[Done v1.3.9h] HTML tags show after upgrade to 1.3.9g

I reinstalled the language paypal.php file from 1.3.9f and all is back in order.

wilt:

Are you talking about the define pages, or some other preview ???

I haven't used the Define Pages since the update yet. Honestly, I'm a little hesitant to do so. I'm referring to the Product Preview page that you get after you add a new product.

Will your whitelist fix that or should I just wait for something more permanent?

Hello

I just downloaded and installed a clean copy of 1.3.9g.
Same problem of HTML tags showing on the product preview pages (admin side) and define_main_pages (store side)

I installed CKEditor by: Kuroi
same problmes outlined above

I then applied Wilts patch.
This fixed the problems of HTML tags appearing on define_main_pages (store side) when using both HTMLarea and CKEditor.

One thing that worried me is delia's comment of "Creating a whole 'nother file that will be obsolete soon is not a great option for me". Is the Wilt patch just a quick fix?
If so, i think i will wait for 1.3.9g1 or 1.3.9h before upgrading my live shop.

Because "Some contributions may be affected, and if so the entry boxes affected in those contributions may need whitelisting in a similar manner to the above, but array('file_contents'); will need to be changed to add the name attribute of the form entry box - wilt" goes over my head, and i have about 30+ add-ons installed.

Folks, the PRODUCT PREVIEW page display issue is NOT a bug.
While you may dislike the way the preview shows, it is unfortunately necessary in order to protect YOU against XSS attacks on your admin area.
Clicking Save on the product-preview screen SAVES IT PROPERLY.

Mr Byte, is the Wilt fix a permanent fix for the define_main_pages bug and going to be added to 1.3.9g or 1.3.9h fileset, therefore upgrading to 1.3.9g now is OK.

Or should I wait a while for further news on this?

Thanks
Michael

Dr. Byte, please speak to the problem of the define pages not showing correctly on the client side. What I'm hearing so far is that the extra file has to be added for the define pages. Is this a permanent solution? A bug? Please clarify because this has made using the define pages impossible for the average cart owner.

dutchy:

Mr Byte, is the Wilt fix a permanent fix for the define_main_pages bug
delia:

Dr. Byte, please speak to the problem of the define pages not showing correctly on the client side.
I think this is clear...
DrByte:

While you may dislike the way the preview shows, it is unfortunately necessary in order to protect YOU against XSS attacks on your admin area.
Clicking Save on the product-preview screen SAVES IT PROPERLY.

Sorry Kobra. I don't mean to be rude, but if it were clear, two of use would not have felt the need to ask if this fix is permanent and we are good to go.

"yes/no this is/isn't a permanent fix for the define_main_pages " is clear

Yes. Treat it as a "permanent" fix.

For now.

There are numerous other far more important fixes in 1.3.9g that warrant the upgrade. Don't hold it off just for this trivial issue. Use the fix supplied.

brilliant, thanks for the top work!
I shall not delay in 1.3.9g upgrade.

Thank you guys! I added that extra cofig file per the instructions and working great! Just wanted to let you know you are appreciated! :clap:

petek:

I reinstalled the language paypal.php file from 1.3.9f and all is back in order.

Why did I type paypal.php ? What I meant is that I reinstalled admin/includes/modules/product/preview_info.php.

Everything for me is now working fine.
Great thankyou

Hello,
Sorry guys, all fixed up on the front page showing html, yeehaw, but now my html on my banners are showing in the side boxes. No images ,just the code pops up on front end. What should I do to fix it.
Thanks!

NOTE: THE FOLLOWING CODE HAS BEEN SUPERCEDED BY THIS POST: http://www.zen-cart.com/forum/showthread.php?p=941839#post941839

Try using for the extra_white_list.php file:
/admin/includes/extra_configures/extra_white_list.php

and put into that file the code:

<?php
$global_xss_whitelist = isset($global_xss_whitelist) ? $global_xss_whitelist : array();
$my_whitelist  = array('file_contents', 'banners_html_text');
$global_xss_whitelist = array_merge($my_whitelist, $global_xss_whitelist); 

and then try to edit the define_main_page.php or Banner HTML once more and save it to see if this displays correctly now?

NOTE: the file
/admin/includes/extra_configures/extra_white_list.php

is a file that you create for this code ...

Not just yea but hell yea! Thanks! All good here. I saw I needed to edit something in the array line but I do not know code very well. But I do follow instructions well lol. Gimme something to copy and paste and tell me where to paste it and Im good. Thank you for your help.

I've applied the patch as outline but now my banners on the front page no longer interpate the HTML code:

It works for the other pages, but not the banner.

http://www.daisygirlstshirts.com/index.php?main_page=index

Any idea what to do here?

It seems my only alternative is to load all the old files that were replaced for the upgrade since this newest fubard my site.

azimpact:

I've applied the patch as outline but now my banners on the front page no longer interpate the HTML code:

It works for the other pages, but not the banner.

http://www.daisygirlstshirts.com/index.php?main_page=index

Any idea what to do here?
Um ... the fix Ajeh posted above will handle banners.

I applied the fix and it worked for everything except the front page banner.

If I use HTML text instead of the image, all that displays is the actually HTML, not the output of the HTML.