User tracking mod

Yes, considering that I see those type entries and others that are historically known to allow some form of sql injection (in older versions of ZC), I would suspect that those using this mod would see something similar.

So, with that in mind, my thought of approach is to create an admin configuration field, in which a portion of the string to cause the individual to be ignored would be entered.
Then, another on screen option to either show or hide or only show those "visitors", but in any case to provide an indicator for each such visitor that they used one of the "key" words.

This way, a review could be performed to see all traffic, all traffic that doesn't include that text or to look through all traffic of those that have tried that or similar.

How's that sound to you (and others)?

mc12345678:

Yes, considering that I see those type entries and others that are historically known to allow some form of sql injection (in older versions of ZC), I would suspect that those using this mod would see something similar.

So, with that in mind, my thought of approach is to create an admin configuration field, in which a portion of the string to cause the individual to be ignored would be entered.
Then, another on screen option to either show or hide or only show those "visitors", but in any case to provide an indicator for each such visitor that they used one of the "key" words.

This way, a review could be performed to see all traffic, all traffic that doesn't include that text or to look through all traffic of those that have tried that or similar.

How's that sound to you (and others)?

That sounds fantastic and would work awesome. I'm glad I could communicate the problem effectively, as seeing all those hack attempts in between the real customer visits kinda messes up the activity report. If it's hidden then I can see the big benefit. Great idea!

Nitroedge:

That sounds fantastic and would work awesome. I'm glad I could communicate the problem effectively, as seeing all those hack attempts in between the real customer visits kinda messes up the activity report. If it's hidden then I can see the big benefit. Great idea!

So I have this operational, I've chosen a few things to modify the "display", but I'd be glad to take others input for modification. Right now, a word is added in front of the "name" of the searcher (Guest or logged in individual) also there should be some color change made to parts of the row.

While the genesis of this feature was to eliminate the presentation of records for users "testing" the site, the feature also allows filtering for other reasons (to show records of users getting to a particular web-page, etc..). Filter "words" are to be comma separated and suggest using whatever is displayed when looking at the UT admin screen.

I have updated the github location but also have submitted the plugin to ZC with the following modifications identified:

• Version 1.5.5:
• • Removed HTML that was in the middle of PHP code.
• • Moved Admin menu option "name" to the languages folder to support multiple languages.
• • Improved sanitization for catalog and store side data capture.
• • Made radio labels clickable to support radio button activation.
• • Added feature to filter URL information that was captured when the site was visited.
• • Added default settings to the top of the admin/user_tracking.php file.
• • Removed unused code/variables in the two detection files.
• • Updated version compare software to latest available in the ZC 1.5.5 series (not identified yet to a specific version)

Once reviewed and accepted should be available from here.

That is awesome and thanks!

Sorry I can't find the github location, could you post it again or point me in the right direction?

Nitroedge:

That is awesome and thanks!

Sorry I can't find the github location, could you post it again or point me in the right direction?
User Tracking on github can be found here.

Got it, since my mod is working with my Zen Cart v1.51, should I just FTP overwrite all the files with the new files?

I don't need to do any install script or similar?

Just overwrite and I'll have the new features for filter words etc?

Nitroedge:

Got it, since my mod is working with my Zen Cart v1.51, should I just FTP overwrite all the files with the new files?

I don't need to do any install script or similar?

Just overwrite and I'll have the new features for filter words etc?

That's the expectation. Please report if that doesn't work, issues identified, and if had to work through something related to please identify the solution that worked. Or if no issues, would appreciate report back that worked and possibly other system conditions that may seem obscure or edge case (low/high PHP version, old ZC version, etc...)

Not entirely sure what's going on with the latest user tracking mod in ZC 1.5.5, but working properly is not happening. First of all the auto install doesn't create a database table called user_tracing, it doesn't create a config menu option and it doesn't create a tools menu option.

I ran the create user_tracking table function by planting it into a define page and loading the define page. Then the readme file says to add <?php $zco_notifier->notify('NOTIFY_FOOTER_END'); ?> to the end of the tpl_main_page.php file which doesn't make much sense as that call already exists there, but adding a call to the function zen_update_user_tracking(); does work. However, while this function call does get records added to the database table, the .com/admin/user_tracking.php still doesn't show any of those records. Just blank records area. User tracking back in the day had some issues, but this is crazy.

bumba000:

Not entirely sure what's going on with the latest user tracking mod in ZC 1.5.5, but working properly is not happening. First of all the auto install doesn't create a database table called user_tracing, it doesn't create a config menu option and it doesn't create a tools menu option.

I ran the create user_tracking table function by planting it into a define page and loading the define page. Then the readme file says to add <?php $zco_notifier->notify('NOTIFY_FOOTER_END'); ?> to the end of the tpl_main_page.php file which doesn't make much sense as that call already exists there, but adding a call to the function zen_update_user_tracking(); does work. However, while this function call does get records added to the database table, the .com/admin/user_tracking.php still doesn't show any of those records. Just blank records area. User tracking back in the day had some issues, but this is crazy.
Sounds like an incomplete install/upload of files.

The note about adding a notifier to the includes/templates/YOUR_TEMPLATE/common/tpl_main_page.php file is related to pre-ZC 1.5.5 because it is in ZC 1.5.5 that the notifier was added. There is the possibility that a newer template could have been installed to an older system that already had that line in it and yes the instruction would then be incorrect. It will be updated to indicate to add the line if it does not already exist.

As to no action being taken even with its presence, but calling the function seems to work AND that the notifier has already been identified as being present implies that the includes/auto_loaders and/or includes/classes/observers related file(s) have not been put to the server at least in the expected location(s).

I suggest also performing a search using the tools->developers tool kit for init_user_tracking and identifying the path(s) to the search response. Obscure the directory name for YOUR_SECRET_ADMIN directory if/when presented.

As to the lack of table and/or admin menu options in relation to the discussion of an older User Tracking installation, what is the history of the database to which this was installed? Had it previously had User tracking installed? It may be a good idea to run the uninstall sql to ensure removal of old partial remnants. A lot of effort went into Version 1.5.3 to try to convert previous installations to using this more standardized installer primarily so that the user_tracking table didn't get wiped out every time a new version was presented. There hasn't been a change to the table in a very long time, so there doesn't seem to be a need to delete it when other features are added/modified.

I checked uploaded files against all included in download. All files were uploaded.

public_html/shop/my_super_secret_admin_location/includes/auto_loaders/config.user_tracking_install.php

there was no previous installation as this is a fresh install.

Also, as stated previously. The responsive_classic template in use already includes the $zco_notifier->notify('NOTIFY_FOOTER_END', $current_page); mentioned in the installation_readme.txt file. It does not populate the user_tracking db table, but calling the function zen_update_user_tracking(); works as it always has.

bumba000:

I checked uploaded files against all included in download. All files were uploaded.

public_html/shop/my_super_secret_admin_location/includes/auto_loaders/config.user_tracking_install.php

there was no previous installation as this is a fresh install.

Also, as stated previously. The responsive_classic template in use already includes the $zco_notifier->notify('NOTIFY_FOOTER_END', $current_page); mentioned in the installation_readme.txt file. It does not populate the user_tracking db table, but calling the function zen_update_user_tracking(); works as it always has.
And with the includes/auto_loaders/config.user_tracking.php and includes/classes/observers/class.user_tracking.php in place as well as all of the version scripts being run: please identify what files are located in admin/includes/installers/user_tracking/
With all of that entered/applied, then all of the database settings would exist to allow the plugin to function. Otherwise there are settings that are missing that could cause the issues you are describing.

all of them
1_5_3.php,1_5_4.php,1_5_5.php and uninstall_user_tracking.php. I just ran the config queries

$db->Execute("INSERT IGNORE INTO " . TABLE_CONFIGURATION . "  (configuration_group_id, configuration_key, configuration_title,  configuration_value, configuration_description, sort_order, date_added,  use_function, set_function) VALUES (" . (int) $configuration_group_id .  ", 'ZEN_CONFIG_USER_TRACKING', 'User Tracking Visitors', 'true', 'Check  the Customers/Guests behaviour ? (each click will be recorded)', " . 10 *  (1 + (int)array_search('ZEN_CONFIG_USER_TRACKING', $sort_order)) . ",  NOW(), NULL, 'zen_cfg_select_option(array(''true'', ''false''),');");
        $db->Execute("INSERT IGNORE INTO " . TABLE_CONFIGURATION . "  (configuration_group_id, configuration_key, configuration_title,  configuration_value, configuration_description, sort_order, date_added,  use_function, set_function) VALUES (" . (int) $configuration_group_id .  ", 'ADMIN_CONFIG_USER_TRACKING', 'User Tracking (ADMIN)', 'true', 'Check  the ADMINs behaviour ? (each click will be recorded)', " . 10 * (1 +  (int)array_search('ADMIN_CONFIG_USER_TRACKING', $sort_order)) . ",  NOW(), NULL, 'zen_cfg_select_option(array(''true'', ''false''),');");
        $db->Execute("INSERT IGNORE INTO " . TABLE_CONFIGURATION . "  (configuration_group_id, configuration_key, configuration_title,  configuration_value, configuration_description, sort_order, date_added,  use_function, set_function) VALUES (" . (int) $configuration_group_id .  ", 'CONFIG_USER_TRACKING_EXCLUDED', 'User Tracking (exclude this  IP-Address)', 'your IP', 'Do NOT record this IP Address<br>(like  webmaster/owners/Beta-testers)', " . 10 * (1 +  (int)array_search('CONFIG_USER_TRACKING_EXCLUDED', $sort_order)) . ",  NOW(), NULL, NULL);");
        $db->Execute("INSERT IGNORE INTO " . TABLE_CONFIGURATION . "  (configuration_group_id, configuration_key, configuration_title,  configuration_value, configuration_description, sort_order, date_added,  use_function, set_function) VALUES (" . (int) $configuration_group_id .  ", 'CONFIG_USER_TRACKING_SESSION_LIMIT', 'User Tracking (Session  Limit)', '50', 'Displaying the latest # sessions of this 24 hour  period.<br>(SET to 999999 for unlimited per 24 hour  period)<br>NOTE:<BR>Watch you space !', " . 10 * (1 +  (int)array_search('CONFIG_USER_TRACKING_SESSION_LIMIT', $sort_order)) .  ", NOW(), NULL, NULL);");
        $db->Execute("INSERT IGNORE INTO " . TABLE_CONFIGURATION . "  (configuration_group_id, configuration_key, configuration_title,  configuration_value, configuration_description, sort_order, date_added,  use_function, set_function) VALUES (" . (int) $configuration_group_id .  ", 'CONFIG_USER_TRACKING_ADMIN_CAN_DELETE', 'User Tracking (Admin User  Can Delete)', 'true', 'Allow Record Deletion to be  Active?<br/>Setting this to true will override ENTRY and SESSION  purges.<br/>Default <b>true</b><br/>', " . 10 *  (1 + (int)array_search('CONFIG_USER_TRACKING_ADMIN_CAN_DELETE',  $sort_order)) . ", NOW(), NULL, 'zen_cfg_select_option(array(''true'',  ''false''),');");
        $db->Execute("INSERT IGNORE INTO " . TABLE_CONFIGURATION . "  (configuration_group_id, configuration_key, configuration_title,  configuration_value, configuration_description, sort_order, date_added,  use_function, set_function) VALUES (" . (int) $configuration_group_id .  ", 'CONFIG_USER_TRACKING_ADMIN_CAN_DELETE_RECORDS', 'User Tracking  (Admin User Can Delete Historical Data)', 'false', 'Allow Record  Deletion of records older than now - the purge duration set  below.<br/>This value is ignored if Admin User Can Delete is set  to true.  Otherwise set this to true to allow deletion of  visits.<br/>Default <b>false</b>.<br/>', " . 10 *  (1 + (int)array_search('CONFIG_USER_TRACKING_ADMIN_CAN_DELETE_RECORDS',  $sort_order)) . ", NOW(), NULL, 'zen_cfg_select_option(array(''true'',  ''false''),');");
        $db->Execute("INSERT IGNORE INTO " . TABLE_CONFIGURATION . "  (configuration_group_id, configuration_key, configuration_title,  configuration_value, configuration_description, sort_order, date_added,  use_function, set_function) VALUES (" . (int) $configuration_group_id .  ", 'CONFIG_USER_TRACKING_ADMIN_CAN_DELETE_SESSIONS', 'User Tracking  (Admin User Can Delete SESSIONS)', 'false', 'Allow SESSION Deletion to  be Active?<br/>This setting is ignored if Admin User Can Delete is  set to true.<br/>Default <b>false</b><br/>', " .  10 * (1 +  (int)array_search('CONFIG_USER_TRACKING_ADMIN_CAN_DELETE_SESSIONS',  $sort_order)) . ", NOW(), NULL, 'zen_cfg_select_option(array(''true'',  ''false''),');");
        $db->Execute("INSERT IGNORE INTO " . TABLE_CONFIGURATION . "  (configuration_group_id, configuration_key, configuration_title,  configuration_value, configuration_description, sort_order, date_added,  use_function, set_function) VALUES (" . (int) $configuration_group_id .  ", 'CONFIG_USER_TRACKING_ADMIN_CAN_DELETE_IP', 'User Tracking (Admin  User Can Delete IP)', 'false', 'Allow Deletion of records that match the  identified IP address?<br/>This setting is ignored if Admin User  Can Delete is set to true.<br/>Default  <b>false</b><br/>', " . 10 * (1 +  (int)array_search('CONFIG_USER_TRACKING_ADMIN_CAN_DELETE_IP',  $sort_order)) . ", NOW(), NULL, 'zen_cfg_select_option(array(''true'',  ''false''),');");
        $db->Execute("INSERT IGNORE INTO " . TABLE_CONFIGURATION . "  (configuration_group_id, configuration_key, configuration_title,  configuration_value, configuration_description, sort_order, date_added,  use_function, set_function) VALUES (" . (int) $configuration_group_id .  ", 'CONFIG_USER_TRACKING_PURGE_NUMBER', 'User Tracking (Purge this  Number)', '3', 'What is the number associated with purging before the  current date/time?<br/><br/>An example would be to choose 3  here and units associated with days to delete data greater than 3 days  before today.<br/>', " . 10 * (1 +  (int)array_search('CONFIG_USER_TRACKING_PURGE_NUMBER', $sort_order)) .  ", NOW(), NULL, NULL);");
        $db->Execute("INSERT IGNORE INTO " . TABLE_CONFIGURATION . "  (configuration_group_id, configuration_key, configuration_title,  configuration_value, configuration_description, sort_order, date_added,  use_function, set_function) VALUES (" . (int) $configuration_group_id .  ", 'CONFIG_USER_TRACKING_PURGE_UNITS', 'User Tracking (Purge Units)',  '1440', 'Pick the units associate with the periodicity to allow purging  data.<br/><br/>60) Hours<br/>1440)  Days<br/>10080) Weeks<br/>43200) Months (Based on 30  days)<br/>', " . 10 * (1 +  (int)array_search('CONFIG_USER_TRACKING_PURGE_UNITS', $sort_order)) . ",  NOW(), NULL, 'zen_cfg_select_option(array(''60'',  ''1440'',''10080'',''43200''),');");
        $db->Execute("INSERT IGNORE INTO " . TABLE_CONFIGURATION . "  (configuration_group_id, configuration_key, configuration_title,  configuration_value, configuration_description, sort_order, date_added,  use_function, set_function) VALUES (" . (int) $configuration_group_id .  ", 'CONFIG_USER_TRACKING_TRACK_TYPE_RECORD', 'User Tracking (Type of  User Interaction to Record)', '1', 'Type of user tracking to  record?<br/><br/>1 - All visitors.<br/>2 - Visitors  views where sessions have been started.<br/>3 - All users except  bots/spiders ( requires Configuration->Sessions->Prevent Spider  Sessions->true)  (Don\'t know if this works with Zen-Cart versions  older than 1.2.6d)<br/><br/>Related to above: If you set  Force Cookie Use->true, then at the first user entry, sessions do not  start!!! And in variants 2 and 3, user-tracking will not have started.  In this case you lose one click and do not log the refferal. But if this  user is a returning user and has an old/previous zen cookie the session  started and your tracking system will collect this info. So, the result  beforehand is not logged or will not be known.<br/>', " . 10 * (1  + (int)array_search('CONFIG_USER_TRACKING_TRACK_TYPE_RECORD',  $sort_order)) . ", NOW(), NULL, 'zen_cfg_select_option(array(''1'',  ''2'',''3''),');");
        $db->Execute("INSERT IGNORE INTO " . TABLE_CONFIGURATION . "  (configuration_group_id, configuration_key, configuration_title,  configuration_value, configuration_description, sort_order, date_added,  use_function, set_function) VALUES (" . (int) $configuration_group_id .  ", 'USER_TRACKING_WHOIS_URL', 'User Tracking (your favorite WHOIS URL)',  'http://www.dnsstuff.com/tools/whois.ch?ip=', 'Put here you favorite  WHOIS tracking site<br>(the IP will follow automaticly after this  url)', " . 10 * (1 + (int)array_search('USER_TRACKING_WHOIS_URL',  $sort_order)) . ", NOW(), NULL, NULL);");
        $db->Execute("INSERT IGNORE INTO " . TABLE_CONFIGURATION . "  (configuration_group_id, configuration_key, configuration_title,  configuration_value, configuration_description, sort_order, date_added,  use_function, set_function) VALUES (" . (int) $configuration_group_id .  ", 'ZEN_CONFIG_SHOW_USER_TRACKING_CATEGORY', 'User Tracking (Show  Product Category when tracking product clicks)', 'true', 'Show Product  Category when tracking product clicks', " . 10 * (1 +  (int)array_search('ZEN_CONFIG_SHOW_USER_TRACKING_CATEGORY',  $sort_order)) . ", NOW(), NULL, 'zen_cfg_select_option(array(''true'',  ''false''),');");

But I haven't been able to find the admin pages queries to create those records. When I do access the config page which did get placed in the configuration_group with id 31, there are only three options on the page update check, version installed and filter words.

ehhh. well I did find those queries in admin> installers/ut/1_5_5.php. So I guess there are only supposed to be those three config options. Well either way, the admin/user_tracking.php page isn't showing any of the records that I now have being logged into the ut db table.

I haven't gotten to the bottom of it just yet, but the reason no records are being returned has something to do with $time_frame

So. Records are being returned now after changing the date range back one day as the server date is currently 07/13/2017 02:07:55 though it's still only 10 pm 7/12 here. I haven't done a fresh install in some time so I'll work on changing the default time zone. However, this doesn't change the fact that there were no records being returned for the 12th when the server date was the 12th.

So, issue was in both some note taking and a modification made in the admin/includes/init_includes/init.user_tracking.php file.

a sort function was removed that is needed.

  if (sizeof($installers) > 0) {
      $newest_version = $installers[0];
      $newest_version = substr($newest_version, 0, -1 * $file_extension_len);

      if (version_compare($newest_version, $current_version) > 0) {
          foreach ($installers as $installer) {
              if (substr($installer, strrpos($installer, '.')) == $file_extension && (preg_match('~^[^\._].*\.php$~i', $installer) > 0 || $installer != 'empty.txt')) {
                  if (version_compare($newest_version, substr($installer, 0, -1 * $file_extension_len)) >= 0 && version_compare($current_version, substr($installer, 0, -1 * $file_extension_len)) < 0) {
                      include($module_installer_directory . '/' . $installer);
                      $current_version = str_replace("_", ".", substr($installer, 0, -1 * $file_extension_len));
                      $db->Execute("UPDATE " . TABLE_CONFIGURATION . " SET configuration_value = '" . $current_version . "', set_function = 'zen_cfg_select_option(array(\'" . $current_version . "\'),' WHERE configuration_key = 'CONFIG_" . $module_constant . "_VERSION' LIMIT 1;");
                      $messageStack->add("Installed " . $module_name . " v" . $current_version, 'success');
                  }
              }
          }
      }
  }

modified to:

  if (sizeof($installers) > 0) {
      $newest_version = $installers[0];
      $newest_version = substr($newest_version, 0, -1 * $file_extension_len);

      sort($installers);
      if (version_compare($newest_version, $current_version) > 0) {
          foreach ($installers as $installer) {
               if (substr($installer, strrpos($installer, '.')) == $file_extension  && (preg_match('~^[^\._].*\.php$~i', $installer) > 0 ||  $installer != 'empty.txt')) {
                  if  (version_compare($newest_version, substr($installer, 0, -1 *  $file_extension_len)) >= 0 &&  version_compare($current_version, substr($installer, 0, -1 *  $file_extension_len)) < 0) {
                      include($module_installer_directory . '/' . $installer);
                      $current_version = str_replace("_", ".", substr($installer, 0, -1 * $file_extension_len));
                       $db->Execute("UPDATE " . TABLE_CONFIGURATION . " SET  configuration_value = '" . $current_version . "', set_function =  'zen_cfg_select_option(array(\'" . $current_version . "\'),' WHERE  configuration_key = 'CONFIG_" . $module_constant . "_VERSION' LIMIT  1;");
                      $messageStack->add("Installed " . $module_name . " v" . $current_version, 'success');
                  }
              }
          }
      }
  }

The scandir function is intended to return the list in descending order. This allows quickly identifying if there is a new version associated. The note next to that action is incorrect identifying that the order is instead ascending. The second sort (missing in the download) is to organize the list to apply the updates in sequence and to prevent running recognized undesirable files. It was a sort of last minute "fix" thinking that by removing it the file was being returned back to more of its original state.

mc12345678:

That's the expectation. Please report if that doesn't work, issues identified, and if had to work through something related to please identify the solution that worked. Or if no issues, would appreciate report back that worked and possibly other system conditions that may seem obscure or edge case (low/high PHP version, old ZC version, etc...)

I copied over all the files and overwrote the old ones. The User Tracking under Tools just came up blank. I checked out the config and saw the new entry for the words filter though.

Unfortunately what I think has happened is I am running ZC v1.51 and I remember when I installed your last latest version .54 first nothing worked for me, I had to go back and download the base v1.5 version with the SQL installer. Running the installer made everything work 100%.

I now have run the uninstall SQL for your new version, then deleted all the files that were uploaded. So I'm back to square one.

I can re-install v1.5 and likely get it to work as it used to using the SQL installer but wouldn't have any of the new features.

So this one works for me fine:
User Tracking - Version: v1.5 Full
Updated 12/08/2013 Version 1.5

But I see in v1.53 you added this:
User Tracking - Version: 1.5.3

1. Implemented an installation/upgrade script instead of expecting users to try to successfully run the installation sql and to
   remove the need of clearing the database of existing records when performing an update that does not modify the records table.

Is that script supposed to auto-run after the files are uploaded? Or for Zen Cart v1.51 am I supposed to execute it manually?

Thanks!

Brandon

Nitroedge:

I copied over all the files and overwrote the old ones. The User Tracking under Tools just came up blank. I checked out the config and saw the new entry for the words filter though.

Unfortunately what I think has happened is I am running ZC v1.51 and I remember when I installed your last latest version .54 first nothing worked for me, I had to go back and download the base v1.5 version with the SQL installer. Running the installer made everything work 100%.

I now have run the uninstall SQL for your new version, then deleted all the files that were uploaded. So I'm back to square one.

I can re-install v1.5 and likely get it to work as it used to using the SQL installer but wouldn't have any of the new features.

So this one works for me fine:
User Tracking - Version: v1.5 Full
Updated 12/08/2013 Version 1.5

But I see in v1.53 you added this:
User Tracking - Version: 1.5.3

1. Implemented an installation/upgrade script instead of expecting users to try to successfully run the installation sql and to
   remove the need of clearing the database of existing records when performing an update that does not modify the records table.

Is that script supposed to auto-run after the files are uploaded? Or for Zen Cart v1.51 am I supposed to execute it manually?

Thanks!

Brandon

Yes, in version 1.5.3 an auto installer was incorporated that was written/rewritten to support updating previous installations of User Tracking and to support new installation.

As described here below and in conversation with bumba000, it was identified that the installer provided in this version of User Tracking is missing an important line of code as highlighted below in red.

To explain how it works (or how it is supposed to have worked but because of others reporting issues with installation I had "tried" to rewrite the code that was actually perfectly fine, but in rewriting I had made it more complex, then when I tried to restore it back to its original state I made a last minute decision when zipping the file to remove the sort thinking that it wasn't necessary), the installer directory is reviewed, files that are not applicable are removed, the current highest plugin version is identified and then for any version that is older than the currently installed version that installer file is executed. To do this requires first a list of all the files in descending order (documented note is incorrect), then remove all of the undesirable files to get to the first/most recent version. Then as long as there is a file remaining in the list, reverse the list sequence and if the file is an installer that is newer than the current version, execute it.

So, I would say to resolve the issue and have the latest update (ran this last night on a few different ZC versions), update the admin/includes/init_includes/init.user_tracking.php file to contain the below 'sort($installers);' line, then upload all of the files to your server. The plugin will auto-install and contain all of the features requested.

mc12345678:

So, issue was in both some note taking and a modification made in the admin/includes/init_includes/init.user_tracking.php file.

a sort function was removed that is needed.

if (sizeof($installers) > 0) {
$newest_version = $installers[0];
$newest_version = substr($newest_version, 0, -1 * $file_extension_len);

  if (version_compare($newest_version, $current_version) > 0) {
      foreach ($installers as $installer) {
          if (substr($installer, strrpos($installer, '.')) == $file_extension && (preg_match('~^[^\._].*\.php$~i', $installer) > 0 || $installer != 'empty.txt')) {
              if (version_compare($newest_version, substr($installer, 0, -1 * $file_extension_len)) >= 0 && version_compare($current_version, substr($installer, 0, -1 * $file_extension_len)) < 0) {
                  include($module_installer_directory . '/' . $installer);
                  $current_version = str_replace("_", ".", substr($installer, 0, -1 * $file_extension_len));
                  $db->Execute("UPDATE " . TABLE_CONFIGURATION . " SET configuration_value = '" . $current_version . "', set_function = 'zen_cfg_select_option(array(\'" . $current_version . "\'),' WHERE configuration_key = 'CONFIG_" . $module_constant . "_VERSION' LIMIT 1;");
                  $messageStack->add("Installed " . $module_name . " v" . $current_version, 'success');
              }
          }
      }
  }

}

> 
> modified to:
> ```
  if (sizeof($installers) > 0) {
      $newest_version = $installers[0];
      $newest_version = substr($newest_version, 0, -1 * $file_extension_len);

      sort($installers);
      if (version_compare($newest_version, $current_version) > 0) {
          foreach ($installers as $installer) {
               if (substr($installer, strrpos($installer, '.')) == $file_extension  && (preg_match('~^[^\._].*\.php$~i', $installer) > 0 ||  $installer != 'empty.txt')) {
                  if  (version_compare($newest_version, substr($installer, 0, -1 *  $file_extension_len)) >= 0 &&  version_compare($current_version, substr($installer, 0, -1 *  $file_extension_len)) < 0) {
                      include($module_installer_directory . '/' . $installer);
                      $current_version = str_replace("_", ".", substr($installer, 0, -1 * $file_extension_len));
                       $db->Execute("UPDATE " . TABLE_CONFIGURATION . " SET  configuration_value = '" . $current_version . "', set_function =  'zen_cfg_select_option(array(\'" . $current_version . "\'),' WHERE  configuration_key = 'CONFIG_" . $module_constant . "_VERSION' LIMIT  1;");
                      $messageStack->add("Installed " . $module_name . " v" . $current_version, 'success');
                  }
              }
          }
      }
  }

The scandir function is intended to return the list in descending order. This allows quickly identifying if there is a new version associated. The note next to that action is incorrect identifying that the order is instead ascending. The second sort (missing in the download) is to organize the list to apply the updates in sequence and to prevent running recognized undesirable files. It was a sort of last minute "fix" thinking that by removing it the file was being returned back to more of its original state.

@nitroedge,

I also uploaded a new version, 1.5.6, to github that addresses the issue described and modified the installation instructions only slightly.

Though I'd really like to submit a version that does more than what is covered in the above post.

I have submitted version 1.5.6 for review.
When made available should be downloadable from: https://www.zen-cart.com/downloads.php?do=file&id=159

Primarily adds an error log if the install file is loaded to the store instead of admin, corrects the error I made in the installer in the most recent upload, and modified the instructions a little to make some minor improvements.