Displaying HTML Code in 3.1

[Mark Goldstein]

Hi,

I've just upgraded from 2.8 to 3.1.

In 2.8, I enabled HTML in the Description field and added some shopping code for each product. I was able to view and edit the code by selecting the Edit Product link for each product.

Now, after upgrading to 3.1, all I can see is the line <br clear="all">, which is part of the original code - but that is the only line.

I've checked the database tables and the original code is there in the Description field, but I cannot edit it through ReviewPost.

I've also checked my Admin options and Allow HTML in Product Fields? is set to No. Changing it to Yes, however, stops the shopping code from working at all!

Example of the shopping code working here:
http://www.photographyblog.com/revie...&cat=14&page=1

[Chuck S]

You have an example of what your placing in there?

I place say an html table in the description and I can edit it

$pdesc = un_htmlspecialchars($pdesc);

we make sure we convert it to editable html code once we grab it from the database as it is stored in the database in the proper format

[Mark Goldstein]

Here is an example of the code that I am placing:

<iframe src="XXX" name="frame1" scrolling="no" frameborder="no" align="left" height="400px" width="450px">
</iframe>
<br clear="all">
<iframe src="XXX" name="frame2" scrolling="no" frameborder="no" align="left" height="400px" width="450px">
</iframe>

When I was running v2.8 of RP, I added this code to nearly 1000 products.

Now, after upgrading to 3.1, the code still works as it should and is in the database, but Allow HTML in Product Fields? is set to No and the only part of the above code that shows up in the Description field when I try to edit it is <br clear="all">. Therefore I can't edit the existing code.

Furthermore, because Allow HTML in Product Fields? is set to No, I can't add the code to any new products (which I need to do on an ongoing basis). If I change the Allow HTML in Product Fields? setting to Yes, all of the existing code for the older products stops working (although it is still in the database).

[Chuck S]

well if I have html off it will display as such

&lt;iframe src=&quot;&quot; name=&quot;frame1&quot; scrolling=&quot;no&quot; frameborder=&quot;no&quot; align=&quot;left&quot; height=&quot;400px&quot; width=&quot;450px&quot;&gt;
&lt;/iframe&gt;
&lt;br clear=&quot;all&quot;&gt;
&lt;iframe src=&quot;&quot; name=&quot;frame2&quot; scrolling=&quot;no&quot; frameborder=&quot;no&quot; align=&quot;left&quot; height=&quot;400px&quot; width=&quot;450px&quot;&gt;
&lt;/iframe&gt;


However on edit it definately is converted back to this. I tried your exact code posted above

<iframe src="" name="frame1" scrolling="no" frameborder="no" align="left" height="400px" width="450px">
</iframe>
<br clear="all">
<iframe src="" name="frame2" scrolling="no" frameborder="no" align="left" height="400px" width="450px">
</iframe>

Make sure your using The 3.1 download all the files. Only other suggestion I would make has nothing to do with edit is in showphoto you can try this as maybe you have a conflict with convert_markups
remove the code in bold

if ($Globals['allowhtml'] == "yes" ) $desc = convert_markups( un_htmlspecialchars($desc) );

so that line should look like

if ($Globals['allowhtml'] == "yes" ) $desc = un_htmlspecialchars($desc);

[Mark Goldstein]

Right, something strange is going on!

I have now set Allow HTML in Product Fields? to No.

Here is a product that I have added the code for today (after upgrading to 3.1 last week):
http://www.photographyblog.com/revie...&cat=29&page=1

Here is a product that I have added the code for before upgrading to 3.1:
http://www.photographyblog.com/revie...&cat=29&page=1

As you can see, in the first example the code is correctly shown as plain text.

In the second example, the code is "incorrectly" shown as working HTML. If I choose Edit Product, only <br clear="all"> is shown. This also applies to all of the other products that I edited in this way prior to upgrading to 3.1.

It's as if all the old, pre-3.1 products are doing the opposite of what they should do!

[Chuck S]

Well I can not comment on how things are stored prior to 3.0 as remember we did not support storing html in the database back then. In fact our whole typecast function was not in existence yet with older versions

It should be stored as something like this to work proper

&lt;iframe src=&quot;&quot; name=&quot;frame1&quot; scrolling=&quot;no&quot; frameborder=&quot;no&quot; align=&quot;left&quot; height=&quot;400px&quot; width=&quot;450px&quot;&gt;
&lt;/iframe&gt;
&lt;br clear=&quot;all&quot;&gt;
&lt;iframe src=&quot;&quot; name=&quot;frame2&quot; scrolling=&quot;no&quot; frameborder=&quot;no&quot; align=&quot;left&quot; height=&quot;400px&quot; width=&quot;450px&quot;&gt;
&lt;/iframe&gt;

Now on showproduct.php the only edit I would make is what I have outlined above in my last post.

Othwewise using 3.1 I am able to post show and edit html descriptions should I choose to allow html.

This line in editproduct.php shows we

convert the html to editable html here

$pdesc = un_htmlspecialchars($pdesc);

Make sure to redownload the build and make sure you upload all templates and php files

[Mark Goldstein]

OK, so I guess I'm not going to get the pre-3.0 code to show up properly in the new system.

So what would you suggest as the best way of extracting the code for each product? Can I save the database as a CSV file, and then copy and paste the code back into the Description field?

[Chuck S]

Well I dont know how it was saved in the database using the old system so I can't really say. You can post an example here of how the old style is stored in the database and I might be able to assist

There is one correction I posted above that I would suggest in displaying html as convert_markups can not be on the line to allow html as it will mess with it so lines 323-325 of showproduct.php should be this

Content visible to verified customers only.

[Mark Goldstein]

That's just it - if I look at the database with phpMyAdmin, I can see the correct code in the Description field for each product. It just won't display properly if I set Allow HTML in Product Fields? to Yes, only if I set it to No, and only one line of it is displayed if I edit the product in RP.

If you want to take a quick look at the actual database, let me know and I'll email you the login details.

[Chuck S]

What I am saying is this.

You need to post how the actual code is stored in the database. How is it different that how it is stored with the new code that does process the stuff right to display html

You follow me here. The new code displays html right as I have shown so if your old code is not displayed correctly then it was being stored way back when a different way which means you might need to convert it or of course yes you could redo it again by editing the products

sure send me details to login to server

[Mark Goldstein]

Ah, OK, I see :-) I can't really answer your question as I'm usuing phpMyAdmin and it doesn't show the code.

I've just sent you a PM.

Thanks for all your help with this.

[Chuck S]

Yep has nothing to do with our present code

Your old code when you applied the hack in the old software wrote the information in real HTML format which is not good.

I altered an upgrade script to run htmlspecialchars on your product fields and all is good.

Now do realize I placed the ability for customers to be able to show html in products and reviews as a switch and give a stern warning. Vbulletin does much the same. Do realize you open your system up to security issues when you allow people to upload html and let it display on your site.

However number one requested thing in Reviewpost has always been to be able to display html so hense the ability to have it as a switch. But my warning stays the same

[Mark Goldstein]

Excellent! Thanks a lot!! That has saved me a LOT of time :-)

I'm the only one that uploads products, and I don't allow HTML to be uploaded in Reviews - Allow HTML in Reviews? is set to No.

Curiously, Allow HTML in Product Fields? is also set to No, although it seems to be working anyway.

[Chuck S]

Thats because we do this

if ($Globals['allowhtml'] == "yes" ) $desc = un_htmlspecialchars( $desc );
else $desc = convert_markups( un_htmlspecialchars($desc) );

Basically convert_markups will allow normal html to just be shown correctly but not parsed. Try entering a table and an image tag and you will see what I mean. Your using an iframe so thats not touched which is why it works as is. Convert_markups makes img tags and the normal nasty ones safe as well as convert bbcode

[Mark Goldstein]

OK, so I can leave everything as is then? :-)

[WB]

Mark:

See my thread in the bug report section about HTML code:

3.1 HTML Settings; File Question

as I think there is an edit there toward the bottom that you will want to make on your install related to the reviews HTML setting.

[Mark Goldstein]

OK, I will take a look.

[Mark Goldstein]

Coincidentally, someone posted a review yesterday which contained a line of HTML code. I received an email notification, but the review was never actually posted on RP.

Is this the expected behaviour when someone tries to include HTML in their review (and Allow HTML in Reviews? is set to No) ?

[Chuck S]

noI beleive the build was updated reupload showproduct.php and pp-inc.php

[Mark Goldstein]

OK, I will download the latest build now...