RP 5.1 issues

[Zigw]

Hi Chuck -

We've upgraded RP from 4.04 to 5.1 on a test instance. I haven't tested thoroughly yet, but noticed a few issues already I was hoping you could explain or fix:

1. When I view Reviews from Profile, HTML is interpreted, even though Allow HTML in Reviews is "Off" in admin, so that's a security issue. Reviews viewed on the product pages do not have this issue. This seems to be an old bug that keeps coming back.

2. When I click on Subscriptions in the top menu, I don't see my subscribed categories. I do see them in my Profile stats, so they exist. They just don't get displayed from subscriptions.php. Doesn't appear to be a black on black issue.

3. When I click on Subscriptions in Profile, I also don't see them, and I loose the Profile menu, so have to back out.

4. The Search page only shows "All Categories" in the Select Categories window, even when logged-in and registered as a normal user, so users can't narrow their searches. I see all categories when logged-in as admin, though.

I'm sure I'll have more items, but thought I'd get you going on these first.

Thanks!
Zig

[Chuck S]

1. actually its never a security issue because we do not allow harmful html tags ever. The only place I know of we purposely do not post html is showcat and thats for a whole different reason.

2. Thats a different subscription thing thats actually subscriptions. Your category or product notifications are as always displayed under your classifieds profile.

3. Your notifications are most definately there have tested this on my very own site.

4. I would have to see that. If I look at my search page this is what I see

Search - Reeftalk Reviews

[Zigw]

Originally Posted by Chuck S

1. actually its never a security issue because we do not allow harmful html tags ever. The only place I know of we purposely do not post html is showcat and thats for a whole different reason.

2. Thats a different subscription thing thats actually subscriptions. Your category or product notifications are as always displayed under your classifieds profile.

3. Your notifications are most definately there have tested this on my very own site.

4. I would have to see that. If I look at my search page this is what I see

Search - Reeftalk Reviews

1. Well, I can call javascript, which I think you'll agree is definitely a problem. Also seems odd that it would be allowed in one place and not the other for the same content.

2. Ah, more info please. What is it and how is it used? Clicking on the second menu item on a site and getting a blank frame other than a title is not good IMO. On your site, it says " Subscriptions Subscription Duration This is the friendly duration name as in 1 week, 1 month, 1 year etc. Order" which isn't much better. What do you do with it? Can we turn that menu choice off?

3. I'll say it a different way: clicking on "List Subscriptions" in Profile goes to the same blank frame (/reviews/subscriptions.php) as the link on the menu bar, taking you out of Profile. Does the same on your site. Clicking on "Statistics" does show Category Subscriptions.

4. Hmm, your site behaves differently. If not logged-in, it behaves the same as ours (only "All Categories" are displayed in the selection box). Once I login to your site it shows the categories, but ours does not for a regular user, however it does for admin. Why would that be? We have "Require users to be registered to use search?" set to "No". How do we allow all visitors to select categories without having to register and login?

Ran into a couple more issues:

5. "Forgot Password" doesn't send a new password email. It does send an email if admin resets a user's password manually.

6. Emails like registration confirmation and password reset have "<br/>" strings in them instead of line feeds.

Thanks,
Zig

[Chuck S]

1. I can look at it but I am not seeing any issue there. any line we call un_htmlspecialchars on is NOT going to allow any script input object or embed tags

Content visible to verified customers only.

2. Your getting confused. Subscriptions there are NONE so it should be blank on my site or any other not using subscriptions. Notifications and subscriptions are two seperate things. Subscriptions are something you can setup for payment to receive higher permissions.

3. Your notifications are listed under statistics just like they always have been for quite a long while which is why I do not understand your confusion.

Member Profile - Reeftalk Reviews

4. will check that out

5. will check that out

6. line breaks are converted to breaks I beleive.

[Zigw]

Thanks.

1. Shouldn't <script> be added to that list of stripped tags? BTW, I am able to show ordered and unordered lists, bold, etc., so the code that displays reviews from profile must not call it, or is different. I'll take a look.

2. Okay, I understand there are two types of subscriptions now (let's call the new one "site", and the old one "product") but I'm wondering why the site subscriptions option is shown as a major menu item if it isn't being used. Can we turn it off? Should there be an admin option? I just find it odd that the second menu item on the site does nothing. BTW, how do they work?

3. My point is clicking on the new List Subscriptions link is the only link on the left side that takes you away from member.php. The others don't, so it's confusing.

4,5. Thanks.

6. They don't seem to be for us.

[Chuck S]

1. it already is off the list. the only tags allowed are what I posted above.

2. There is no overall kill switch currently no one else has reported any such confusion and the feature has been around awhile. Something I can definately look at adding in the future. I am working on an update to support xenforo so maybe soon.

[Zigw]

1. Ah, I thought it worked the other way.

2. That would be nice.

BTW, is RP 5.1 compliant with PHP 5.3.x? I'm seeing some function calls that are depreciated in PHP 5.3.x (according to this page: PHP: Deprecated features in PHP 5.3.x - Manual), and that's the main reason we want to upgrade RP, as PHP 5.2.x is EOL.

Thanks.

[Chuck S]

I would have to do a more indepth search but I am using 5.3.1 on my site with no issues.

[Zigw]

I see: eregi(), ereg_replace(), eregi_replace(), set_magic_quotes_runtime(), split(), but I didn't do an exhaustive search. A lot of the calls have the @ prefix, which I think suppresses warnings.

[Chuck S]

I know alot of work has to be done when 6.0 php comes out which is what we are working on.

[Zigw]

Hi Chuck -

Any updates on the list of issues you were looking into?

We noticed HTML is not being evaluated for products in the RSS feed, even though we have HTML enabled for products in the admin options. Is there a way to disable RSS? We use our own news system.

Thanks,
Zig

[Chuck S]

I do not beleive the rss feed is suppose to render html as in execute it as we see it

Number 5 I do not see any issues maybe a language issue? The phrase called for the letter is epassres and definitely exists and works.

Number 4 as well my site works the proper way things should be coded. Maybe ensure you have uploaded ALL the files from the latest distribution?

[Zigw]

Originally Posted by Chuck S

I do not beleive the rss feed is suppose to render html as in execute it as we see it

Okay. All our products have HTML, so that make them unreadable in the feed. Like I said, we have our own rss feed for new products anyways, so will likely not use it anyway.

Originally Posted by Chuck S

Number 5 I do not see any issues maybe a language issue? The phrase called for the letter is epassres and definitely exists and works.

I see the epassres strings in the phrases database. What else should I look at? Odd that email works when admin resets it, but not when user requests it.

Originally Posted by Chuck S

Number 4 as well my site works the proper way things should be coded. Maybe ensure you have uploaded ALL the files from the latest distribution?

Yeah, that's a strange one. I'm pretty sure I've uploaded all the new files.

Ran into another issue that may be related. When I do a search with more than one page of results, I don't see the "Next Page" links like on your site. We just get a dot. I see the nextpage string in the phrase database, so I know that's not the issue.

What versions of PHP has RP 5.1 been tested with?

[Chuck S]

worked fine when I tested it.

Your sure if your using an alternate language as in german you have an epassres field for german??

I have tested up to 5.31

[Zigw]

Definitely English, and that's all I see installed in the admin language option.

[Chuck S]

Interesting your using a standalone install the phrase is there so the email should be sent it does on my test site.

[Zigw]

Very odd that some emails like registration confirmation works, yet not Forgot Password. Is that a clue?

BTW, I forgot to ask earlier, but how do you delete a product in RP 5.1? When I select Move/Delete in the new Product Options drop-down menu, nothing happens. A little title attribute window pops-up saying "show admin" while I hover over the link in FireFox, and the browser displays "javascript.sendInfoReq('productadmin','227'); at the bottom instead of a URL to a PHP script.

There is also no Delete tick box displayed when editing a product, even though "Display Admin quick move/delete options under ad?" is set to "Yes" in the admin options, so I can't delete any products.

[Chuck S]

I can check over your files if you wish me to but from what I see this works if I test it.

If you click move delete then under product details you will see the move delete box as it always dislayed down there.

[Zigw]

Ah, I see it now. Most of our product pages are longer than a screen, so I didn't see the options appear at the bottom. A little odd to do it that way when the menu is near the top.

Thanks.

[Chuck S]

The ajax always appears where it has always displayed. The whole ajax thing is about hiding and refreshing content on a site. The move delete was always located where you see it.