[Done v1.3.9h] HTML tags show after upgrade to 1.3.9g

DrByte:

Making the changes discussed in this thread can't break the storefront, since they're only applicable to the admin side.

You must have something else wrong in your storefront files.
ref: https://www.zen-cart.com/tutorials/index.php?article=82

This is a brand new install. I installed it less than an hour ago, and the first change I'm trying to make to the store is the Main Page text. If I delete the extra_white_list.php file, the site works again (albeit the HTML tags are not rendered). If I upload it again, the site breaks.

I've even tried uploaded this new file to /includes/extra_configures and /admin/includes/extra_configures... and whenever I upload it either, that section of the site breaks... if its in the admin/includes/extra_configures folder, the admin sections breaks... if its in the /includes/extra_configures folder

The ONLY change I'm making is uploading this new whitelists file... if it's there, the site doesn't render and that FAQ didn't help because the site doesn't even generate any errors.

The correct location is under /admin/includes/extra_configures/
And if that's causing the admin to break, then you've got bad content in the file. Again, see the link I posted to you previously.
Maybe your copy+paste isn't reliable on your PC?

DrByte:

The correct location is under /admin/includes/extra_configures/
And if that's causing the admin to break, then you've got bad content in the file. Again, see the link I posted to you previously.
Maybe your copy+paste isn't reliable on your PC?

Thank you -- for some inexplicable reason, my copy and paste was adding \ at the end of every line, but it wasn't showing in Notepad. I opened the file up in Dreamweaver to look at the code and saw the extra 's... I rebooted the computer and it stopped doing that.

Thanks!

Most "editor" software written by microsoft is going to do that to you.

Better to use Notepad++ as a solid free replacement for MS Notepad.

http://notepad-plus.sf.net

after being kindly guided to this thread i added the file and the define page issue was resolved.

It hasn't resolved the same problem in the news and article mod manager.

Articles created there are showing as source HTML on the store side.

Any ideas?

DVDTitan:

It hasn't resolved the same problem in the news and article mod manager.
Article manager is not in the white list...

NOTE: THE FOLLOWING CODE HAS/MAY HAVE BEEN SUPERCEDED BY THIS POST: http://www.zen-cart.com/forum/showthread.php?p=941839#post941839

Not familiar with that 3rd party mod, I do not know the variable to add to

$my_whitelist  = array('file_contents', 'banners_html_text', 'pages_title', 'message_html');

Great fix.. It was weird. My site was displaying the html just fine up until today... I upgraded a few days ago and now it works again! Thanks for the info!

kobra:

Article manager is not in the white list...

NOTE: THE FOLLOWING CODE HAS/MAY HAVE BEEN SUPERCEDED BY THIS POST: http://www.zen-cart.com/forum/showthread.php?p=941839#post941839

Not familiar with that 3rd party mod, I do not know the variable to add to

$my_whitelist = array('file_contents', 'banners_html_text', 'pages_title', 'message_html');

Thanks for this, what info am i looking for in the news and article mod files to add to the white list file?

The <input> field name of the content that you're saying is mangled.

DrByte:

The <input> field name of the content that you're saying is mangled.

Looking at the news.php file could it be this?

$news_article_text = zen_db_prepare_input($_POST['news_article_text'][$lang['id']]);

Just to let anyone know who is also struggling with source HTML in the news and article manager i added to the suggested file in this thread two inputs from this mod so my file reads as follows:

<?php
$global_xss_whitelist = isset($global_xss_whitelist) ? $global_xss_whitelist : array();
$my_whitelist  = array('file_contents', 'banners_html_text', 'pages_title', 'message_html','news_article_text','news_article_shorttext');
$global_xss_whitelist = array_merge($my_whitelist, $global_xss_whitelist);
```This appears to have resolved the issue with this mod. I will also post this in the news and article mod thread as well for assistance there.

After applying the code mention before, there is still a problem on EZpages address.

When I put:
index.php?main_page=product_info&cPath=1&products_id=3

It changed into:
index.php?main_page=product_info&cPath=1&products_id=3

on the address bar.

Thanks

Same with me I am afraid. All the ezpage internal links are broken.
/index.php?main_page=product_info**&**cPath=65&products_id=180

I don't know how to fix this?

i experience the error for the shopping cart if attributes have special chars in them, how can i put that on the xss whitelist?

For the EZPages Internal Links see the current settings at:
http://www.zen-cart.com/forum/showthread.php?p=941839#post941839

Ajeh I have a question for you. I uploaded the /admin/includes/extra_configures/extra_white_list.php but still it shows like this when updating or submitting a new item. Any idea what I did wrong or is there something else I need to do. Shows ok on the catalog side. Thank you

<p><font face="VERDANA, HELVETICA, ARIAL" color="#000000" size="2" style="font-weight: bold;"> Hefty 28-oz. stein is banded all around by vintage John Deere advertising images, then tastefully trimmed in gleaming gold. A majestic mug that's a joy to behold, and a stately symbol of Heartland pride! </font><font face="VERDANA, HELVETICA, ARIAL" color="#000000" size="2" style="font-weight: bold;">Ceramic. Dishwasher safe; do not microwave. 4 1/2" diameter x 6 1/8" high.</font></p>

Thankfully I haven't done the upgrade to 'g' yet.

As this 'theoretical' xss fix is causing so many 'real' problems, could we have a thread that shows comprehensively how to fix this problem please. Trying to navigate all the comments and XTS's (cross thread solutions) in here is a nightmare.

Could I also suggest posting a 'fix' that removes this 'theoretical' xss feature completely rather than having to enter various random names into an override file? This seems the best solution until this is tested properly.

Thanks for your attempt at this feature, but better luck next time.

DrByte:

Folks, the PRODUCT PREVIEW page display issue is NOT a bug.
While you may dislike the way the preview shows, it is unfortunately necessary in order to protect YOU against XSS attacks on your admin area.
Clicking Save on the product-preview screen SAVES IT PROPERLY.

Doesn't this make the preview screen obsolete for most cart owners? They no longer can preview the product.

My apologies if I"ve missed anything else about this.

Celtic:

Thankfully I haven't done the upgrade to 'g' yet.

As this 'theoretical' xss fix is causing so many 'real' problems, could we have a thread that shows comprehensively how to fix this problem please. Trying to navigate all the comments and XTS's (cross thread solutions) in here is a nightmare.

Could I also suggest posting a 'fix' that removes this 'theoretical' xss feature completely rather than having to enter various random names into an override file? This seems the best solution until this is tested properly.

Thanks for your attempt at this feature, but better luck next time.

I am in total agreement. This is causing nightmares for me and has cost me money.

I'm about ready to back up to f and hold there.

countrycharm:

Ajeh I have a question for you. I uploaded the /admin/includes/extra_configures/extra_white_list.php but still it shows like this when updating or submitting a new item. Any idea what I did wrong or is there something else I need to do. Shows ok on the catalog side. Thank you

If you mean in the Preview, that will be that way until v1.3.9h comes out ...

We are working on this issue and do not want a bazillion patch works made for things ...

As long as the Catalog looks good you should be fine ...