User tracking mod

[starrysky]

Good morning,

I am using zen-cart on a site that does not receive purchases, but it is convenient to use ZC since it has a great user interface. Thus, I am still using 1.3.8a, and php version 5.2.17. I have not upgraded the site recently. There are some add-ons that we use, such as user tracking, sitemap, and seo urls. The issue I am having is not exactly an issue, more of a question about this plug-in specifically.

I use godaddy as my hosting provider, and they have a limit on database sizes of 200mb. I think they have changed it recently to make the amount of available space higher, but I am not sure (their tech support person told me they have removed this limit). This user tracking mod appears to be able to only write to the database. Since I have several bots that visit the site, and there is no way to block tracking on every one since their ip addresses change regularly, the user tracking database file grows quite large. I am not sure what version of this module I am using, since I can't find where it says the version in either the config page or the tracking page. I believe it was a version that was installed in 2009, so it is either version 1.3.6.2 or 1.4.0.

What I am wondering is, is there a way to cause the module to write the data to a file on the server instead of to the database? Does the new version do this, as opposed to writing to the database? I cannot find a way to change this aspect of the module in the configuration section. If I purge all the records in the last 72 hour period, then I would lose the data for the visitors in that period. So, I am simply looking for a way to make the database stop growing. I did not see writing to the database mentioned as something that was changed in later versions, so I am wondering if that was something that is different now. If it is a simple fix such as this, I will install the new version right away.

Alternatively, is there a different module that would work more in the way that I have mentioned? Any help on this matter is appreciated. Thank you.

[mc12345678]

For what it's worth (FWIW) the most recently posted version is not the one that contains other improvements, one of which is that the deletion period is customizable by date/tme (not size of table) in the format of delete everything that is beyond x hours/days/weeks/months in the past... There is also a swtch to change how/when to log (does not provide a file version of this) as discussed in the past and in some of the documentation provided in various versions of the plugin.

The plugin as it stands two versions ago should be compatible with your version of ZC as well as with ZC 1.5.4. Thing is I botched the instructions (SQL) for new users (though I thought a corrected version was eventually published). A somewhat revised version using post commands instead of get commands was provided for further development; however, other priorities have gotten in the way of further development. One additional feature considered for addition was to autodelete historical information at a point independent of the manual method (with expectation of it being further in the past than the manual setting.)

As for a file download of the table, while not "easy" it can be done through phpmyadmin as well as through other backup utilities available as plugins...

[spawnie69]

I recently got my site back and I am trying to be on top of my logs and found this:

[23-Mar-2016 09:02:36 America/Denver] PHP Fatal error:  1064:You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'A=0&products_id=741', 'White Diamonds Scented Gel Candle - 120 Hour Deco Jar', '' at line 1 :: insert into user_tracking (customer_id, full_name, session_id, ip_address, time_entry, time_last_click, last_page_url, referer_url, page_desc, customers_host_address) values ('0', 'Guest', '', '98.226.154.95', '1458745356', '1458745356', '/index.php?main_page=product_info\'A=0&products_id=741', 'http://gelcandlecompany.com/index.php?main_page=product_info'A=0&products_id=741', 'White Diamonds Scented Gel Candle - 120 Hour Deco Jar', 'c-98-226-154-95.hsd1.il.comcast.net') ==> (as called by) /xxxxx/xxxxx/public_html/includes/functions/extra_functions/user_tracking.php on line 70 <== in /xxxxx/xxxxx/public_html/includes/classes/db/mysql/query_factory.php on line 155

[mc12345678]

I recently got my site back and I am trying to be on top of my logs and found this:

[23-Mar-2016 09:02:36 America/Denver] PHP Fatal error:  1064:You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'A=0&products_id=741', 'White Diamonds Scented Gel Candle - 120 Hour Deco Jar', '' at line 1 :: insert into user_tracking (customer_id, full_name, session_id, ip_address, time_entry, time_last_click, last_page_url, referer_url, page_desc, customers_host_address) values ('0', 'Guest', '', '98.226.154.95', '1458745356', '1458745356', '/index.php?main_page=product_info\'A=0&products_id=741', 'http://gelcandlecompany.com/index.php?main_page=product_info'A=0&products_id=741', 'White Diamonds Scented Gel Candle - 120 Hour Deco Jar', 'c-98-226-154-95.hsd1.il.comcast.net') ==> (as called by) /xxxxx/xxxxx/public_html/includes/functions/extra_functions/user_tracking.php on line 70 <== in /xxxxx/xxxxx/public_html/includes/classes/db/mysql/query_factory.php on line 155

Yup, that's someone trying to take advantage of an old style SQL injection attack that has been caught... They were trying to cause the SQL to close out/crash and then perform some action. Problem/potential attack thwarted by the security of ZC.

[spawnie69]

Hell No! Amazing, glad to finally upgrade to 1.54.
Thank you guys!

[DrByte]

spawnie69 and mc12345678, would you be willing to test out these updates to verify that I've not broken anything while cleaning it up a bit (okay, a lot)?

[mc12345678]

spawnie69 and mc12345678, would you be willing to test out these updates to verify that I've not broken anything while cleaning it up a bit (okay, a lot)?

Before downloading, may I ask which version was used as a "template" if any at all? As identified earlier in this thread, the most "recent" upload was nothing new but was actually from years ago with a correctly formatted install SQL for new users...

[DrByte]

Sigh.

I used this: https://www.zen-cart.com/downloads.php?do=file&id=159

And I didn't touch the install SQL file.

I didn't incorporate any code changes posted in this thread, as I haven't studied the 700 previous posts here.
I did observe that there are probably a number of things in the admin pages of this plugin that could probably use improving. I did touch those just to fix some potential sanitization issues and HTML markup errors, and PHP compatibility issues.

[mc12345678]

I used this: https://www.zen-cart.com/downloads.php?do=file&id=159

And I didn't touch the install SQL file.

I didn't incorporate any code changes posted in this thread.

That's what I was afraid of. Please read the following and adjacent posts. https://www.zen-cart.com/showthread....13#post1276013

Guess I have nothing to complain about seeing as I didn't take further action to fix the overall issue even when a slightly reworked version was otherwise provided. Ohh well. Moving on. Will see what there is to see related to above expecting to be both happy and disappointed at the same time.

[mc12345678]

spawnie69 and mc12345678, would you be willing to test out these updates to verify that I've not broken anything while cleaning it up a bit (okay, a lot)?

Took a lap through comparing to the version posted two versions ago. Geo data is way out-of-date (instructions to obtain newer files are/were in the second to newest version), get statements are used throughout instead of the POST statements that had been developed/applied, I'll continue looking through and merging back into the code what didn't exist in that recently uploaded old version, without affecting the improved data capture.

The url field length I think it was was extended to 255 characters and the storage function uses 253 characters presumably to permit escaping the content. One thing that I had been concerned about was the potential of that string having some form of escape inside of it (ie. Is/was it possible), in looking at how the code had been previously rewritten, seemed like the storage "function" (SQL) was in a sequence considered more secure. Now I'm writing this 2 days following my review, so please take this concern with a grain of salt.

Otherwise I did see a few discrepancies with things like quoted commands/text and function sequences that were addressed correct in the 2 versions ago software that I'm working on. Then there is the fact that torvista had reworked the plugin to use all post features though one thing to investigate in this is if the presentation of product in a cart will display the cart adjacent to all history for that day versus the one individual's cart being applied to every entry. (Feature improvement.)