[Done v1.3.9h] HTML tags show after upgrade to 1.3.9g

The tags are also showing in the Coupon Description (customer can see) of a newly created Discount Coupon. I am using CKEditor.

p1lot:

Well,

I use a lot of HTML tags in my define pages as well as in my product descriptions.

And all < and >'s turn into < or >.

I fixed it already for the define pages, not for the product previews though.

Here the fix for "admin/define_pages_editor.php":
I added line 77 -> http://pastie.org/1191676

I did change all lines and the problem was solved.. Thanks

I had the same problem, followed Linda's instructions. Bingo all fixed. Thanks Linda!

Linda, you're heaven sent. Thank you, Thank you, Thank you. I've been the whole morning trying to figure out how to sort it out this problem, until I saw your post. Thank you!!!

Linda,

I did what you wrote and it worked II guess to a point. In the define pages editor and some ez pages that have html instead of an external or internal link it works

However in the product description pages I set the wording and it appears fine....click preview button and I see all the htm coding inserted within....yet the actual page is displaying normally on the store.

I have a couple of admns that will freak when they see the code like the product description and newsletter section. they will think that the customers will see this too.

Is there something to add to the code to stop the preview from not displaying what it will actually look like.

btw, I use CKEditor

DarkAngel:

Linda,

I did what you wrote and it worked II guess to a point. In the define pages editor and some ez pages that have html instead of an external or internal link it works

However in the product description pages I set the wording and it appears fine....click preview button and I see all the htm coding inserted within....yet the actual page is displaying normally on the store.

I have a couple of admns that will freak when they see the code like the product description and newsletter section. they will think that the customers will see this too.

Is there something to add to the code to stop the preview from not displaying what it will actually look like.

btw, I use CKEditor

answered in this post

thanks clyde, I will tell all admins inall stores that they will see this and that it is not going to show up in the store as is seen.

It does look awful and maybe at one time that will be fixed....preview may not be as important as the actual page---if they put formatting in there it is great to actually see what it will look like, as it did before.

This is only a problem in preview whilst in admin right? So as I don't use any html editors at all I can just skip this whitelist file entirely?

Also- security wise does it make a difference having a whitelist file? In other words does it open a site up to any higher risk of XSS attack?

If no is answer to second question, then I shall add it. Thanks.

This is only a problem in preview whilst in admin right? So as I don't use any html editors at all I can just skip this whitelist file entirely?
No, you will still see code in the admin preview if you do not add the whitelist you will also see it on the frontend

If you can put up with the pain a tiny bit longer then you may be able to avoid whitelisting altogether with v1.3.9h. We're working on a more convenient option which may make life simpler for everyone.

In the meantime, if you aren't entering any HTML code or encoded text like & via your admin, you won't need to whitelist anything further. If you are entering such content then whitelisting will be needed in the meantime.

kobra, Dr Byte: thanks, got it.

I've been through this thread and I can't find the answer to this question.

I am upgrading my site to version g and when I tried to enter info to my main page define pages, it just shows the html.

Here is the site link:

http://www.kanawhaplayers.org/groupieg/

It doesn't matter if I copy code from dreamweaver or use zen's editor.

If this problem has been solved and posted, please point me to the post.

Thanks in advance.

Look at this post #52 in this thread:
http://www.zen-cart.com/forum/showthread.php?p=941839#post941839

and see if that doesn't resolve the problem ...

Ajeh:

The current release v1.3.9g was just released with the added Protection and, unfortunately, is too good ... so there is the need for the "white list" at this time ...

This will all be addressed in the next release ...

It takes two seconds to open a blank file and save it as:
/admin/includes/extra_configures/extra_white_list.php

You already have the directory:
/admin/includes/extra_configures/

You want to make a file called:
extra_white_list.php

and load it to the directory:
/admin/includes/extra_configures/

and in that file copy and paste the code posted in thread #52 ...

What this code is doing is excluding certain parts of the code from the extra protection that has been added in v1.3.9g from being applied to certain areas of the Admin so that when you edit the data and enter the HTML code it is not getting this extra protection as it also is protecting you against HTML code that you need to enter in some areas of the Admin ...

For ma part I have a problem that this extra-white-list.php couldn't resolve.

For exemple I have a problem with the "Shipping & returns" file, then I created extra_white_list.php in /admin/includes/extra_configures/ and it didn't work.

Inside i wrote:
$my_whitelist = array('shippinginfo'); -> didn't work
I tried with:
$my_whitelist = array('shippinginfo.php'); -> didn't work
then tried with:
$my_whitelist = array('define_shippinginfo.php'); -> didn't work
tried with:
$my_whitelist = array('define_shippinginfo'); -> didn't work

Then I read to do this with xss_whitelist.php instead of extra-white-list.php -> didn't work

Sorry, may be I missed something?
Could somebody help me?

Create the file as in post #52 ...

This line:

$my_whitelist  = array('file_contents', 'banners_html_text', 'pages_title', 'message_html');

Hold the things that are "white listed" so that they work with the issues that are currently being cleaned by the security methods so that they do NOT get cleaned ...

You cannot just make up things for this white list ... they have to be the proper values and the code has to be written properly for the white list to work ...

First, try making the exact file listed in post #52 and then try to Edit the Shipping & Returns as you normally would and save it ... see if that doesn't correct the problem ...

Ajeh:

Create the file as in post #52 ...

This line:

$my_whitelist = array('file_contents', 'banners_html_text', 'pages_title', 'message_html');

> 
> Hold the things that are "white listed" so that they work with the issues that are currently being cleaned by the security methods so that they do NOT get cleaned ...
> 
> You cannot just make up things for this white list ... they have to be the proper values and the code has to be written properly for the white list to work ...
> 
> First, try making the exact file listed in post #52 and then try to Edit the Shipping & Returns as you normally would and save it ... see if that doesn't correct the problem ...

I wrote before but have been away for the weekend. And I didn't see that you asked me a question.

My note was about this also have problem in **Install SQL Patching**.

Frank also have that problem and DrByte has notice it.

So can you update the fix to include the install sql patching? 

(I fix it by upload it in phpmyadmin but it's good for others before the 1.3.9h is ready).

Ajeh:

Create the file as in post #52 ...

This line:

$my_whitelist = array('file_contents', 'banners_html_text', 'pages_title', 'message_html');

> 
> Hold the things that are "white listed" so that they work with the issues that are currently being cleaned by the security methods so that they do NOT get cleaned ...
> 
> You cannot just make up things for this white list ... they have to be the proper values and the code has to be written properly for the white list to work ...
> 
> First, try making the exact file listed in post #52 and then try to Edit the Shipping & Returns as you normally would and save it ... see if that doesn't correct the problem ...


WAAAHOUUU!!!!!!!!!!
It works! Thank you very much.

The newsletters are also showing the HTML tags.
Will the fix also fix that.

Yes it will. That was discussed earlier in the thread.

Adding 'comments' to the white list for me fixed the problems with order updates showing on the order screen, and the emails that these send :)