ajax – not sorted :( – HELP

[arfa]

This is an adjunct to issues regarding my NEW Image Manager plugin and I hope one/some of you might be able to help.

The key issue now is regarding ajax. I thought I had it sorted ... see:
viewtopic.php?t=3077
but, when I have a sub-directory install – ....example.net/test/install.php – this:
session_name('BLUDIT-KEY');
session_start();
fails. It works just dandy in a top-level install.

But, while this – session_name('__Secure-BLUDIT-KEY'); – works OK in the sub-dir it fails in a top-level setup.

The obvious rejoinder is "send it all through plugin.php" (I hear you, [and me] say) but there is about 40k of code in ajax and adding that to plugin.php seems a bit heavy plus... the separate files makes it so easy to track/edit/etc. and... there is (ideally) the option to use ajax; yes?

ANY comments here would be so gratefully received. This dang plugin has been quite some work and I WILL get it to you in full working order {worth the wait !}

In expectation - Kusalo

[lastpictures]

Here is a short summary:

Incorrect capitalization: The plugin folder is named

Code: Select all

ImageManager

but the code often refers to it as

Code: Select all

imageManager

On Linux servers, this can cause 404 errors, especially for AJAX requests.

Subdirectory installations are not handled correctly: Many URLs are hardcoded and start with

Code: Select all

/bl-content/

Code: Select all

/bl-plugins/

or

Code: Select all

/admin/

If Bludit is installed in a subdirectory such as

Code: Select all

/bludit/

these paths point to the wrong location.

Incorrect filesystem paths: In several places, the plugin uses

Code: Select all

$_SERVER['DOCUMENT_ROOT']

This only works reliably if Bludit is installed directly in the web root.

Too many relative paths: Paths such as

Code: Select all

../../../bl-content/

depend on the current file or URL location and are therefore fragile.

AJAX paths are hardcoded: AJAX files are called through fixed paths such as

Code: Select all

/bl-plugins/imageManager/...

instead of using Bludit's own path and URL constants.

AJAX token handling is inconsistent: The required

Code: Select all

adminToken

is not stored in the session on every relevant plugin page. As a result, AJAX requests may work on one page but fail with

Code: Select all

Access denied

on another.

Some internal paths are simply incorrect: For example,

Code: Select all

filemtime()

is sometimes called with a path that does not point to the actual image file.

Security issues: Some write operations are performed via

Code: Select all

GET

file and folder names are not sufficiently validated, and some actions do not have proper CSRF protection.

The main issue is that filesystem paths and web URLs are handled inconsistently throughout the plugin and are often hardcoded.

A better approach would be to consistently use Bludit's built-in constants such as

Code: Select all

PATH_CONTENT

Code: Select all

PATH_PLUGINS

Code: Select all

DOMAIN_CONTENT

and

Code: Select all

HTML_PATH_ROOT

This should make the plugin work reliably both when Bludit is installed in the web root and when it is installed in a subdirectory such as

Code: Select all

/bludit/

I had the plugin patched for you using AI. Take a look at it—especially the parts that were changed.

Fixed issues include:

- AJAX paths and AJAX token handling
- Support for Bludit installations in a subdirectory
- Incorrect capitalization of ImageManager / imageManager
- Hardcoded paths using DOCUMENT_ROOT, HTTP_HOST, and ../../../
- Incorrect internal image paths, including issues with filemtime()
- ZIP download paths
- Removal of filesystem paths supplied by the browser/client
- Validation of album, gallery, tag, and file names
- Additional protection for delete operations
- Upload restrictions to actual JPG/JPEG/PNG/GIF image files
- Safer file access when editing galleries
- Minor fixes to gallery settings and related path handling

The entire plugin doesn't seem very logically structured to me, not even visually. It may be functional, but it isn't intuitive.

[arfa]

@lastpictures
Wow, what an incredibly generous reply. Thank you. I have downloaded the zip and will go through that thoroughly.

>> The plugin folder is named ImageManager
Yes, spotted that. New zip up.

>> Many URLs are hardcoded
Yes. You make several references to Bludit constants and I have been remiss in this respect.

>> AJAX token handling is inconsistent:
This is the key bit for me.

>> adminToken is not stored in the session on every relevant plugin page
This is a real gem. Thank you.

>> file and folder names are not sufficiently validated,
Can do.

>> The main issue is that filesystem paths and web URLs
I totally get that and am working on it.

>> The entire plugin doesn't seem very logically structured to me, not even visually.
I can totally take on all the above but would really like some feedback on this last.
the action tabs...
Lists = lists of galleries
Upload = upload images
New = New gallery
Data = (intro) Click on an album to view its thumbnails and associated data. Each icon detailed explanation.
Tags = (intro) Tag images for sorting: by location, subject, etc. – the 3 sub-tags may be ?new
Tidy up = each tab has an explanation.

Of course it is clear to me – I spent a lot of time detailing each section – but, clearly it is not to you.

Which tab-section is most confusing?
Which of my explanations doesn't read clearly or doesn't make sense?
I have developed this plugin over time in relation to a few friends with numerous iterations and the logic developed collectively so our logic was clear (to us) – but... coming in new. Not so.

it isn't intuitive
Again, where is the fog?
Where did you get lost?

It may be functional,
I really think it is and have more features in mind but... get this right first.

AI? I am probably well past my use-by date and if it weren't for the sheer joy of coding I would take voluntary redundancy. Clearly I am not a pro — but I do love it so :)
This is my most ambitious Bludit project and... my learning curve – growing pains – and I am sorry to entangle you all in mine. I really appreciate, and clearly ask for more of, your time. It is the greatest treasure we have – and, plus, maybe, very maybe, AI ? Good luck with the future one and all :)

[lastpictures]

The plugin should work in the version I uploaded; the issues mentioned have been resolved.

I don't quite understand the plugin's structure. There are various tabs. I tried using it in a test environment: I created a gallery and uploaded images, but they didn't appear anywhere. How do I embed the gallery into a page? The underlying logic isn't clear to me. I would have expected it to work like this:

Create gallery with a name – upload photos – publish gallery

That’s the part where I got stuck with your plugin. This isn't a problem that directly concerns you, but for me, it lacks the usability I expect. After all, it should be usable for people who don't have much technical or programming knowledge.

Feel free to optimize and improve it further. I don't want to disparage your work—that certainly wasn't my intention!

[arfa]

@ lastpictures
Thanks for the response. I imagine we all make assumptions about each other. I assumed that your detailed, technical first-reply had you resting in the very-clever-techie Bludit echelon. but...
>> people who don't have much technical or programming knowledge
kind of suggesting that is you?

>> How do I embed the gallery into a page?
This reminds me of my early entry into Bludit – WTF...I thought as I scratched my head. I just assumed that 'everyone' knew how to do this and how that worked. The jargon, the 'new group' given. It should be obvious – but it wasn't to me. It somewhat echoes the 'disappointment' re: the lack of documentation in some areas; mine not exempt.

On the 'Lists' tab > shortcode for tinyMCE
[% imgMan=yourGalleryName %] Copy this and paste it into a page content textarea. At some point I plan to make it a click-copy but for now it has to be mouseClick-dragSelect-copy-paste. Save the page content – go to that page on your site and the gallery should be visible.

>> disparage your work
Not a hint. Quite the contrary; very helpful.

I have loaded the AI file-set and there are still some things (paths?) need adjusting and some variety in the use of $token – there seems no cross-check on this? I will need to give it all more time.

Thanks again for taking your time with this.
Go well – Kusalo