Hello, we're having 2 problems with special characters in the newest release of zen cart (v1.5.5a). The problems are:

When saving a newly created ez-page, if there is an ampersand symbol (&) in the title, the "&" symbol is converted and displayed as &.

The second problem is when changing any of the layout settings in admin (Configuration-Layout Settings) that have a symbol, for example the "Categories Separator between the Category Name and Sub Categories" to something other than the default (|_ ) such as    which is 2 spaces, the outcome is   . Even trying to change it back to the default is impossible because the outcome is |_ .

All web browsers are displaying the same results.

We have an older version (v1.5.1) of zen cart (different domain) running on the same server and it doesn't have this problem. Does anyone have any ideas or is anyone even having the same problem running the newest version (v1.5.5a)?

rotten:

Hello, we're having 2 problems with special characters in the newest release of zen cart (v1.5.5a). The problems are:

When saving a newly created ez-page, if there is an ampersand symbol (&) in the title, the "&" symbol is converted and displayed as &.

The second problem is when changing any of the layout settings in admin (Configuration-Layout Settings) that have a symbol, for example the "Categories Separator between the Category Name and Sub Categories" to something other than the default (|##) such as #### which is 2 spaces, the outcome is   . Even trying to change it back to the default is impossible because the outcome is | .

All web browsers are displaying the same results.

We have an older version (v1.5.1) of zen cart (different domain) running on the same server and it doesn't have this problem. Does anyone have any ideas or is anyone even having the same problem running the newest version (v1.5.5a)?

This is a known bug, I do think the development team is on it.

Thank you for the quick reply. Do you know if there's a workaround for it or do we just have to wait for the fix?

rotten:

Thank you for the quick reply. Do you know if there's a workaround for it or do we just have to wait for the fix?

Nope, not even adding it using an SQL patch works.

Thanks again, we'll just wait for the fix then. Have a great evening :smile:

Should be resolved by updating these files: https://www.zen-cart.com/showthread.php?219760-Known-Bugs-%28and-fixes%29-with-v1-5-5&p=1312333#post1312333

DrByte:

Should be resolved by updating these files: https://www.zen-cart.com/showthread.php?219760-Known-Bugs-%28and-fixes%29-with-v1-5-5&p=1312333#post1312333
The problem is still there even after I replaced those 3 files. Any suggestion?
Thank you.

scott_ease:

The problem is still there even after I replaced those 3 files. Any suggestion?
Thank you.

You say the problem is still there. Please identify how it is possible to reproduce the issue now that the patched files have been installed?

v155a under construction: http://angelcorp.net/test/index.php?main_page=product_info&cPath=45&products_id=88
The 4th line from above, next to 'Model:' shows ' '

v150 live site: http://angelcorp.net/infant-formula/index.php?main_page=product_info&cPath=45&products_id=88
The 4th line from above, next to 'Model:' follows a space.

The admin backend input are identical ( ). Same database actually (upgraded with v155a).
Thank you.

scott_ease:

v155a under construction: http://angelcorp.net/test/index.php?main_page=product_info&cPath=45&products_id=88
The 4th line from above, next to 'Model:' shows ' '

v150 live site: http://angelcorp.net/infant-formula/index.php?main_page=product_info&cPath=45&products_id=88
The 4th line from above, next to 'Model:' follows a space.

The admin backend input are identical ( ). Same database actually (upgraded with v155a).
Thank you.

In your development site, if you manually update the record, does the ```
 

I re-input the value. The bug still hassle. Thank you anyway.

DrByte:

Should be resolved by updating these files: https://www.zen-cart.com/showthread.php?219760-Known-Bugs-%28and-fixes%29-with-v1-5-5&p=1312333#post1312333

Will these files work in 1.5.6c? It looks like they are only good through 1.5.5f.

I am getting the conversion of & to &...running on XAMPP v3.2.4, PHP 7.3.15, most recent version of windows 10 64 bit.

I don't have a live site to show you at this time so I'll give you as much as I can to narrow down the issue.

My custom admin template is based on the Zencart admin/Configuration page.

A sub page of this is my backup program and one of it's options is to select which category to back up.

There are radio button selects in the right hand box for each top level category in my catalog...Health & Beauty being one of them.

When I select Health & Beauty, it returns Health & Beauty in the value column and screws up my script for backing up this category.

Yes, I can rename it to Health Beauty but prefer Health & Beauty.

I tried using html_decode in my script but the rest of the script failed even though the html_decode did change the category name correctly.

Thanks for your help.

Commenting this out in AdminRequestSanitizer.php makes the problem go away but I don't fully understand the impact of leaving this commented out.

    public function setDoStrictSanitization($doStrictSanitize)
    {
        /*$this->doStrictSanitization = $doStrictSanitize;*/
    }

The problem is not just occurring in my custom admin app.

Input boxes, check boxes and text boxes throughout admin are affected.

...or this in init_sanitze.php

//$sanitizer->setDoStrictSanitization(DO_STRICT_SANITIZATION);

mikeel100:

...or this in init_sanitze.php

//$sanitizer->setDoStrictSanitization(DO_STRICT_SANITIZATION);

editing the core sanitizer is not a good idea.  Creating your own class to add your new fields to a sanitizer group could help you... I did on the fields I created for my site such as products_details.. Documentation can be found [here](https://docs.zen-cart.com/dev/code/admin_sanitization/admin_sanitization/)..  

I'm in the middle of upgrading a mod that well have to have one created for it too..

Thanks Dave.

I know very little about classes or the reason and need for all this sanitizing...I'm sure it is security.

I appreciate the link and will look into it.

Since this is not happening solely in my admin app, I believe it is an issue that the "Team" needs to address.

My dev store is not live (home computer only) and will not be for some time.

I will leave my fix in place until someone can tell me why the entire admin area is affected and what we need to do to fix it.

If it was just happening in my dev app, I'd dig deeper.

I got my extra_configures files set up and working but what do I do with the sanitize_debug output?

Apr-26-2020 05:25:31

Incoming GET Request Array
(
[gID] => 31
[cID] => 555
[action] => save
)

Incoming POST Request Array
(
[securityToken] => 8c370e8059fb1a9b47ea59678c097822
[submitEZ_FEEDS_DEFAULT_CATEGORY] =>
[configuration_value] => Health & Beauty
)

Running Admin Sanitizers

PROCESSING SIMPLE_ALPHANUM_PLUS(GET) == action

PROCESSING SIMPLE_ALPHANUM_PLUS(GET) == cID

PROCESSING SIMPLE_ALPHANUM_PLUS(GET) == gID

PROCESSING STRICT_SANITIZE_VALUES == securityToken

PROCESSING STRICT_SANITIZE_VALUES == submitEZ_FEEDS_DEFAULT_CATEGORY

Outgoing GET Request Array
(
[gID] => 31
[cID] => 555
[action] => save
)

Outgoing POST Request Array
(
[securityToken] => 8c370e8059fb1a9b47ea59678c097822
[submitEZ_FEEDS_DEFAULT_CATEGORY] =>
[configuration_value] => Health & Beauty
)

Apr-26-2020 05:25:31

Incoming GET Request Array
(
[gID] => 31
[cID] => 555
)

Incoming POST Request Array
(
)

Running Admin Sanitizers

PROCESSING SIMPLE_ALPHANUM_PLUS(GET) == cID

PROCESSING SIMPLE_ALPHANUM_PLUS(GET) == gID

Outgoing GET Request Array
(
[gID] => 31
[cID] => 555
)

Outgoing POST Request Array
(
)

Sorry to be so dense but I really am clueless at this point.

Thanks.

mikeel100:

I got my extra_configures files set up and working but what do I do with the sanitize_debug output?

Sorry to be so dense but I really am clueless at this point.

Thanks.
What do you mean "what do I do with the sanitize_debug output"? Are you asking what to do with the file? How to make it stop generating the file? What the contents of the file are telling you? Can you be a little more specific about the request?

mc12345678:

What do you mean "what do I do with the sanitize_debug output"? Are you asking what to do with the file? How to make it stop generating the file? What the contents of the file are telling you? Can you be a little more specific about the request?

it seems that DO_DEBUG_SANITIZATION is set to true somewhere.

i would think setting it to false would address the output.