PHP inside ezpages

hey Glenn, yeah, now I'm a little confused, but things work fine.

I did wonder why that 'new_products = false' code was in there when I first looked at this file to add the not-home-page code, but the new products centerbox was displaying fine everywhere before adding the not-home-page code, and now is displaying fine everywhere except the home page, which is what we wanted.

So, yeah, I have no idea why that 'false' code doesn't interfere .. but the 'true' test below it is maybe reversing it (when Admin >> Config setting does have have New Prods centerbox set to display). This is what you are calling the 'resetting' test? Maybe that 'false' code is there so that this file's code simply makes sure that New Prods centerbox is totally off before running the main part of the code, which then turns the centerbox on.

Since it does work correctly, I am sure that there is some testing code in the module file that is "required" after the "false" setting. That code in the other file will decide whether the sidebox should be displayed and return a true or false value accordingly.

TecBrat:

Not a Question, but I didn't know where else to post this.

I posted this in the infopages thread a while back. I have updated it to work with ezpages in 1.3.0

To allow PHP code to run inside a "page".

copy includes/templates/template_default/templates/tpl_page_default.php to
includes/templates/your template/templates/

Then edit the new copy as such
find between "<div></div>"

echo $var_pageDetails->fields['pages_html_text'];

> and replace with:
> 
> ```
$titlecheck=substr($var_pageDetails->fields[pages_title],0,9);
if ($titlecheck=="allowcode"){
eval(stripslashes($var_pageDetails->fields['pages_html_text']));}
else{echo $var_pageDetails->fields['pages_html_text']; }

Change "allocode" to whatever name you want your php code ezpages to have, or add more names or remove the if alltogether if you want. (dont forget to change ,0,9 to ,0,x where x is the length of your "allowcode" replacement string.

I hope this is helpful. (I notice that someone else was looking to use include in infopages or ezpages, That's exactly what I am doing. Apparently That person didn't dig deep enough in the other thread, it was 30+ pages long.)

HI
I cant understand
allowcode is my page title (ie the <h1> of my ezypage?) or is it the url /my_ezy_url ? That would be rewritten though because i use seo url mod

And the 0,9... what is that exactly? Change the 9 to the number of characters in my code? Does that include spaces?

Also - with the second example

Which he said is a security issue - is this just a security issue that someone with access to admin area could put some code into ezy pages or could a "customer" enter php somewhere and steal info from my database etc? Customers are able to enter details into ZC database and the file to edit ncludes/templates/template_default/templates/tpl_page_default.php is not just a ezy pages file its the main template default page for the whole site isnt it? Shouldnt it be changing the ezy page template file somewhere instead?

So, at this point, the FCKEditor is apparently retired. While I can still download FCKEditor v2.6.6, the current editor is CKEditor 3.6.1 (3.4 for zencart). The CKEditor is still fracking up my PHP and adding code (!-- and -- to essentially comment it out) to make it not work. does anyone know if the FCKEditor hack mentioned at the beginning of the thread works for CKEditor too?

Ideally, what I'm trying to do in the end is be able to write in php into the EZpages and product page descriptions some php that allows specific products to be added to the cart from those non-standard pages.

I created a directory under /templates/my_template/php. I can call requires from there so far using the get-template-dir method; I'm trying to put several SmugMug galleries on an ez-page. I'm using phpSmug but haven't made it too far.

I am wondering about security implications and even though my plan is to use OAuth, I remain somewhat concerned about injecting a third party within the template directory. I imagine there is a better, modular, way to enable this integration that's more secure; I just don't know what it is or how to do it. Any thoughts?

This thread was started quite a while ago so I wanted to get the current scoop on adding PHP to EZ-pages in .1.3.9h.
0) Can it still be done

1. Replace which code? Is the following still valid:

Originally Posted by TecBrat View Post
Not a Question, but I didn't know where else to post this.

I posted this in the infopages thread a while back. I have updated it to work with ezpages in 1.3.0

To allow PHP code to run inside a "page".

copy includes/templates/template_default/templates/tpl_page_default.php to
includes/templates/your template/templates/

Then edit the new copy as such
find between "<div></div>"
Code:

echo $var_pageDetails->fields['pages_html_text'];

and replace with:

Code:

$titlecheck=substr($var_pageDetails->fields[pages_title],0,9);
if ($titlecheck=="allowcode"){
eval(stripslashes($var_pageDetails->fields['pages_html_text']));}
else{echo $var_pageDetails->fields['pages_html_text']; }

Change "allocode" to whatever name you want your php code ezpages to have, or add more names or remove the if alltogether if you want. (dont forget to change ,0,9 to ,0,x where x is the length of your "allowcode" replacement string.

I hope this is helpful. (I notice that someone else was looking to use include in infopages or ezpages, That's exactly what I am doing. Apparently That person didn't dig deep enough in the other thread, it was 30+ pages long.)

2. FCKEditor?
3. Security Issues?

Thank you

Nevermind, I just did it using the simple method and its working great on 1.3.9h. Did not do anything with FCKeditor.

The Eval approach has worked perfectly for me (since I reverted to the standard editor), but I'm having trouble using it to call any file that's not in the root directory. If I try to have the page code access anything in includes, etc., it comes back as an "access denied."

I suppose it may be OK to put files into the root directory, but I'm a little worried about it.

Some of the threads mention changing the .htaccess file, but I wasn't able to get that to produce any result.

What I'm doing is using the ez page to display member account data from an external service we provide them. So they can see their list of transactions when logged in to their Zen Cart account. If they aren't logged in, the page isn't accessible.

The php page to generate the display has to pull data from the MySQL database based on their customer number and use that to query the external system. So there are two systems worth of data access that I'd like to keep as protected as possible.

Right. All php file access inside the includes folder is off-limits to scripts running from a browser.
I strongly suggest from a security standpoint that EZ-Pages is the WRONG place to be injecting PHP code. Period.

Call a file in the root directory. If it's not written with enough security to be put there, then it ought not to be on your site at all.

brandtim's simple solution on page 1 works for me. But I'm having a problem pulling from the database on an EZ page that serves as a comparison page I have written about some products.

<?php echo 'test' . zen_get_products_display_price((int)$_GET['2206']); ?>

The above code inserted into the EZ page is commented out by zen-cart when the page is displayed. From the live page source:

<!--?php echo '$' . zen_get_products_display_price((int)$_GET['2206']); ?-->

I need to amend my previous post to say that the solution does NOT work for me. That's what happens when I try.

Bump. Any solutions?

Bump again. Am I the only one needing to pull pricing info on EZ pages?

I've studied TechBrat's posts several times, but I can't for the live of me figure out what the "allocode" he's talking about is for.

Nevermind! I don't know what I did wrong, but it's working now.

"allocode" --> "allowcode". Amazing the trouble one missing letter early in a thread can cause:)

Is there a further modification to brandtim's excellent solution that can be done to allow a backslash in javascript code that I'm using in an EZPage? Zencart is removing the backslash in the replace function here and I believe is breaking my code in the process.

return decodeURIComponent(keyvaluepair[1].replace(/+/g, ' '));

brandtim's solution to allow PHP code:

brandtim:

MODERATOR COMMENT: Adding eval() to arbitrarily execute random PHP or other code in the manner suggested here opens your site up to security risks.
USE AT YOUR OWN RISK.

I definately needed this feature. Here's an even simpler version.

Replace this:

DrByte:

Right. All php file access inside the includes folder is off-limits to scripts running from a browser.
I strongly suggest from a security standpoint that EZ-Pages is the WRONG place to be injecting PHP code. Period.

Call a file in the root directory. If it's not written with enough security to be put there, then it ought not to be on your site at all.
Good morning.. I promise I am not trying to be a hard-head here, but I have a client who won't simply accept this answer. I've explained that EZ Pages are saved to the DB and we can't save executable code to the DB.. Would be able to provide me with something more I can take back to her so she will let this go once and for all..:smile:

While the general principle still applies (don't enter programming code via admin screens), I can't give you one generic answer that could adequately arm you with suitable information to convince your client one way or another. Details of what exactly they want to accomplish (the end result), and why (the business goal they're trying to meet or the problem they're trying to solve), as well as why they're convinced that the solution they've come up with is the "right" one having forsaken all others, are all important pieces of information.

DrByte:

While the general principle still applies (don't enter programming code via admin screens), I can't give you one generic answer that could adequately arm you with suitable information to convince your client one way or another. Details of what exactly they want to accomplish (the end result), and why (the business goal they're trying to meet or the problem they're trying to solve), as well as why they're convinced that the solution they've come up with is the "right" one having forsaken all others, are all important pieces of information.I understand.. I'm just looking to find an explanation of the security risks involved with adding PHP code to EZ Pages since the explanations I've provided thus far (based largely on your prior posts) haven't convinced her yet that this is not a good idea.. sigh

The "business problem" she is trying to solve is that she wants to use a particular slideshow/gallery on her site and she wants to be able to add the slideshow code to ANY EZ Page on the site.. Adding it to the defined pages is not an issue, but she is INSISTING on being able to use EZ pages to add these slideshows to as well.. sigh I can create as many defined pages as she needs to do this, but she somehow seems to feel that she won't have "flexibility" if she can't use EZ Pages too..