Custom link to uploaded file not displayed correctly in shopping cart

Hi!

I have modified the shopping_cart.php to show the uploaded image in the shopping cart, or a link if the uploaded file is not an image.
This was working perfectly fine when testing this on my local computer running a server.
Now I migrated to a web server and this feature is not working anymore :no:
When uploading the image / file, the html code that is being generated by the shopping_cart.php is being displayed on the page :cry:
I have no idea how this could happen, please help me!
I am guessing there is a permissions problem or so, but what is even more strange is, that during the check out, the image or link is displayed correctly...

If you want to try and see for yourself, you can visit http://www.priedel.com/laserwerks
user: test
password: test

This is the code of my shopping_cart.php:

          $real_ids = isset($_POST['id']) ? $_POST['id'] : "";
          if (isset($_GET['number_of_uploads']) && $_GET['number_of_uploads'] > 0) {
            /**
             * Need the upload class for attribute type that allows user uploads.
             *
             */
            include(DIR_WS_CLASSES . 'upload.php');
            for ($i = 1, $n = $_GET['number_of_uploads']; $i <= $n; $i++) {
              if (zen_not_null($_FILES['id']['tmp_name'][TEXT_PREFIX . $_POST[UPLOAD_PREFIX . $i]]) and ($_FILES['id']['tmp_name'][TEXT_PREFIX . $_POST[UPLOAD_PREFIX . $i]] != 'none')) {
                $products_options_file = new upload('id');
                $products_options_file->set_destination(DIR_FS_UPLOADS);
                $products_options_file->set_output_messages('session');
                if ($products_options_file->parse(TEXT_PREFIX . $_POST[UPLOAD_PREFIX . $i])) {
                  $products_image_extension = substr($products_options_file->filename, strrpos($products_options_file->filename, '.'));
                  if ($_SESSION['customer_id']) {
                    $db->Execute("insert into " . TABLE_FILES_UPLOADED . " (sesskey, customers_id, files_uploaded_name) values('" . zen_session_id() . "', '" . $_SESSION['customer_id'] . "', '" . zen_db_input($products_options_file->filename) . "')");
                  } else {
                    $db->Execute("insert into " . TABLE_FILES_UPLOADED . " (sesskey, files_uploaded_name) values('" . zen_session_id() . "', '" . zen_db_input($products_options_file->filename) . "')");
                  }
                  $insert_id = $db->Insert_ID();
				  $datei = strtolower($products_image_extension);


//Zeige als Bild wenn bilddatei, sonst zeige link!
				  $rand = rand();
				  $randsave = $rand;

				  if ($datei == '.jpg' || $datei == '.jpeg' || $datei == '.gif' || $datei == '.png' ){
				   $real_ids[TEXT_PREFIX . $_POST[UPLOAD_PREFIX . $i]] = '<a target="blank" href="images/uploads/' . $randsave . $insert_id . $products_image_extension . '"><img src="images/uploads/' . $randsave . $insert_id . $products_image_extension . '" width="160"></img></a><br>Image ID: [ '. $randsave . $insert_id . ' ]  <br>Image name: ' . $products_options_file->filename;
				   }
				   
				   else {
				   $real_ids[TEXT_PREFIX . $_POST[UPLOAD_PREFIX . $i]] = '<a target="blank" href="images/uploads/' . $randsave . $insert_id . $products_image_extension . '">'. $randsave . $insert_id . $products_image_extension .' </a>' . $products_options_file->filename;
				   }

                  $products_options_file->set_filename($randsave . "$insert_id" . $products_image_extension);
                  if (!($products_options_file->save())) {
                    break;
                  }
                } else {
                  break;
                }
              } else { // No file uploaded -- use previous value
                $real_ids[TEXT_PREFIX . $_POST[UPLOAD_PREFIX . $i]] = $_POST[TEXT_PREFIX . UPLOAD_PREFIX . $i];
              }
            }
          }

Please, I need help :cry:

THANK YOU!

• Paul

Link is secured

What line #'s does this code represent?

kobra:

Link is secured

The username is "test", the password is also "test"

kobra:

What line #'s does this code represent?
That would be:
1605 - 1651

Thank you!

Oh, and is is manipulated by me starting at:

//Zeige als Bild wenn bilddatei, sonst zeige link!

I looked and did not see an issue nor anything that is different than a default install

Check your PM's

You will see the issue when adding an image or another file to the only product that exists in the store.
Then look into the shopping cart.

Please, someone? I need help :cry:

You might add a details list for:

ZenCart Version
Server type
php version
mysql version

My live Server:

Linux Server
PHP version 4.4.6
MySQL version 4.1.22
ZC version: 1.3.7.1

My local machine that I developed on and where this is working:

Windows NT Server
PHP version 5.2.1
MySQL version: 5.0.37
ZC version: 1.3.7

Hey guys!

I have tried and tried, but I was still not able to find a solution.

I don't think I'm the first one to try to display an uploaded image to the user after the upload. Does someone maybe know of a better/easier/working way to do this?

Thanks!!

• Paul

When uploading the image / file, the html code that is being generated by the shopping_cart.php is being displayed on the pageIf you undo all your custom coding on the live server, and then test image uploads, do you still have this problem?

Are the uploads getting saved to the images/uploads folder?

What are your permissions set to on the images/uploads folder?

"Which" html code is being displayed on the page? ie: "everything" or just a certain part, etc?

Does this happen for all filetypes?

Is your live server's PHP configuration set up to allow uploads?
Is its temporary upload folder properly configured and writable ?

Hi!

The upload itself is not the problem. The image or file is uploaded properly.
Only the shopping_cart.php was manipulated out output the following html (depending on the uploaded file of course):

Engraved image - <a target="blank" href="images/uploads/891023110135.jpg"><img src="images/uploads/891023110135.jpg" width="160"></img></a><br>Image ID: [ 891023110135 ] <br>Image name: 01102005(001).jpg

After uploaded a image (or a file is the same behaviour), this html code itself is displayed in the shopping cart.
On the last screen of the checkout, this is displayed correctly again (the image is displayed instead of the image's html code), which is very strange.

I have tried setting all permissions to 777 for a short time to test if that makes a difference, but it didn't.

:cry:

Thanks,

• Paul

since your site is blocked from outside access, there's no way to test this to see what exactly the generated HTML really is.

Can you create the problem, then copy and paste your browser source for review ?

Hi!

To access the site use the following credentials:
user: test
password: test

Thanks!

• Paul

FYI:
Right now the issue does not occur because I reset the shopping_cart.php to show to the future store owner..

PaulRiedel:

Hi!

To access the site use the following credentials:
user: test
password: test

Thanks!

• Paul

I did that, using the info from your first post.
Using "test" and "test" wasn't accepted.
That's why I posted.

Hi!

For me test/test is wokring..
However this is the html source code of what is displayed in the browser (this is the part that should display the image with a link to the file:

<li>Engrave image - <a target="blank" href="images/uploads/516865279149.jpg"><img src="images/uploads/516865279149.jpg" width="160"></img></a><br>Image ID: [ 516865279149 ]  <br>Image name: Clipboard01.jpg</li>

I think this is a good idea to investigate. Maybe you can find something?

Thanks!

• Paul

I have changed the current code:

$real_ids[TEXT_PREFIX . $_POST[UPLOAD_PREFIX . $i]] = '<a target="blank" href="images/uploads/' . $randsave . $insert_id . $products_image_extension . '"><img src="images/uploads/' . $randsave . $insert_id . $products_image_extension . '" width="160"></img></a><br>Image ID: [ '. $randsave . $insert_id . ' ]  <br>Image name: ' . $products_options_file->filename;

to:

$real_ids[TEXT_PREFIX . $_POST[UPLOAD_PREFIX . $i]] = '<a target="blank" href="images/uploads/' . $randsave . $insert_id . $products_image_extension . '"><img src="images/uploads/' . $randsave . $insert_id . $products_image_extension . '" width="160"></img></a><br>Image ID: [ '. $randsave . $insert_id . ' ]  <br>Image name: ' . $products_options_file->filename;

Hoping that this would simply switch it around, but the webpage now does the same and the output is:

Engrave image - <a target="blank" href="images/uploads/1060882729150.jpg"><img src="images/uploads/1060882729150.jpg" width="160"></img></a><br>Image ID: [ 1060882729150 ] <br>Image name: nav1.jpg 

which's code is:

<li>Engrave image - &lt;a target=&quot;blank&quot; href=&quot;images/uploads/1060882729150.jpg&quot;&gt;&lt;img src=&quot;images/uploads/1060882729150.jpg&quot; width=&quot;160&quot;&gt;&lt;/img&gt;&lt;/a&gt;&lt;br&gt;Image ID: [ 1060882729150 ]  &lt;br&gt;Image name: nav1.jpg</li>

Any idea?

Maybe an encoding issue because I am now on a Linux Server and I was on a Windows server before, where this was working, and I just copied the file that was working on the Windows Server to the Linux Server. Does ZC maybe differenciate between these systems and I should have implemented by changes in the new file again instead of just copying the file?

:cry::cry::cry:

Thanks a lot for your investigation-start point though, I'm sure this will help .. someone? :wink:

• Paul

<li>Engrave image - &lt;a target=&quot;blank&quot; href=&quot;images/uploads/1060882729150.jpg&quot;&gt;&lt;img src=&quot;images/uploads/1060882729150.jpg&quot; width=&quot;160&quot;&gt;&lt;/img&gt;&lt;/a&gt;&lt;br&gt;Image ID: [ 1060882729150 ] &lt;br&gt;Image name: nav1.jpg</li>

Does it really generate all the extra > &or did you add those yourself?

The information is sanitized before display so that customers and hackers cannot inject rogue content into your site and end up exploiting your store.

This line in includes/modules/pages/shopping_cart/header_php.php handles that:```
$attrArray[$option]['products_options_values_name'] = zen_output_string_protected($attr_value) ;

If you wish to retain the security protection, then you'll need to find a different way to supply a link to the uploaded file.