocals after being up until late last night is out there now, but if I understand correctly, you have uploaded a "small" file (which probably has small dimensions as well). IH4 does not increase the size of the image, but rather reduces the dimensions of a large image down to the desired maximum settings, and if properly setup will maintain perspective of the image. This is an attribute that is covered in the instructions. It may not be presented straight forward (I can't recall, but I know the above to be relatively accurate without referring to it); however, if while reading you piece everything together, then you will see all that this can do, and CAN NOT do...

Mind you, and congratulations on the successful install; however, there is still some code development ongoing as you can see above to resolve an issue of having multiple images for a single product. Unfortunately this has been made known to be an issue when Zen Lightbox is installed but turned off and also with IH4 in it's basic installation. These are two separate issues; however, may be resolved either with simply a correction of IH4 where it appears the above fix is most appropriately applied, or by adding more code into the template file, but that is more of a patch rather than a well written program.

[DivaVocals]

So, I know that DivaVocals after being up until late last night is out there now, but if I understand correctly, you have uploaded a "small" file (which probably has small dimensions as well). IH4 does not increase the size of the image, but rather reduces the dimensions of a large image down to the desired maximum settings, and if properly setup will maintain perspective of the image. This is an attribute that is covered in the instructions. It may not be presented straight forward (I can't recall, but I know the above to be relatively accurate without referring to it); however, if while reading you piece everything together, then you will see all that this can do, and CAN NOT do...

You are correct.. IH4 works exactly as you have stated.. This point IS indeed covered in the readme file, and on the intro post on THIS support thread, and in the module description in the download section.. In other words, the co-collaborators and I who wrote the readme documents for IH4 made sure that this point was CRYSTAL clear..

[EHSI]

Thank you for the reply.

Yes, I read instructions several times and I 'believe' I understand how IH4 works. In my first inhalation, the IH4 allowed me to insert the largest image in the third window (large image window) and then itself reduced that large image to medium and small sizes. So, the three images I saw for my product were having sizes, for example, as follows:

5K - small
15K - medium
150K large

In the current installation of the IH4, IH4 does not allow me to insert my large image as a large one and informs me that I must insert a default image which is a small image. When I insert the default small image, the IH4 does not re-size them to medium and large sizes and the images for my product have all the same sizes, for example, as follows:

150K - small
150K - medium
150K - large

Again, this issue would not be a problem because I do not want to activate the hover function, but this issue lets me know that something is wrong and has to be fixed before I go ahead and install Lightbox.

[DivaVocals]

Thank you for the reply.

Yes, I read instructions several times and I 'believe' I understand how IH4 works. In my first inhalation, the IH4 allowed me to insert the largest image in the third window (large image window) and then itself reduced that large image to medium and small sizes. So, the three images I saw for my product were having sizes, for example, as follows:

5K - small
15K - medium
150K large

In the current installation of the IH4, IH4 does not allow me to insert my large image as a large one and informs me that I must insert a default image which is a small image. When I insert the default small image, the IH4 does not re-size them to medium and large sizes and the images for my product have all the same sizes, for example, as follows:

150K - small
150K - medium
150K - large

Again, this issue would not be a problem because I do not want to activate the hover function, but this issue lets me know that something is wrong and has to be fixed before I go ahead and install Lightbox.

This is absolutely NOT how the image upload works.. Go back to the usage tab, and go to the part that starts with:
"It's all very straightforward. But let's talk about where some folks get stuck: adding primary and additional product images. Let's begin by walking through the process of adding an image to a product. The important thing to understand is that the process is the same whether you're adding your first image or your tenth to a given product"

You will see that you MUST upload a default image.. I suggest re-reviewing this section again (pay special attention to the "Important Notes:") so you understand how the default, medium and large image upload options work..

[EHSI]

This is absolutely NOT how the image upload works.. Go back to the usage tab, and go to the part that starts with:
"It's all very straightforward. But let's talk about where some folks get stuck: adding primary and additional product images. Let's begin by walking through the process of adding an image to a product. The important thing to understand is that the process is the same whether you're adding your first image or your tenth to a given product"

You will see that you MUST upload a default image.. I suggest re-reviewing this section again (pay special attention to the "Important Notes:") so you understand how the default, medium and large image upload options work..

Thank you for the reply.

OK, maybe I do not remember exactly how the first installation of the IH4 worked, but now it works properly now and it forces me to upload a default image first. My default image is the largest image and has size of 150K. Unfortunately, you did not answer my question which is:

Why all three sizes of images (small, medium, and large) have the same size of 150K. Why does not the IH4 re-size them appropriately?

I know that in my first installation of the IH4, it re-sized the small, medium, and large images accordingly now all three images have the same (large) size. Maybe I did not activate some function?

[DivaVocals]

So here is the code that works for the includes/modules/YOUR_TEMPLATE/additional_images.php:

  for ($i=0, $n=$num_images; $i<$n; $i++) {
    $file = $images_array[$i];
    $products_image_large = str_replace(DIR_WS_IMAGES, DIR_WS_IMAGES . 'large/', $products_image_directory) . str_replace($products_image_extension, '', $file) . IMAGE_SUFFIX_LARGE . $products_image_extension;
//  Begin Image Handler changes 1 of 2
//next line is commented out for Image Handler
    if (function_exists('handle_image')) {
        $newimg = handle_image($products_image_large, addslashes($products_name), LARGE_IMAGE_WIDTH, LARGE_IMAGE_HEIGHT);
        list($src, $alt, $width, $height, $parameters) = $newimg;

        $products_image_large = zen_output_string($src);
    } 
    
    $flag_has_large = file_exists($products_image_large);
//  End Image Handler changes 1 of 2

To be coupled with the following code in the includes/templates/YOUR_TEMPLATE/popup_image_additional/tpl_main_page.php file:

<?php
/**mod Image Handler 4.1
 * Override Template for common/tpl_main_page.php
 *
 * @package templateSystem
 * @copyright Copyright 2005-2006 Tim Kroeger
 * @copyright Copyright 2003-2005 Zen Cart Development Team
 * @copyright Portions Copyright 2003 osCommerce
 * @license http://www.zen-cart.com/license/2_0.txt GNU Public License V2.0
 * @version $Id: tpl_main_page.php,v 2.0 Rev 8 2010-05-31 23:46:5 DerManoMann Exp $
 */
?>
<body id="popupAdditionalImage" class="centeredContent" onload="resize();">
<div>
<?php
// $products_values->fields['products_image']
//Begin Image Handler changes 1 of 2
//the next line is commented out for Image Handler 3
  if (file_exists($_GET['products_image_large_additional'])) {
//End Image Handler changes 1 of 2
  echo '<a href="javascript:window.close()">' . zen_image($_GET['products_image_large_additional'], $products_values->fields['products_name'] . ' ' . TEXT_CLOSE_WINDOW) . '</a>';
//Begin Image Handler changes 2 of 2
//the next three lines are commented out for Image Handler 3
  } else {
    echo '<a href="javascript:window.close()">' . zen_image(DIR_WS_IMAGES . PRODUCTS_IMAGE_NO_IMAGE, POPUP_ADDITIONAL_NO_IMAGE . ' ' . TEXT_CLOSE_WINDOW) . '</a>'; /*v4.3.1c-lat9*/ 
  }
//End Image Handler changes 2 of 2
?>
</div>
</body>

The above code does a check for the existence of the file on the server, and goes to present an image which if the image path is wrong/a non-image on the server, would not display anything as indicated by Dr. Byte if I understood correctly.

There are changes that probably should be made to Zen Lightbox, which I have worked out some; however, that is to be carried on/over to the Zen Lightbox forum @ http://www.zen-cart.com/showthread.p...read&p=1215670. Something related to that may be posted in the next day or two as I have some prior commitments to engage in, so I apologize if it appears that I have abandoned the community on such an important issue.

BTW, this is still code that is in development and is provided for review by others that might be able to chime in on the validity/security of it's use. Use at your own risk. Test locally before applying to a live server.

This isn't fully working for me.. While the correct additional image is pulled from the bmz_cache folder and is now showing in the popup, the popup window itself is not sized correctly.. (see here: http://eitestsite(dot)eyeitalia(dot)...roducts_id=331)

[mc12345678]

This isn't fully working for me.. While the correct additional image is pulled from the bmz_cache folder and is now showing in the popup, the popup window itself is not sized correctly.. (see here: http://eitestsite(dot)eyeitalia(dot)...roducts_id=331)

If have reviewed the image correctly, it should be 600x60 as the largest size correct? instead of 250 x 600? Hmm.. On my site, when I changed the max height and had it pop up, it shrunk like I expected it to do... This would most likely be an indication that the variables LARGE_IMAGE_WIDTH should be replaced with $ihConf['large']['width'] and LARGE_IMAGE_HEIGHT be replaced with $ihConf['large']['height'] in the above code. I say that because I assume that the goal is to consistently show a window that is of the same size for all images that are to be displayed as large. Something of a guess at this point, sorry.