Image Handler 4 (for v1.5.x) Support Thread

mydanilo:

Applied all the suggested fixes to the code and all seems to work fine. What's next? Can somebody confirm that this does plug the outlined security holes?

For those just tuning in: the security hole being discussed related to a template file that was used in some versions of IH4 to display the additional images. The specific security issue was known as XSS (Cross Site Scripting) which is, in my summary, a situation where the code of one site can be or does use or access the code of another site via a function call from outside the code. In this case, a verification of existence of a local version (file) of the file/pathname combination sent to the template file shows a specific default image if the file/pathname doesn't equal a local item. If it is local, then the file/pathname is sent to be processed as an image.

So that is why it can be said that the correction addresses the XSS concern. Now IH provides a local filename when handling an image and before displaying the image, there is a verification that the image path is local.

mc12345678:

Diva, unless you get this message removed by the admins, forgive me for cross posting on this one issue.

Recognizing that there was an update needed for IH (I'm guessing all active versions are impacted) and for at least Zen Lightbox as an image handler referenced by IH4 an update to Zen Lightbox has been submitted to the plug-in review process. The update addresses only the co-existence of IH and Zen Lightbox. So other issues described in either of these forums were not incorporated into that update. Some are specific to alternate plugins and other unique situations.

Anyways, wanted to to put it out there because IH4 instructions do refer to ZLB and in this case/situation they are tied at the hip.

Right, and in answering gazag's last question I was only referring to the IH4 corrections posted in THIS support thread, not the separate (unrelated) ZLB fixes I posted in the ZLB thread as they have NOTHING to do with the IH4 fixes (and their purpose -- address a security vulnerability)

Hey there,
having some issues in the admin being able to enable/disable products from category page, I have read throuhg all of the posts i can find, ensured that the code in category_product_listing.php were correct:

if ($products->fields['products_status'] == '1') {
        echo zen_draw_form('setflag_products', FILENAME_CATEGORIES, 'action=setflag&pID=' . $products->fields['products_id'] . '&cPath=' . $cPath . (isset($_GET['page']) ? '&page=' . $_GET['page'] : '') . ((isset($_GET['search']) && !empty($_GET['search'])) ? '&search=' . $_GET['search'] : ''));?>
        <input type="image" src="<?php echo DIR_WS_IMAGES ?>icon_green_on.gif" title="<?php echo IMAGE_ICON_STATUS_ON; ?>" />
        <input type="hidden" name="flag" value="0" />
        </form>
<?php
      } else {
        echo zen_draw_form('setflag_products', FILENAME_CATEGORIES, 'action=setflag&pID=' . $products->fields['products_id'] . '&cPath=' . $cPath . (isset($_GET['page']) ? '&page=' . $_GET['page'] : '') . ((isset($_GET['search']) && !empty($_GET['search'])) ? '&search=' . $_GET['search'] : ''));?>
        <input type="image" src="<?php echo DIR_WS_IMAGES ?>icon_red_on.gif" title="<?php echo IMAGE_ICON_STATUS_OFF; ?>"/>
        <input type="hidden" name="flag" value="1" />
        </form>

and categories.php:

if ( isset($_GET['flag']) && ($_GET['flag'] == '0') || ($_GET['flag'] == '1') ) {
        if (isset($_GET['pID'])) {
          zen_set_product_status($_GET['pID'], $_GET['flag']);
        }
      }

and still cant turn them on or off, checked for error logs, none, check for console errors, none.

Anything im missing here?
ZC 1.51
IMH 4

jeffiec:

Hey there,
having some issues in the admin being able to enable/disable products from category page, I have read throuhg all of the posts i can find, ensured that the code in category_product_listing.php were correct:

if ($products->fields['products_status'] == '1') {
echo zen_draw_form('setflag_products', FILENAME_CATEGORIES, 'action=setflag&pID=' . $products->fields['products_id'] . '&cPath=' . $cPath . (isset($_GET['page']) ? '&page=' . $_GET['page'] : '') . ((isset($_GET['search']) && !empty($_GET['search'])) ? '&search=' . $_GET['search'] : ''));?>
<input type="image" src="<?php echo DIR_WS_IMAGES ?>icon_green_on.gif" title="<?php echo IMAGE_ICON_STATUS_ON; ?>" />
<input type="hidden" name="flag" value="0" />
</form>

    <input type="image" src="<?php echo DIR_WS_IMAGES ?>icon_red_on.gif" title="<?php echo IMAGE_ICON_STATUS_OFF; ?>"/>
    <input type="hidden" name="flag" value="1" />
    </form>

> and categories.php:
> ```
if ( isset($_GET['flag']) && ($_GET['flag'] == '0') || ($_GET['flag'] == '1') ) {
        if (isset($_GET['pID'])) {
          zen_set_product_status($_GET['pID'], $_GET['flag']);
        }
      }

and still cant turn them on or off, checked for error logs, none, check for console errors, none.

Anything im missing here?
ZC 1.51
IMH 4

Realize you said ZC1.5.1, but that is reminiscent of ZC1.5 and not necessarily related to IH4. When did this begin happening? Upgrade?

no, i don't really know when it started, but i didn't do any upgrades, any searches for products not turning on or off, has pointed me to IH, it was the last mod installed according to the guy who built the site, but not too sure, im just trying to fix it lol.
However viewing the page in page source shows this:

I saw someone else asking should the change all posts to gets?
could that be?

jeffiec:

no, i don't really know when it started, but i didn't do any upgrades, any searches for products not turning on or off, has pointed me to IH, it was the last mod installed according to the guy who built the site, but not too sure, im just trying to fix it lol.And it would help if we knew WHICH version on IH4 you are running.. sounds like an old version.. and if you search this thread for category_product_listing.php the fix is posted..
jeffiec:

However viewing the page in page source shows this:

<form name="setflag_products" action="http://mysite.com/my_secret_admin/categories.php?action=setflag&pID=98&cPath=3&page=1" method="post">

I saw someone else asking should the change all posts to gets?
could that be?NO..

4.2, what would be the best way to upgrade, in the instructions, it only talks about if you have installed ih3?

jeffiec:

4.2, what would be the best way to upgrade, in the instructions, it only talks about if you have installed ih3?

The way I have done it in the past, is to download (or have) both the old and new versions, compare the two to see if there are files that get deleted from the old (usually haven't seen that happen.), then once determined and made a list of which should go, compare the new and existing files to see what changes need to be made. Merge the changes into the new set of files. Delete any files previously identified and pretty much at the same time upload the entire package (so that the auto installer can do it's thing which includes making backup copies of what was to be replaced, just-in-case). But, a backup of existing files is made/available as part of any routine update.

ok, uninstalled 4.2, installed 4.3.1, still cant enable/disable, this just isn't my day.
so any searches on not being able to enable/disable from category page, brings up all about IH$, since im up to the latest and greatest and everyone else seems to be working, what else can be the issue? i have made no mods to the admin side.
Any help appreciated.
Jeff

jeffiec:

ok, uninstalled 4.2, installed 4.3.1, still cant enable/disable, this just isn't my day.
so any searches on not being able to enable/disable from category page, brings up all about IH$, since im up to the latest and greatest and everyone else seems to be working, what else can be the issue? i have made no mods to the admin side.
Any help appreciated.
Jeff

It would surprise me that the content of the following link hasn't been incorporated in an update since it was made, so first I would suggest if not done already to clear your cache and temporary files (or anything else to "refresh" your browser) while not logged into your admin, if you haven't already. If that still doesn't resolve your issue, see this link: http://www.zen-cart.com/showthread.php?194740-Image-Handler-4-%28for-v1-5-x%29-Support-Thread&p=1117504&highlight=category_product_listing.php#post1117504

The content of that link addresses the issue you are describing with the red/green button not working in the file category_product_listing.php that I went ahead and searched for seeing that you still were having an issue. If unable to still resolve, please seek paid help to address your problem, as you said, others aren't experiencing this with the updated version(s). Btw, there is some updates posted a few pages back that I have not verified as incorporated to the downloads associated with the additional_images functionality.

mc12345678:

It would surprise me that the content of the following link hasn't been incorporated in an update since it was made, so first I would suggest if not done already to clear your cache and temporary files (or anything else to "refresh" your browser) while not logged into your admin, if you haven't already. If that still doesn't resolve your issue, see this link: http://www.zen-cart.com/showthread.php?194740-Image-Handler-4-%28for-v1-5-x%29-Support-Thread&p=1117504&highlight=category_product_listing.php#post1117504

The content of that link addresses the issue you are describing with the red/green button not working in the file category_product_listing.php that I went ahead and searched for seeing that you still were having an issue. If unable to still resolve, please seek paid help to address your problem, as you said, others aren't experiencing this with the updated version(s). Btw, there is some updates posted a few pages back that I have not verified as incorporated to the downloads associated with the additional_images functionality.

Not sure I fully understand what you are saying, have cleared all temp files and the link you posted matches what that file already has, remember, I uninstalled and re-installed to 4.3.1 IH is working fine.

Telling someone they need to pay for help can be taken a few ways, i will for arguments sake, take it in a neutral way.

So what you are saying is instead of sharing ideas, with fellow coders, is not the way to go? I should just go out and hire someone who will no doubt do the same thing, unless it's deva herself? And like i said, i don't even think IH is the issue, however, most of the searches so far, have pointed at IH, that's why I am asking if someone knew of another add-on i could look at or java.

Ok, little trouble shooting and putting a trap in 'setflag' function of categories.php,
print '<script type="text/javascript">';
print 'alert("im in the case"'. $_GET['flag'] . ')';
print '</script>';
I get the popup, but $_GET['flag'] is empty?
Just looking for clues.
Jeff

jeffiec:

Ok, little trouble shooting and putting a trap in 'setflag' function of categories.php,
print '<script type="text/javascript">';
print 'alert("im in the case"'. $_GET['flag'] . ')';
print '</script>';
I get the popup, but $_GET['flag'] is empty?
Just looking for clues.
Jeff
The code you posted looks like Zen Cart 1.3.x code... Possibly Zen Cart was upgraded from a previous version and something was missed when merging files... Or maybe some older code was merged into your "/admin/categories.php" by mistake when installing a plugin...

The code from Zen Cart 1.5.1 for "/admin/categories.php" (note the parts in red):

case 'setflag':

      if ( [B]isset($_POST['flag']) && ($_POST['flag'] == '0') || ($_POST['flag'] == '1')[/B] ) {
        if (isset($_GET['pID'])) {
          zen_set_product_status($_GET['pID'], [B]$_POST['flag'][/B]);
        }
      }

      zen_redirect(zen_href_link(FILENAME_CATEGORIES, 'cPath=' . $_GET['cPath'] . '&pID=' . $_GET['pID'] . (isset($_GET['page']) ? '&page=' . $_GET['page'] : '') . ((isset($_GET['search']) && !empty($_GET['search'])) ? '&search=' . $_GET['search'] : '')));
      break;

jeffiec:

Ok, little trouble shooting and putting a trap in 'setflag' function of categories.php,
print '<script type="text/javascript">';
print 'alert("im in the case"'. $_GET['flag'] . ')';
print '</script>';
I get the popup, but $_GET['flag'] is empty?
Just looking for clues.
Jeff

The flag property is captured within a post form as a hidden field with the alternate value of the current option, I don't think a get statement will pull the data that you are looking for. This was identified by looking at the page source.

Thank you Thank you Thank you Working as intended.
Jeff

mc12345678:

The flag property is captured within a post form as a hidden field with the alternate value of the current option, I don't think a get statement will pull the data that you are looking for. This was identified by looking at the page source.

At this point I should beat Diva to the punch. It no appears that this issue is not specifically related to IH4 and further discussion, if any, should be taken to a new/alternate thread or PMs. Was bad of me not to state this sooner, but I expect the comment to come.

jeffiec:

Thank you Thank you Thank you Working as intended.
Jeff

Please share. What was the fix and associated problem?

jeffiec:

Not sure I fully understand what you are saying, have cleared all temp files and the link you posted matches what that file already has, remember, I uninstalled and re-installed to 4.3.1 IH is working fine.

Telling someone they need to pay for help can be taken a few ways, i will for arguments sake, take it in a neutral way.

So what you are saying is instead of sharing ideas, with fellow coders, is not the way to go? I should just go out and hire someone who will no doubt do the same thing, unless it's deva herself? And like i said, i don't even think IH is the issue, however, most of the searches so far, have pointed at IH, that's why I am asking if someone knew of another add-on i could look at or java.
So let me weigh in on mc12345678's "pay for help" comment.. It's a suggestion I too have made when it seems warranted.. Not sure why people appear to get their feathers ruffled over this as it is a LEGIT suggestion.. The comment is neutral and meant to mean that if after trying to get help, you reach an IMPASSE (for whatever reason), that one should/could consider paying for professional help.. I've done it when it's become necessary.. (hell I don't know everything, and I don't mind paying for professional advice/help when needed) but some folks find the thought objectionable.. The suggestion is not an insult, or a way or avoiding helping or anything else that's been suggested.. it's truly a legit option.. 'tis all.. Everything is NOT going to be free just because Zen Cart is free.. (IJS)

mc12345678:

Please share. What was the fix and associated problem?

jeffiec:

Thank you Thank you Thank you Working as intended.
Jeff
lhungil posted the solution a few posts ago (quoted below).. It appears the issue is due to left over 1.3.9 code which was missed during the upgrade..

lhungil:

The code you posted looks like Zen Cart 1.3.x code... Possibly Zen Cart was upgraded from a previous version and something was missed when merging files... Or maybe some older code was merged into your "/admin/categories.php" by mistake when installing a plugin...

The code from Zen Cart 1.5.1 for "/admin/categories.php" (note the parts in red):

case 'setflag':

  if ( [B]isset($_POST['flag']) && ($_POST['flag'] == '0') || ($_POST['flag'] == '1')[/B] ) {
    if (isset($_GET['pID'])) {
      zen_set_product_status($_GET['pID'], [B]$_POST['flag'][/B]);
    }
  }

  zen_redirect(zen_href_link(FILENAME_CATEGORIES, 'cPath=' . $_GET['cPath'] . '&pID=' . $_GET['pID'] . (isset($_GET['page']) ? '&page=' . $_GET['page'] : '') . ((isset($_GET['search']) && !empty($_GET['search'])) ? '&search=' . $_GET['search'] : '')));
  break;

Image Handler⁴ v4.3.2 Changelog

• Important required changes to modules/YOUR_TEMPLATE/additional_images.php to support the changes made to /includes/templates/YOUR_TEMPLATE/popup_image_additional/tpl_main_page.php in v4.3.1
• Minor correction to /includes/templates/YOUR_TEMPLATE/popup_image_additional/tpl_main_page.php

I have an unusual problem, and may need to be sorted with my host (BlueHost).
My problem started when I could not get to display my header image in emails, while it was available in my browser if I pointed the url directly to it. This has been fixed by BlueHost.

But now I have an issue with imagehandler, if I add new images to a product, the images do display in my catalog, but not in admin > imagehandler4.

Here is te code from <td class="dataTableContent" align="center" valign="top"> which is correct

<tr class="dataTableRow" onmouseover="rowOverEffect(this)" onmouseout="rowOutEffect(this)" onclick="document.location.href='http://my-site.com/my-admin/image_handler.php?products_filter=32&imgName=434-8&action=layout_info'">

But the path to the image sudddenly includes the directory in which ZC is installed, while my URL points directly to my ZC installation:

<img src="/Directory/bmz_cache/7/726d23ceac06644ebcac83d0ffb615ab.image.175x175.jpg" border="0" alt="ProductName - 434" title=" Big Pocket Wool & Cashmere Jacket - 434 " height="175"><br /> 175x175<br /><strong>5.4Kb</strong>      </td><td class="dataTableContent" align="center" valign="top">

Is there anywhere in IH that I can change the path above to read the image correctly ie: /bmz_cache/7/726d23ceac06644ebcac83d0ffb615ab.image.175x175.jpg"

Thanks.

Goshawk