User tracking mod

Good morning,

I am using zen-cart on a site that does not receive purchases, but it is convenient to use ZC since it has a great user interface. Thus, I am still using 1.3.8a, and php version 5.2.17. I have not upgraded the site recently. There are some add-ons that we use, such as user tracking, sitemap, and seo urls. The issue I am having is not exactly an issue, more of a question about this plug-in specifically.

I use godaddy as my hosting provider, and they have a limit on database sizes of 200mb. I think they have changed it recently to make the amount of available space higher, but I am not sure (their tech support person told me they have removed this limit). This user tracking mod appears to be able to only write to the database. Since I have several bots that visit the site, and there is no way to block tracking on every one since their ip addresses change regularly, the user tracking database file grows quite large. I am not sure what version of this module I am using, since I can't find where it says the version in either the config page or the tracking page. I believe it was a version that was installed in 2009, so it is either version 1.3.6.2 or 1.4.0.

What I am wondering is, is there a way to cause the module to write the data to a file on the server instead of to the database? Does the new version do this, as opposed to writing to the database? I cannot find a way to change this aspect of the module in the configuration section. If I purge all the records in the last 72 hour period, then I would lose the data for the visitors in that period. So, I am simply looking for a way to make the database stop growing. I did not see writing to the database mentioned as something that was changed in later versions, so I am wondering if that was something that is different now. If it is a simple fix such as this, I will install the new version right away.

Alternatively, is there a different module that would work more in the way that I have mentioned? Any help on this matter is appreciated. Thank you.

For what it's worth (FWIW) the most recently posted version is not the one that contains other improvements, one of which is that the deletion period is customizable by date/tme (not size of table) in the format of delete everything that is beyond x hours/days/weeks/months in the past... There is also a swtch to change how/when to log (does not provide a file version of this) as discussed in the past and in some of the documentation provided in various versions of the plugin.

The plugin as it stands two versions ago should be compatible with your version of ZC as well as with ZC 1.5.4. Thing is I botched the instructions (SQL) for new users (though I thought a corrected version was eventually published). A somewhat revised version using post commands instead of get commands was provided for further development; however, other priorities have gotten in the way of further development. One additional feature considered for addition was to autodelete historical information at a point independent of the manual method (with expectation of it being further in the past than the manual setting.)

As for a file download of the table, while not "easy" it can be done through phpmyadmin as well as through other backup utilities available as plugins...

I recently got my site back and I am trying to be on top of my logs and found this:

[23-Mar-2016 09:02:36 America/Denver] PHP Fatal error:  1064:You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'A=0&products_id=741', 'White Diamonds Scented Gel Candle - 120 Hour Deco Jar', '' at line 1 :: insert into user_tracking (customer_id, full_name, session_id, ip_address, time_entry, time_last_click, last_page_url, referer_url, page_desc, customers_host_address) values ('0', 'Guest', '', '98.226.154.95', '1458745356', '1458745356', '/index.php?main_page=product_info\'A=0&products_id=741', 'http://gelcandlecompany.com/index.php?main_page=product_info'A=0&products_id=741', 'White Diamonds Scented Gel Candle - 120 Hour Deco Jar', 'c-98-226-154-95.hsd1.il.comcast.net') ==> (as called by) /xxxxx/xxxxx/public_html/includes/functions/extra_functions/user_tracking.php on line 70 <== in /xxxxx/xxxxx/public_html/includes/classes/db/mysql/query_factory.php on line 155

spawnie69:

I recently got my site back and I am trying to be on top of my logs and found this:

[23-Mar-2016 09:02:36 America/Denver] PHP Fatal error: 1064:You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'A=0&products_id=741', 'White Diamonds Scented Gel Candle - 120 Hour Deco Jar', '' at line 1 :: insert into user_tracking (customer_id, full_name, session_id, ip_address, time_entry, time_last_click, last_page_url, referer_url, page_desc, customers_host_address) values ('0', 'Guest', '', '98.226.154.95', '1458745356', '1458745356', '/index.php?main_page=product_info'A=0&products_id=741', 'http://gelcandlecompany.com/index.php?main_page=product_info'A=0&products_id=741', 'White Diamonds Scented Gel Candle - 120 Hour Deco Jar', 'c-98-226-154-95.hsd1.il.comcast.net') ==> (as called by) /xxxxx/xxxxx/public_html/includes/functions/extra_functions/user_tracking.php on line 70 <== in /xxxxx/xxxxx/public_html/includes/classes/db/mysql/query_factory.php on line 155

Yup, that's someone trying to take advantage of an old style SQL injection attack that has been caught...  They were trying to cause the SQL to close out/crash and then perform some action. Problem/potential attack thwarted by the security of ZC.

Hell No! Amazing, glad to finally upgrade to 1.54.
Thank you guys!

spawnie69 and mc12345678, would you be willing to test out these updates to verify that I've not broken anything while cleaning it up a bit (okay, a lot)?

DrByte:

spawnie69 and mc12345678, would you be willing to test out these updates to verify that I've not broken anything while cleaning it up a bit (okay, a lot)?

Before downloading, may I ask which version was used as a "template" if any at all? As identified earlier in this thread, the most "recent" upload was nothing new but was actually from years ago with a correctly formatted install SQL for new users...

Sigh.

I used this: https://www.zen-cart.com/downloads.php?do=file&id=159

And I didn't touch the install SQL file.

I didn't incorporate any code changes posted in this thread, as I haven't studied the 700 previous posts here.
I did observe that there are probably a number of things in the admin pages of this plugin that could probably use improving. I did touch those just to fix some potential sanitization issues and HTML markup errors, and PHP compatibility issues.

DrByte:

I used this: https://www.zen-cart.com/downloads.php?do=file&id=159

And I didn't touch the install SQL file.

I didn't incorporate any code changes posted in this thread.

That's what I was afraid of. Please read the following and adjacent posts. https://www.zen-cart.com/showthread.php?35081-User-tracking-mod&p=1276013#post1276013

Guess I have nothing to complain about seeing as I didn't take further action to fix the overall issue even when a slightly reworked version was otherwise provided. Ohh well. Moving on. Will see what there is to see related to above expecting to be both happy and disappointed at the same time.

DrByte:

spawnie69 and mc12345678, would you be willing to test out these updates to verify that I've not broken anything while cleaning it up a bit (okay, a lot)?

Took a lap through comparing to the version posted two versions ago. Geo data is way out-of-date (instructions to obtain newer files are/were in the second to newest version), get statements are used throughout instead of the POST statements that had been developed/applied, I'll continue looking through and merging back into the code what didn't exist in that recently uploaded old version, without affecting the improved data capture.

The url field length I think it was was extended to 255 characters and the storage function uses 253 characters presumably to permit escaping the content. One thing that I had been concerned about was the potential of that string having some form of escape inside of it (ie. Is/was it possible), in looking at how the code had been previously rewritten, seemed like the storage "function" (SQL) was in a sequence considered more secure. Now I'm writing this 2 days following my review, so please take this concern with a grain of salt.

Otherwise I did see a few discrepancies with things like quoted commands/text and function sequences that were addressed correct in the 2 versions ago software that I'm working on. Then there is the fact that torvista had reworked the plugin to use all post features though one thing to investigate in this is if the presentation of product in a cart will display the cart adjacent to all history for that day versus the one individual's cart being applied to every entry. (Feature improvement.)

Please let me know if this module is compatible with zc 1.5.5

thank you

Posted an updated version of this plugin, version 1.5.3 which upon review and acceptance should be available from here:

Update summary:

Updated 02/23/2017 Version 1.5.3 mc12345678:
1. Implemented an installation/upgrade script instead of expecting users to try to successfully run the installation sql and to 
remove the need of clearing the database of existing records when performing an update that does not modify the records table.
2. Tightened security controls on the plugin by using focused database entry/record sanitization as well as output control to 
reduce the likelihood of script being executed by display of attempted url.  The captured session data only includes what is needed
to support the desired information to be displayed.
3. Updated code to be php 7.2 compliant based on reported deprecation of the each() function.
4. Modified the cart content display to provide cart data adjacent only to the record applicable to that cart.
5. Added a filter to show records that meet a minimum number of hits for that session.
6. Moved some standard html table code into using the default admin ZC table style code.
7. Converted the submit button to a post style submission instead of a get format.
8. Incorporated additional cod changes suggested by torvista as well as DrByte's most recent in forum posted version.
9. Basically restored the code back to the condition it was in at version 1.5.1.
10. Added the day forward/backward at the bottom of the page (so not just at the top).
11. Updated the geoip.dat file to the February 2017 version.

Code was tested on up to ZC 1.5.5 and PHP 7.0.

mc12345678:

Posted an updated version of this plugin, version 1.5.3 which upon review and acceptance should be available from here:

Update summary:

Updated 02/23/2017 Version 1.5.3 mc12345678:

1. Implemented an installation/upgrade script instead of expecting users to try to successfully run the installation sql and to
   remove the need of clearing the database of existing records when performing an update that does not modify the records table.
2. Tightened security controls on the plugin by using focused database entry/record sanitization as well as output control to
   reduce the likelihood of script being executed by display of attempted url. The captured session data only includes what is needed
   to support the desired information to be displayed.
3. Updated code to be php 7.2 compliant based on reported deprecation of the each() function.
4. Modified the cart content display to provide cart data adjacent only to the record applicable to that cart.
5. Added a filter to show records that meet a minimum number of hits for that session.
6. Moved some standard html table code into using the default admin ZC table style code.
7. Converted the submit button to a post style submission instead of a get format.
8. Incorporated additional cod changes suggested by torvista as well as DrByte's most recent in forum posted version.
9. Basically restored the code back to the condition it was in at version 1.5.1.
10. Added the day forward/backward at the bottom of the page (so not just at the top).
11. Updated the geoip.dat file to the February 2017 version.

> 
> Code was tested on up to ZC 1.5.5 and PHP 7.0.

Version 1.5.3 of this plugin is now available from [here](https://www.zen-cart.com/downloads.php?do=file&id=159).

I installed User Tracking today on version 1.5.5b. The green "Installed User Tracking v1.5.3" banner won't go away even with a page refresh or using a different browser. What can be done to make that disappear?

hannahheart:

I installed User Tracking today on version 1.5.5b. The green "Installed User Tracking v1.5.3" banner won't go away even with a page refresh or using a different browser. What can be done to make that disappear?
Knew I should have put this on github to make it easier to do a code review.

I'm inclined to say that the full contents of the installer file did not get uploaded. Recommend reuploading the files.

Has the module actually successfully installed (ie. An option present in the configuration menu to support making changes?) and/or an option under tools to access the program?

I uploaded the latest version, it seems like the upgrade script is not being processed any ideas?

ShopVille:

I uploaded the latest version, it seems like the upgrade script is not being processed any ideas?
Humorous to me that the last two posts relate to the installer script providing two opposing conditions, won't stop and won't start. :)

What is the indication that it has not gotten installed? If it has been installed, there should be a configuration section for User Tracking and the version number identified there should be 1.5.3.

1. all files and folders from admin directory placed into admin directory keeping the folder structure?
2. specific files involved with installer are located in the admin/includes/auto_loaders, admin/includes/init_includes, and admin/includes/installers/user_tracking directories.
3. suggest attempting to re-upload the files at least in the admin directory.

mc12345678:

Humorous to me that the last two posts relate to the installer script providing two opposing conditions, won't stop and won't start. :)

What is the indication that it has not gotten installed? If it has been installed, there should be a configuration section for User Tracking and the version number identified there should be 1.5.3.

1. all files and folders from admin directory placed into admin directory keeping the folder structure?
2. specific files involved with installer are located in the admin/includes/auto_loaders, admin/includes/init_includes, and admin/includes/installers/user_tracking directories.
3. suggest attempting to re-upload the files at least in the admin directory.

This is a screenshot of the config does not look like it is updated

As a former user of User Tracking, try this change though at the moment, I'm not sure that it will resolve the issue if the other suggestions haven't been followed.

In admin/includes/init_includes/init_user_tracking.php

Find this line:

if ($configuration_group_id == '') {

And replace with:

if ([b]!zen_not_null([/b]$configuration_group_id[b])[/b]) {

mc12345678:

As a former user of User Tracking, try this change though at the moment, I'm not sure that it will resolve the issue if the other suggestions haven't been followed.

In admin/includes/init_includes/init_user_tracking.php

Find this line:

if ($configuration_group_id == '') {

> 
> And replace with:
> ```
if ([b]!zen_not_null([/b]$configuration_group_id[b])[/b]) {

Nothing changed