[Done v1.3.9h] HTML tags show after upgrade to 1.3.9g

DrByte,
I understand that. I simply was stating that on loading newest vers. of xamp, there was problem in where the php.ini files was located. And that maybe the (my) problem with the HTML situation could be related to xampp. IDK, my bad if i am reaching. I am just trying to work the editor problem. Is there a problem? I keep searching for the problem on my end.

Thanks!!

Personally I think using ANY upload tool in an HTML editor is a BAD thing. It leaves you open to security problems, and is really just the wrong way to put content on your site.
Thus I have no interest in even trying to figure out what might be causing you troubles with it.

DrByte,

Ok. I understand. I am not trying to upload anything. I am simply trying to add images to the define_page_editor, etc. on my test server. It use to work, now it does not. that's all

I am just a newbe, a nobody, so if my pm pissed you off, I apologize, which i thought i already did. I was a little slow in forum etiquette. Thanks for all your post which I try to learn by.

regards,

Ajeh:

I don't know off the top of my head I do not use that Best Seller scrolling Add On ...
Thanks for your help. I'm not going to worry about it to much. I can away switch the bread crumbs off. I really don't need them any way. Thanks again

so far so good, i still need to install this file into another site i did the update at but it has worked in my own too...had html showing instead of what the define page was supposed to be. It showed the html on the main page NOT just in the admin editing place...as well as the product description pages...when done they would show html not the regular people talk...lol

happy it was not me messing up the update.:clap:

Looper:

DrByte,

Ok. I understand. I am not trying to upload anything. I am simply trying to add images to the define_page_editor, etc. on my test server. It use to work, now it does not. that's all

I am just a newbe, a nobody, so if my pm pissed you off, I apologize, which i thought i already did. I was a little slow in forum etiquette. Thanks for all your post which I try to learn by.

regards,Not pissed off. Just stating a point of view. Sorry - I could have worded it differently. Apologies.

Looper:

DrByte,

Ok. I understand. I am not trying to upload anything. I am simply trying to add images to the define_page_editor, etc. on my test server. It use to work, now it does not. that's all
Personal opinions aside, I just downloaded the FCKeditor addon from the Free Addons area and installed it on my clean v1.3.9g site (with the whitelisting patch discussed in this thread). I then opened the Define Pages Editor, selected FCKeditor, and then define_main_page.php
I clicked in a spot where I wanted to insert an image, and then clicked the Image button in the button bar. I then entered the path to an image on the server: /store/images/free.gif ... and it immediately showed me that image and when I saved it the image shows just fine on the storefront.

So, unless the problem is related to you not correctly applying the whitelist update discussed at length in this thread, then it's something else you've got busted on your site.

Is there a list of variables that someone could posted that we could potentialy add to the whitelist to reduce the number of people asking how to add certain variables.
This would allow people to add and remove as needed and have all the information easy to find, also how would you do this with easy pages.

An example:
file_contents : ( description of what it affects)
banners_html_text: ( description of what it affects)

DrByte,

Thanks. Actually that helps me, I applied the whitelist patch and corrected the showing html tags, etc. so it has to be something i am doing wrong. Somewhere I saw and learned to use the FCKeditor, browse to image folder, and click the upload to server (meaning my local server). Having said that, I'll go back and make sure I know how to use the editors. That could be a bigger problem. LOL

Thanks for all,

Looper

neit:

Is there a list of variables that someone could posted that we could potentialy add to the whitelist to reduce the number of people asking how to add certain variables.
This would allow people to add and remove as needed and have all the information easy to find, also how would you do this with easy pages.

An example:
file_contents : ( description of what it affects)
banners_html_text: ( description of what it affects)

Neit, I already asked for this, but it doesn't look like it's going to happen :(

Admittedly I've only been a ZC user for about 8 months now, but it's the first time I've seen a balls-up in an upgrade. The devs normally do an awesome job. Maybe they need some more coffee bought for them :wink:

Ajeh:

Try using for the extra_white_list.php file:
/admin/includes/extra_configures/extra_white_list.php

and put into that file the code:

<?php $global_xss_whitelist = isset($global_xss_whitelist) ? $global_xss_whitelist : array(); $my_whitelist = array('file_contents', 'banners_html_text', 'pages_title', 'message_html'); $global_xss_whitelist = array_merge($my_whitelist, $global_xss_whitelist); ``` > > and then try to edit the **Define Page** or **Banner HTML** or **EZPage Title** or **Send Email** once more and save it to see if this displays correctly ... > > NOTE: the file > /admin/includes/extra_configures/extra_white_list.php > > is a file that you create for this code ... Please, please help me to understand...Stop talking greek, please.. Now if I take this right... The reason my defines pages are talking html crap all over it, has to do with some coding problem that got messed up in this 1.39g upgrade. So if I want to fix the problem until someone figures we should have a 1.39h upgrade, then I need to what? Make a folder? Then insert this code into the folder? Then upload this folder to my .... admin/includes/extra_configures/....??????? And give it the name:::: extra_white_list.php ????? Just pretend I have a box of rocks for a brain, so I need more detail please. And why doesn't someone just create this file and fix the problem? Okay, I am a box of rocks....

The current release v1.3.9g was just released with the added Protection and, unfortunately, is too good ... so there is the need for the "white list" at this time ...

This will all be addressed in the next release ...

It takes two seconds to open a blank file and save it as:
/admin/includes/extra_configures/extra_white_list.php

You already have the directory:
/admin/includes/extra_configures/

You want to make a file called:
extra_white_list.php

and load it to the directory:
/admin/includes/extra_configures/

and in that file copy and paste the code posted in thread #52 ...

What this code is doing is excluding certain parts of the code from the extra protection that has been added in v1.3.9g from being applied to certain areas of the Admin so that when you edit the data and enter the HTML code it is not getting this extra protection as it also is protecting you against HTML code that you need to enter in some areas of the Admin ...

Ajeh:

The current release v1.3.9g was just released with the added Protection and, unfortunately, is too good ... so there is the need for the "white list" at this time ...

This will all be addressed in the next release ...

It takes two seconds to open a blank file and save it as:
/admin/includes/extra_configures/extra_white_list.php

You already have the directory:
/admin/includes/extra_configures/

You want to make a file called:
extra_white_list.php

and load it to the directory:
/admin/includes/extra_configures/

and in that file copy and paste the code posted in thread #52 ...

What this code is doing is excluding certain parts of the code from the extra protection that has been added in v1.3.9g from being applied to certain areas of the Admin so that when you edit the data and enter the HTML code it is not getting this extra protection as it also is protecting you against HTML code that you need to enter in some areas of the Admin ...

I thank you very kindly for your straight forward instructions..
This did the trick, so I shall apply it to my second store also..

I tried to find info about install sql patches.

for me it change " to " sp the array was not working.

Could you give an example of what you are having a problem with? :unsure:

Did anyone not try the new version before making it available to the public because I have 2 broken websites that I will gladly let you practice on next time? Also why did you change the name of the admin folder?

I assume your going to say for security reasons BUT don't you think if a person is smart enough to hack a website they probably have downloaded zen cart to figure out how to hack it. Which would mean they would already know the name of the "secret admin folder" any way.
A month from now their will probably be a big yellow warning saying change your admin name to something other than zc_admin.

It just makes me mad that every other week their is a so called "critical update" that needs to be done and if it's not done their is all this garbage in my admin that won't go away, telling me how I need this important update, and then we do the update and it breaks our site.

Then I read one of the admin talking about not wanting a billion patches, but it's sure ok for us to have a billion updates every week. If it wasn't such a pain to do the updates that would probably help too.

Installed the Rewards Points mod today, first on my local store and then on the live site. This mod requires the installation of the included new.sql patch which adds extra boxes to Admin > Configuration.

Part of this sql is shown here:

.....

REPLACE INTO configuration
(configuration_id ,configuration_title ,configuration_key ,configuration_value ,configuration_description ,configuration_group_id ,sort_order ,last_modified ,date_added ,use_function ,set_function)
VALUES (NULL , 'Reward Point Status Track', 'REWARD_POINTS_STATUS_TRACK', '', '<b>Simple mode:</b> All new reward points are set to Pending and are changed to Earned when the Order Status changes. If the Order Status is then changed back to Pending then the reward points are transferred back from Earned.<br /><br /><b>Advanced mode:</b> Set the order status ....etc etc

The highlighted html tags are all showing just as in the quote above, no breaks are inserted into the text and no bold items show up.

Manually fixed this on my local site by editing relevant DB entries. In the DB the brackets were showing as < or >

The extra_white_list.php file is installed, it fixed the EZ Pages issue as expected but has not addressed this issue.

I know this is only of a 'cosmetic' nature and does not affect the operation of the store but is worth noting for the next upgrade.

jasong42122:

... but it's sure ok for us to have a billion updates every week.
You must be referring to some other software. I've never seen Zen Cart release a billion updates. Ever.
Come to think of it we don't even have that many lines of code in Zen Cart yet.
But, thanks for cluttering our forum with your rant. I hope you feel better after you got that off your chest.

frank, it's noted.

DrByte:

frank, it's noted.

Thanks DrByte