PHP 8.4, ZC 2.1.0, Template: ZCA Bootstrap 3.7.5, IH 5.3.5, Ultimate SEO 3.1.2

Is there a way to prevent Ultimate SEO from rewriting the names of images?

retched:

PHP 8.4, ZC 2.1.0, Template: ZCA Bootstrap 3.7.5, IH 5.3.5, Ultimate SEO 3.1.2

Is there a way to prevent Ultimate SEO from rewriting the names of images?
As indicated at the top of USU's readme:

**Ensure that any non-PHP files for your site don't include these (-p-, -m-, -pi-, -pr-, -pri-, -prw-, -aaq-, -ezp- or -c-) character strings! They'll be rewritten, too, unfortunately! **

lat9:

As indicated at the top of USU's readme:

**Ensure that any non-PHP files for your site don't include these (-p-, -m-, -pi-, -pr-, -pri-, -prw-, -aaq-, -ezp- or -c-) character strings! They'll be rewritten, too, unfortunately! **

Oh christ. That explains why this name breaks:

/bmz_cache/c/cb01-p-109png.image.29x40.png

That's the name generated from Image Handler. Is there a way to exclude the bmz_cache directory? Or is it a hard no? (I've already renamed the source file and directory but still was just curious.)

retched:

Oh christ. That explains why this name breaks:

/bmz_cache/c/cb01-p-109png.image.29x40.png

That's the name generated from Image Handler. Is there a way to exclude the bmz_cache directory? Or is it a hard no? (I've already renamed the source file and directory but still was just curious.)
I'm sure there is, but .htaccess directives are kind of like JCL ... I'd need to search for an example that's close to what you want to use as a basis.

lat9:

I'm sure there is, but .htaccess directives are kind of like JCL ... I'd need to search for an example that's close to what you want to use as a basis.

Would this happen to work?

# Exclude bmz_cache for ImageHandler
RewriteCond %{REQUEST_URI} ^/bmz_cache/ [NC]
RewriteRule .* - [L]

Running the full .htaccess through an .htaccess tester (https://htaccess.madewithlove.com)

I get the following:

The URL:
https://www.justuptowngames.com/universus-cowboy-bebop-c-2_24/twinkle-murdock-p-847.html

Translates to:
https://www.justuptowngames.com/index.php?main_page=product_info&products_id=847&cPath=2_24&

Which is the normal behavior.

Translating:
https://www.justuptowngames.com/bmz_cache/c/cb01-p-109png.image.88x120.png

Before the change above yields:
https://www.justuptowngames.com/index.php?main_page=product_info&products_id=109&

(which explains why the <img> tag breaks and clicking on the source in my browser inspect tab takes me to another product page)

But adding the lines above to the area just under the # Start Ultimate (SEO) URL's section (but before the RewriteRules of the same) makes it leave it alone.

retched:

Would this happen to work?

Exclude bmz_cache for ImageHandler

RewriteCond %{REQUEST_URI} ^/bmz_cache/ [NC]
RewriteRule .* - [L]

> 
> 
> Running the full .htaccess through an .htaccess tester (<https://htaccess.madewithlove.com>)
> 
> I get the following:
> 
> The URL: 
> <https://www.justuptowngames.com/universus-cowboy-bebop-c-2_24/twinkle-murdock-p-847.html>
> 
> Translates to:
> <https://www.justuptowngames.com/index.php?main_page=product_info&products_id=847&cPath=2_24&>
> 
> Which is the normal behavior.
> 
> Translating:
> <https://www.justuptowngames.com/bmz_cache/c/cb01-p-109png.image.88x120.png>
> 
> Before the change above yields:
> <https://www.justuptowngames.com/index\.php?main_page=product_info&products_id=109&>
> 
> (which explains why the <img> tag breaks and clicking on the source in my browser inspect tab takes me to another product page)
> 
> But adding the lines above to the area just under the # Start Ultimate (SEO) URL's section (but before the RewriteRules of the same) makes it leave it alone.
Nice one!

I'm on the fence as to whether/not to include that in USU's distributed .htaccess file.

lat9:

Nice one!

I'm on the fence as to whether/not to include that in USU's distributed .htaccess file.

I would include it commented out with instructions that "If you notice some of your images being processed through Image Handler 5 isn't working, try uncommenting these two lines out."

retched:

I would include it commented out with instructions that "If you notice some of your images being processed through Image Handler 5 isn't working, try uncommenting these two lines out."
Sound like a plan. Would you be willing to create a PR on USU's GitHub? https://github.com/lat9/usu

lat9:

Sound like a plan. Would you be willing to create a PR on USU's GitHub? https://github.com/lat9/usu

Will do in a bit. I want to make sure this covers both the Image Handler and main images directory.

retched:

Will do in a bit. I want to make sure this covers both the Image Handler and main images directory.

And done. (Submitted as a PR)

# Exclude /bmz_cache for ImageHandler
RewriteCond %{REQUEST_URI} ^/bmz_cache/ [NC]
RewriteRule .* - [L]

In short, if the REQUEST_URI that starts with /bmz_cache/ (aka the main directory of ImageHandler's cache) is found, regardless of casing (the [NC]), do nothing with it... and STOP searching for more rule matches ([L]).

# Exclude /images directory in general
RewriteCond %{REQUEST_URI} ^/images/ [NC]
RewriteRule .* - [L]

In short, if the REQUEST_URI that starts with /images/ is found, ZenCart's main primary image directory, regardless of casing (the [NC]), do nothing with it... and STOP searching for more rule matches ([L]) .

It gets messy after this point if people put their images in weird, non-standard image directories.

I was just about to send you a PR to fix the $value_pair bug and saw you had already fixed it! LOL. Thanks for doing such a great job supporting this plugin.

I am keeping this addon in mind. I am wondering if the (p-id) can be removed. Like for an example.

From http://yoursite.com/disciples-sacred-lands-linked-p-24.html
to http://yoursite.com/disciples-sacred-lands-linked.html

http://yoursite.com/software-strategy-c-2_20.html to http://yoursite.com/software-strategy.html for the categories.

wmorris:

I am keeping this addon in mind. I am wondering if the (p-id) can be removed. Like for an example.

From http://yoursite.com/disciples-sacred-lands-linked-p-24.html
to http://yoursite.com/disciples-sacred-lands-linked.html

http://yoursite.com/software-strategy-c-2_20.html to http://yoursite.com/software-strategy.html for the categories.

no. it can't.

best.

wmorris:

I am keeping this addon in mind. I am wondering if the (p-id) can be removed. Like for an example.

From http://yoursite.com/disciples-sacred-lands-linked-p-24.html
to http://yoursite.com/disciples-sacred-lands-linked.html

http://yoursite.com/software-strategy-c-2_20.html to http://yoursite.com/software-strategy.html for the categories.

carlwhat:

no. it can't.

best.
... it can't because the p-24 is the way that USU knows that disciples-sacred-lands-linked refers to a product with the id of 24.

git hub issue 42... is there an edge case scenario that could bring that issue back into play?? just updated to latest version of seo urls and using zen 2.1 but when i curl an invalid product id page it returns a 302 and redirects me to the same page until max redirects occurs?

curl -i "https://crazygamer.uk/index.php?main_page=product_info&products_id=99999"
HTTP/1.1 302 Found
Server: nginx
Date: Fri, 25 Jul 2025 20:46:33 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.3.23
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-qLVr9z0MAH/e+HLPNjnuQw==' https://js.stripe.com https://*.js.stripe.com https://checkout.stripe.com https://cdn.jsdelivr.net https://cdn-cookieyes.com https://code.jquery.com https://invitejs.trustpilot.com https://www.googletagmanager.com https://kit.fontawesome.com https://stackpath.bootstrapcdn.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://stackpath.bootstrapcdn.com https://cdnjs.cloudflare.com https://ka-f.fontawesome.com; font-src 'self' data: https://fonts.gstatic.com https://kit.fontawesome.com https://ka-f.fontawesome.com https://stackpath.bootstrapcdn.com https://cdnjs.cloudflare.com; img-src 'self' https://*.stripe.com https://cdn-cookieyes.com https://pictureserver.co.uk data:; connect-src 'self' https://cdn-cookieyes.com https://log.cookieyes.com https://www.googletagmanager.com https://www.google-analytics.com https://code.jquery.com https://invitejs.trustpilot.com https://fonts.googleapis.com https://fonts.gstatic.com https://js.stripe.com https://*.js.stripe.com https://r.stripe.com https://api.stripe.com https://checkout.stripe.com https://maps.googleapis.com https://pictureserver.co.uk https://ka-f.fontawesome.com https://pay.google.com; frame-src 'self' https://js.stripe.com https://*.js.stripe.com https://checkout.stripe.com https://hooks.stripe.com; frame-ancestors 'self' https://pay.google.com; object-src 'none'; base-uri 'self';
X-Frame-Options: SAMEORIGIN
Cross-Origin-Opener-Policy: same-origin
Access-Control-Allow-Origin: https://pictureserver.co.uk, https://cookieyes.com, https://invitejs.trustpilot.com/tp.min.js, https://log.cookieyes.com/api/v1/log, https://*.trustpilot.com, https://cdn-cookieyes.com/client_data/ba9e936402c692e98fd2aab7/banner.js
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Location: https://crazygamer.uk/index.php?main_page=product_info&products_id=99999
X-Debug-Test: htaccess-is-working
Vary: User-Agent
X-Content-Type-Options: nosniff
Access-Control-Allow-Origin: *
X-Powered-By: PleskLin

flappingfish:

git hub issue 42... is there an edge case scenario that could bring that issue back into play?? just updated to latest version of seo urls and using zen 2.1 but when i curl an invalid product id page it returns a 302 and redirects me to the same page until max redirects occurs?

curl -i "https://crazygamer.uk/index.php?main_page=product_info&products_id=99999"
HTTP/1.1 302 Found
Server: nginx
Date: Fri, 25 Jul 2025 20:46:33 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.3.23
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-qLVr9z0MAH/e+HLPNjnuQw==' https://js.stripe.com https://.js.stripe.com https://checkout.stripe.com https://cdn.jsdelivr.net https://cdn-cookieyes.com https://code.jquery.com https://invitejs.trustpilot.com https://www.googletagmanager.com https://kit.fontawesome.com https://stackpath.bootstrapcdn.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://stackpath.bootstrapcdn.com https://cdnjs.cloudflare.com https://ka-f.fontawesome.com; font-src 'self' data: https://fonts.gstatic.com https://kit.fontawesome.com https://ka-f.fontawesome.com https://stackpath.bootstrapcdn.com https://cdnjs.cloudflare.com; img-src 'self' https://.stripe.com https://cdn-cookieyes.com https://pictureserver.co.uk data:; connect-src 'self' https://cdn-cookieyes.com https://log.cookieyes.com https://www.googletagmanager.com https://www.google-analytics.com https://code.jquery.com https://invitejs.trustpilot.com https://fonts.googleapis.com https://fonts.gstatic.com https://js.stripe.com https://.js.stripe.com https://r.stripe.com https://api.stripe.com https://checkout.stripe.com https://maps.googleapis.com https://pictureserver.co.uk https://ka-f.fontawesome.com https://pay.google.com; frame-src 'self' https://js.stripe.com https://.js.stripe.com https://checkout.stripe.com https://hooks.stripe.com; frame-ancestors 'self' https://pay.google.com; object-src 'none'; base-uri 'self';
X-Frame-Options: SAMEORIGIN
Cross-Origin-Opener-Policy: same-origin
Access-Control-Allow-Origin: https://pictureserver.co.uk, https://cookieyes.com, https://invitejs.trustpilot.com/tp.min.js, https://log.cookieyes.com/api/v1/log, https://*.trustpilot.com, https://cdn-cookieyes.com/client_data/ba9e936402c692e98fd2aab7/banner.js
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Location: https://crazygamer.uk/index.php?main_page=product_info&products_id=99999
X-Debug-Test: htaccess-is-working
Vary: User-Agent
X-Content-Type-Options: nosniff
Access-Control-Allow-Origin: *
X-Powered-By: PleskLin

✅ Root Cause:
In init_sanitize.php, the zen_redirect() call was redirecting back to product_info for missing products, re-triggering itself indefinitely.

confirmed fix includes/init_includes/init_sanitize.php around line 247 i edited the function to check if the product id was valid...

if (isset($_GET['products_id']) && (!isset($_SESSION['check_valid_prod']) || $_SESSION['check_valid_prod'] !== false)) {
$check_valid = zen_products_id_valid($_GET['products_id']) && !empty($_GET['main_page']);
if (!$check_valid) {
$_GET['main_page'] = zen_get_info_page($_GET['products_id']);
/**
* do not recheck redirect
*/
$_SESSION['check_valid_prod'] = false;
// I CAUSE REDIRECT ERROR zen_redirect(zen_href_link($_GET['main_page'], 'products_id=' . $_GET['products_id']));
zen_redirect(zen_href_link(FILENAME_PAGE_NOT_FOUND));
}
}

i implemented the fix on a site yet to actually go live so i prevent pestering customers with faults i create during debug. but the response from curl testing was....

curl -i "https://testing.uk/index.php?main_page=product_info&products_id=99999"
HTTP/1.1 302 Found
Server: nginx
Date: Sat, 26 Jul 2025 11:09:29 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: keep-alive
X-Powered-By: PHP/8.3.23
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-K9du9I/aRis2+6Z4paugJQ==' https://js.stripe.com https://cdn.jsdelivr.net https://cdn-cookieyes.com https://code.jquery.com https://invitejs.trustpilot.com https://www.googletagmanager.com https://kit.fontawesome.com https://stackpath.bootstrapcdn.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://stackpath.bootstrapcdn.com https://cdnjs.cloudflare.com https://ka-f.fontawesome.com 'unsafe-hashes'; font-src 'self' data: https://fonts.gstatic.com https://kit.fontawesome.com https://ka-f.fontawesome.com https://stackpath.bootstrapcdn.com https://cdnjs.cloudflare.com; img-src 'self' https://cdn-cookieyes.com https://pictureserver.co.uk https://www.googletagmanager.com data:; connect-src 'self' https://cdn-cookieyes.com https://log.cookieyes.com https://www.googletagmanager.com https://www.google-analytics.com https://code.jquery.com https://invitejs.trustpilot.com https://fonts.googleapis.com https://fonts.gstatic.com https://js.stripe.com https://r.stripe.com https://api.stripe.com https://pictureserver.co.uk https://ka-f.fontawesome.com https://pay.google.com; frame-src 'self' https://js.stripe.com; frame-ancestors 'self' https://pay.google.com; object-src 'none'; base-uri 'self';
X-Frame-Options: SAMEORIGIN
Cross-Origin-Opener-Policy: same-origin
Access-Control-Allow-Origin: https://pictureserver.co.uk, https://cookieyes.com, https://invitejs.trustpilot.com/tp.min.js, https://log.cookieyes.com/api/v1/log, https://*.trustpilot.com, https://cdn-cookieyes.com/client_data/ba9e936402c692e98fd2aab7/banner.js
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Location: https://testing.uk/index.php?main_page=page_not_found
X-Debug-Test: htaccess-is-working
Vary: User-Agent
X-Content-Type-Options: nosniff
Access-Control-Allow-Origin: *
X-Powered-By: PleskLin

Any potential issues i have with this fix before i implement it to a live site??

I checked a de-activated product next and found the same issue, I added an extra check and now deactivated products 302 to PAGE_NOT_FOUND

/**
 * validate products_id for search engines and bookmarks, etc.
 */
if (isset($_GET['products_id']) && (!isset($_SESSION['check_valid_prod']) || $_SESSION['check_valid_prod'] !== false)) {
    $check_valid = zen_products_id_valid($_GET['products_id']) && !empty($_GET['main_page']);
    if (!$check_valid) {
        $_GET['main_page'] = zen_get_info_page($_GET['products_id']);
        /**
         * do not recheck redirect
         */
        $_SESSION['check_valid_prod'] = false;
       // zen_redirect(zen_href_link($_GET['main_page'], 'products_id=' . $_GET['products_id']));
        zen_redirect(zen_href_link(FILENAME_PAGE_NOT_FOUND));
    }
}
$_SESSION['check_valid_prod'] = true;

// -----
// Additional check for deactivated products (status = 0)
//
if (isset($_GET['products_id']) && (int)$_GET['products_id'] > 0) {
    $check_status = $db->Execute("SELECT products_status FROM " . TABLE_PRODUCTS . " WHERE products_id = " . (int)$_GET['products_id'] . " LIMIT 1");
    if (!$check_status->EOF && $check_status->fields['products_status'] == '0') {
        header('HTTP/1.1 404 Not Found');
        zen_redirect(zen_href_link(FILENAME_PAGE_NOT_FOUND));
    }
}

@flappingfish, what version of Zen Cart is in use?

lat9:

@flappingfish, what version of Zen Cart is in use?

According to the version checker i'm on 2.1, i've checked a good number of files to make sure i am indeed upgraded and I appear to have all the expected files. I sanity checked and sadly I can replicate this issue by a curl command to other zencart sites i am not responsible for :/

flappingfish:

According to the version checker i'm on 2.1, i've checked a good number of files to make sure i am indeed upgraded and I appear to have all the expected files. I sanity checked and sadly I can replicate this issue by a curl command to other zencart sites i am not responsible for :/
What's weird is that one of my clients that's using USU doesn't exhibit this behavior. What template's in use?