Forums / Bug Reports / [Done v1.6.0] Layout Controller detects files with extensions other than .php

[Done v1.6.0] Layout Controller detects files with extensions other than .php

Views: 657

Results 1 to 3 of 3
30 Jul 2015, 1:09 PM
#1
lat9 avatar

lat9

Administrator

Join Date:
Sep 2009
Location:
Stuart, FL
Posts:
14,110
Plugin Contributions:
56

[Done v1.6.0] Layout Controller detects files with extensions other than .php

I was playing around with some of the sideboxes and copied /includes/modules/sideboxes/currencies.php to /includes/modules/sideboxes/classic/currencies.php (yeah, I know, but it's a local testbed). Played with it a bit and then, wanting only to temporarily disable the sidebox, renamed the classic-folder version to currencies.php~.

Imagine my surprise when Tools->Layout Boxes Controller displayed the currencies.php~ script as an available sidebox!

I haven't had a chance to inspect /admin/layout_controller.php to see what's up, but wanted to make sure that I recorded the sighting before I forgot.

30 Jul 2015, 3:07 PM
#2
mc12345678 avatar

mc12345678

Totally Zenned

Join Date:
Jul 2012
Posts:
16,908
Plugin Contributions:
2

Re: [Done v1.6.0] Layout Controller detects files with extensions other than .php

I thought that was standard operaton as I'd seen it two months ago or so, but hadn't gone to ferret it out myself either.

Looking at the code though, basically any (all) files n the override directory are loaded unless named empty.txt. Was that way in 1.5.1 even.

Prior to adding the file to the directory array, there is no check to validate the extension like there is in the main directory. There also is not a check to see that the overridden file existed in the parent folder as is done with html_includes.

ZC Installation/Maintenance Support <- Site
Contribution for contributions welcome...

1 Aug 2015, 10:02 PM
#3
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,513
Plugin Contributions:
176

Re: [Done v1.6.0] Layout Controller detects files with extensions other than .php

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.