There are a few other issues that suggest a similar bug (#447010: Images upload but don't show up and #452800: Image upload form and preview do not appear are examples) but are marked for 6.x-1.4, mention other issues that I'm not seeing, and I believe are possibly referring to another situation which has been fixed in the dev version.

Preview images are not showing up in the options editing forms, where you would expect them to, regardless of the preview image setting chosen. Unlike in the other issues referenced, I have no problems with the upload fields, etc.

As far as I can tell, this is because filter_xss() is being used on the value for the preview form fields and it's stripping out everything that's being passed back from the theme function. Would changing these to filter_xss_admin() be a reasonable way to solve the problem? I'm not submitting a patch because I don't know if this is the secure way to go about this, but maybe someone with a little more expertise can offer some input?

CommentFileSizeAuthor
#1 uc_option_image-no_image_preview-1206192-1.patch1.4 KBagileware

Comments

agileware’s picture

agileware commented
Status: Active » Needs review
StatusFileSize
new uc_option_image-no_image_preview-1206192-1.patch1.4 KB

Yep, this is because of filter_xss.

Here is a patch with your suggestion of using filter_xss_admin() instead. Works for me.
The other option would be to use filter_xss and send a list of allowed tags including div & img but I think this solution is fine.

agileware’s picture

agileware commented

As far as security goes, this approach will still block script tags etc. and seeing as the images have to be added by some sort of administrator filter_xss_admin() will be ok.

cybis’s picture

cybis commented

Patch #1 works for me.

ben coleman’s picture

ben coleman commented

Patch #1 work here, also.

cybis’s picture

cybis commented
Status: Needs review » Reviewed & tested by the community
dorys’s picture

dorys commented

This worked for me on the dev version dated july 13, 2011

hargobind’s picture

hargobind
he/him
Location Austin, Texas
commented

Also confirming that #1 works. Reviewed and tested. Please roll into -dev.

SimpleAsCouldBe’s picture

SimpleAsCouldBe commented

This is a great fix. Wanted it to help me track down a different issue with option_images. Thanks!

makbeta’s picture

makbeta commented

Tested here as well, would be nice to have it in latest dev for those folks who are still using it.