Image Handler 2 (for ZC v1.3.8 ONLY) Support

what about the folders in BMZcache... does it matter that those are 777?

does it matter that the images within these folders, and the images IH2 creates in the Large and Medium folder are at 666

In the ZC FAQ:* On Linux/Unix hosts, generally, permission-setting recommendations for basic security are:

* folders/directories: 755
* files: 644*

also

*Additional Security for Folders having 777 permissions:

For any directory that requires permissions of 777 or, for their own reasons, one wants to have permission of 777 the following should be put within an .htaccess file used for that directory.*

these 777 folders within BMZcache aint got no .htaccess

so whats the craic?

is IH2 safe, unsafe or does no body fully know?

Nothing to not trust..simply put you are looking for a feature that Image Handler does not offer.. (hover on large images) as for the so-called security issue.. there is none as Clyde and I and PLENTY of of IH2 users will tell you setting you image cache folder to 775 works just fine.. the readme will reflect as such the next release..> r1formetoo:

Interesting. Now I don't know if I should trust this mod and use it or pay for Magic Tools....... I really like the idea of not having to go create extra images for large pictures and thumbnails and so on but I also haven't seen IH2's working mouse over zoom feature either......

Ian
Posted via Mobile Device

I agree.. and not an issue at all I'll update when we sort out the watermarking on additional images issue..

clydejones:

I think this section from the readme doc might be a source of confusion.
Posted via Mobile Device

DivaVocals:

Nothing to not trust..simply put you are looking for a feature that Image Handler does not offer.. (hover on large images) as for the so-called security issue.. there is none as Clyde and I and PLENTY of of IH2 users will tell you setting you image cache folder to 775 works just fine.. thereadme will relect as such the next release..
Posted via Mobile Device

so called?... see my post above...

im trying to get someone who knows to say

safe
unsafe
dont know

im not a security expert nor are you DV, but the ZC docs state any 777 folder and 666 files opens a risk.. folders and images IH2 creates are at 777 and 666... even tho they are in a 755 folder...

im simply curious... and a straight answer would stop this.. personally id think a 777 inside a 755 is still a risk...?
and a lack of recomended .htaccess files for 777?...

and another thing... lol

i have tried search the web to find the answer.. but cant.. but i did find a thread on word press of some dude that had 8 sites closed by his host for having 777 folders inside 744 folders...

so it must not be that great

google
"are chmod 777 folder inside chmod 755 safe?"

third link

you'll be please to know im now off outto get drunk.. so the next 15 hrs will be Shame78 free :P

wheres vger.. she'd know?.. maybe

Shane78:

so called?... see my post above...

im trying to get someone who knows to say

safe
unsafe
dont know

im not a security expert nor are you DV, but the ZC docs state any 777 folder and 666 files opens a risk.. folders and images IH2 creates are at 777 and 666... even tho they are in a 755 folder...

im simply curious... and a straight answer would stop this.. personally id think a 777 inside a 755 is still a risk...?
and a lack of recomended .htaccess files for 777?...

I just checked my bmz_cache folder (set to 755)
All the folders (0 - f) within that folder are also set to 755 and the files within these folders are set to 644.

Not a security expert but I understand folder permissions and IH2.. So here's a straight answer which ckosloff JUST confirmed for me from examining his own store and I've confirmed by examining several Zen Cart sites I've created..

Hopefully Clyde nigel, angel and others who post here will also chime in and confirm the same..

If you set your bmz_cache folder to 755, all the folders IH2 creates within those folders will inheirit their permissions from the parent folder (bmz_cache).. I am not aware of anything in the IH2 code which explicitly sets the folders inside the bmz_cache folder to 777.. (as you seem to be implying the module does)

Shane78:

so called?... see my post above...

im trying to get someone who knows to say

safe
unsafe
dont know

im not a security expert nor are you DV, but the ZC docs state any 777 folder and 666 files opens a risk.. folders and images IH2 creates are at 777 and 666... even tho they are in a 755 folder...

im simply curious... and a straight answer would stop this.. personally id think a 777 inside a 755 is still a risk...?
and a lack of recomended .htaccess files for 777?...
Posted via Mobile Device

Shane78:

... including the 777 chmod security risk IH2 may open people up to.
It's not a security issue unique to IH2. The same principles apply to any and all files/folders, including ZC core and addons.
Explained in a reply to your other post on the matter: http://www.zen-cart.com/forum/showthread.php?t=159994

Thanks Clyde.. Those are my findings as well.. Like I said this "security issue" comes down to some ambiguous and erroneous text we failed to scrub out of Tim's original readme file.. It will be addressed when we examine and correct the watermarking on large images issue.. (which I still maintain is a MINOR) issue at best since all the other major features of Image Handler do in fact work correctly..> clydejones:

I just checked my bmz_cache folder (set to 755)
All the folders (0 - f) within that folder are also set to 755 and the files within these folders are set to 644.
Posted via Mobile Device

I am so scared of aliens.
I have never seen one, so they never did anything to me either.
But I have heard stories of alien abductions, mostly in the X files.
Since I don't know about aliens, and just to be in the safe side, I am scared, and recommend to other people to stay away from them.
Sounds pretty much like these new security concerns:
images in the bmz-cache are encrypted, so it does not matter to what security level they are set.
If you use some free security tools like the Hacker toolbar, a free add-on for Firefox, or even the Linux CD from backtrack-linux.org, you will see what I mean.
Try to find an entry point there.
755 works for most Linux servers, I don't know if for all.
Just to feed the paranoia you can set to 755 recursively your bmz_cache, IH2 does NOT set permissions for folders.
Regarding the coders, yes they are dead people, and bad too, addicted to forks.
However, the last incarnation for IH2 has been written and tested for Zen Cart simply because...there is no IH2 plugin yet for that other bad thing they indulge in.
But stay tuned and you might soon find one.

DivaVocals:

Thanks Clyde.. Those are my findings as well.. Like I said this "security issue" comes down to some ambiguous and erroneous text we failed to scrub out of Tim's original readme file.. It will be addressed when we examine and correct the watermarking on large images issue.. (which I still maintain is a MINOR) issue at best since all the other major features of Image Handler do in fact work correctly..
Posted via Mobile Device

I'm not sure what the watermark "issue" is, but I have images on my site watermarked for ALL image sizes and things seem to be working just fine.

After reading DrByte: "So, yes, in the case of IH2 the specified folders need to be writable ... whatever that means for YOUR unique hosting configuration. Whether 777 or 755 or whatever."
No problem to modify the readme to make folders recursively 755, again this might not work on older servers, but it does work fine for mine, and it is what files are automatically set for.

clydejones:

I'm not sure what the watermark "issue" is, but I have images on my site watermarked for ALL image sizes and things seem to be working just fine.
Same here

thanks to clyde, ckosloff and Drbyte for clarifying and (more importantly) debunking this so-called issue.. the readme will be updated to include DrByte's explanation..
Posted via Mobile Device

and let me add one more thing to this..

IF you originally installed IH2 and set the permissions of your bmz_cache folder to 777, then began using IH2, and AFTER IH2 has begun creating sub-folders inside the bmz_cache folder you then change your bmz_cache folder permissions to 755 you will end up with folders inside your bmz_cache folders set to 777. So what's the Right Way to correct this?

You could simply reset the permission for each of the bmz_cache folders to 755.. or follow these steps..

1. Uninstall IH2 from the admin.

2. delete all of the sub folders within your bmz_cache folder (do not delete the .keep file)
   or
   delete your bmz_cache folder and re-upload the one from the IH2 module files

3. Re-install IH2

Going forward the permissions of the sub-folders IH2 creates within the bmz_cache folder will inheirit it's permissions from the parent folder. (755)

Now with that I'm off to enjoy the rest of my day at the track..> ckosloff:

After reading DrByte: "So, yes, in the case of IH2 the specified folders need to be writable ... whatever that means for YOUR unique hosting configuration. Whether 777 or 755 or whatever."
No problem to modify the readme to make folders recursively 755, again this might not work on older servers, but it does work fine for mine, and it is what files are automatically set for.
Posted via Mobile Device

Now i am confused! I have installed IH2 three times now to get this watermark problem resolved. Having followed this thread and the recent security argument, I looked at my directories to see what my chmod setting are. My bzm_cache directory is chmod 755 but all the directories within are chmod 777. Consequently all images created by IH2 are chmod 666. If this is not supposed to happen, why is this happening? I have not done anything to set these chmod permissions. :huh:

DivaVocals:

and let me add one more thing to this..

IF you originally installed IH2 and set the permissions of your bmz_cache folder to 777, then began using IH2, and AFTER IH2 has begun creating sub-folders inside the bmz_cache folder you then change your bmz_cache folder permissions to 755 you will end up with folders inside your bmz_cache folders set to 777. So what's the Right Way to correct this?

You could simply reset the permission for each of the bmz_cache folders to 755.. or follow these steps..

1. Uninstall IH2 from the admin.

2. delete all of the sub folders within your bmz_cache folder (do not delete the .keep file)
   or
   delete your bmz_cache folder and re-upload the one from the IH2 module files

3. Re-install IH2

Going forward the permissions of the sub-folders IH2 creates within the bmz_cache folder will inheirit it's permissions from the parent folder. (755)

Now with that I'm off to enjoy the rest of my day at the track..
Posted via Mobile Device

.

SERIOUS ISSUE ON LIVE STORE - HELP NEEDED, PLEASE -
WILLING TO DONATE FOR SOME EDUCATED ADVICE:

Hi guys, I recently changed the category names on my store...
it seems IH2 doesn't like that... it's forgotten my product paths (in the admin).

When I try to change the image on ANY of my products in IH2...
it bounces me to the "admin" tab (within IH2)... "No Image Handler information found"

The IH2 dropdown menu shows my current category list...
but the 'base category' is showing the old category name.

I'm sure this is the problem... IH2 didn't update the change!!
(which is very uncool, all I did was change a category name!)

Anyway, this is quite serious... my site is fairly old, I can't afford the downtime...
as a t-shirt store, I'm heavily reliant on the IH2 functionality... so I can't make a mistake here...
the work involved in setting it up from scratch will take weeks!

I need some help getting IH2 to recognize my updated categories!

I'm a web designer, but not a developer...
I can hack my way through most things, just need some help to do it right the first time...
***I'm willing to donate for your time!

.

blackhalo:

SERIOUS ISSUE ON LIVE STORE - HELP NEEDED, PLEASE -
WILLING TO DONATE FOR SOME EDUCATED ADVICE:

I just noticed that IH2 is saying "Install Image Handler" under the 'Admin' section...
but under the 'Manager' section everything is still visible, as if it were still installed... there's a disconnect somewhere.

I have no idea how it decided to think it's uninstalled, it was working fine last week...
I'm afraid to re-install it though, as it will delete all the work I've put into setting up each product.

I really need help from someone that's familiar with how IH2 works...
I can't risk anything without knowing what it will do first... this is a live store (that recently got a mind of it's own)!!!

Developers, feel free to contact me privately...
any insight would be appreciated though, I'm walking on eggshells here.
.

Have you tried following my suggested resolution to correct your mismatched folder permissions?? Please give that shot and let me know if that resolves the issue..

As for the watermarking large additional images I have stated (repeatedly) that I will be taking a closer look at that as soon as I get home tonight.. It's not a showstopper feature(watermarking) and despite it not working as you wish, IH2's primary features should still function just fine..> dutchy:

Now i am confused! I have installed IH2 three times now to get this watermark problem resolved. Having followed this thread and the recent security argument, I looked at my directories to see what my chmod setting are. My bzm_cache directory is chmod 755 but all the directories within are chmod 777. Consequently all images created by IH2 are chmod 666. If this is not supposed to happen, why is this happening? I have not done anything to set these chmod permissions. :huh:
Posted via Mobile Device

you'll need to run the install.. I suggest clearing the cache first (also in the IH2 admin)> blackhalo:

I just noticed that IH2 is saying "Install Image Handler" under the 'Admin' section...
but under the 'Manager' section everything is still visible, as if it were still installed... there's a disconnect somewhere.

I have no idea how it decided to think it's uninstalled, it was working fine last week...
I'm afraid to re-install it though, as it will delete all the work I've put into setting up each product.

I really need help from someone that's familiar with how IH2 works...
I can't risk anything without knowing what it will do first... this is a live store (that recently got a mind of it's own)!!!

Developers, feel free to contact me privately...
any insight would be appreciated though, I'm walking on eggshells here.
.
Posted via Mobile Device