[SOLVED] Adding "Add to cart" to Lightbox"

DaveRH
DaveRH's picture

Joined: 2005-08-27
Posts: 15
Posted: Mon, 2009-11-02 14:22

As this is my first post here, two things:
1) Thanks to all the people who have created Gallery. As a long-time software developer I can appreciate the effort that has gone into this.
2) I tried to find another relevant post that might answer my question but had no luck. Also, if this is in the wrong place, please tell me/move it.

I have installed Lightbox in my Gallery 2.3 and it works fine. However, I want to use Checkout and if you use Lightbox, you never see the "Add to Cart" links. I also don't like the use of a link with what looks like a checkbox to the left of it so wanted to substitute a button. And I wanted to display the Summary info for the photo in the lightbox (screenshot attached). I have got all of this working with one exception:

In album.tpl for the theme I am using (Matrix) I am using the "rev" node in the <A> tag to carry the URL which will be attached to the "Add to cart" button. I am trying to do something like this:


a href="{g-&gt;url arg1="view=core.DownloadItem" arg2="itemId=`$child.resizedId`"}"
    title="{$child.title|markup}"
    name="{$child.summary|markup}"
    pageLink="{g-&gt;url arg1="view=core.ShowItem" arg2="itemId=`$child.id`"}"
    rel="lightbox[photos]"
    rev="{foreach from=$child.itemLinks item=link}
         {if (strstr($link.moduleId, "checkout"))}
            {capture assign=ecURL}{g-&gt;itemLink link=$link type=option lowercase=true|regex_replace:'/&amp;lt;option value=" window.location=/':""}{/capture}
            {$ecURL|regex_replace:.... remove trailing non-required stuff...}
            {/if}
         {/foreach}
    &gt;

"g->itemLink" produces stuff I don't want - I need just the URL. I appreciate there may be other way of doing this but I thought this might be the least complicated. E.g. I looked at "g=>url" but to use that I'd need to get the auth toekn within the template...

So, the 2 x regex_replace to remove the start and end of the generated link to leave just the url I need. However:

The first regex+replace doesn't work - it does not remove anything so I assume the match isn't working. It works fine in straight PHP so WTH am I doing wrong? :)

Secondly, there is I think an easier way to do this: I want to create a "g->itemlink" variant, say "g->ecLink" to give me just the URL but I cannot find the code that implements "g->itemlink" so if anyone could point me at that I would be grateful.

Almost forgot to mention: if anyone else wants this facility, I'll post the changes when I have it working. Advice on where/how to do this gratefully received :)

Dave Harris

This space accidentally left blank

AttachmentSize
G2_LB_Screenshot.JPG30.5 KB
Login or register to post comments
alecmyers

Joined: 2006-08-01
Posts: 3371
Posted: Mon, 2009-11-02 15:43

Why not just include a direct "add to cart" link? Why the hoop-jumping?

Login or register to post comments
DaveRH
DaveRH's picture

Joined: 2005-08-27
Posts: 15
Posted: Mon, 2009-11-02 16:31
alecmyers wrote:
Why not just include a direct "add to cart" link? Why the hoop-jumping?

That was my first thought but:
(a) The Lightbox HTML is generated dynamically at run time so you can't just generate the link. I have modified it's Javascript to retrieve the Add To Cart URL from the Rev node in the thumbnail's div. There's no way (that I can find) to generate *just* the Add To Cart URL.
(b) the single links generated by Gallery are a little confusing - they look like check boxes with text. Whilst I could change the graphic file, that might break something else so I'd rather do it properly. Also, I prefer the button to the text link :)

Dave Harris

This space accidentally left blank

Login or register to post comments
alecmyers

Joined: 2006-08-01
Posts: 3371
Posted: Mon, 2009-11-02 16:57
Quote:
There's no way (that I can find) to generate *just* the Add To Cart URL.

I think you're making it much too complicated.
From inside a smarty template:

<a href="{g->url arg1="controller=checkout.AddToCart" arg2="itemId=`$item.id`" arg3="return=1"}" rel="nofollow">{g->text text="Add to Cart"}</a>

From outside smarty:
<a href="main.php?g2_controller=checkout.AddToCart&g2_itemId=xxx>Add to Cart</a>
- assuming you can fix the itemId in the browser via javascript or whatever
The empty tick-box you refer to is just Gallery's default icon in your iconpack which you can change (by providing a basket icon) or remove by editing your stylesheets.
If the authtoken is a problem you can override the authtoken check in the AddToCart.inc file:
http://www.google.co.uk/search?rlz=1C1GGLS_en-GBGB350GB350&sourceid=chrome&ie=UTF-8&q=site:gallery.menalto.com+omitauthtokencheck
http://gallery.menalto.com/node/79854#comment-280894

If you want a button rather than a link then the url can be generated the same way:
{g->url arg1="controller=checkout.AddToCart" arg2="itemId=`$item.id`" arg3="return=1"}

Login or register to post comments
DaveRH
DaveRH's picture

Joined: 2005-08-27
Posts: 15
Posted: Mon, 2009-11-02 18:40

Thanks Alec! I had to modify what you said somewhat but it put me firmly on the right track and now it works perfectly.
I didn't even have to disable the authtoken check :) I didn't like the idea of doing that on a site which
uses ecommerce - the more secure one can make it the better.

The result is much simpler than what I had before of course - and it even simplified the browser-side JS a bit.

Dave Harris

This space accidentally left blank

Login or register to post comments
alecmyers

Joined: 2006-08-01
Posts: 3371
Posted: Mon, 2009-11-02 18:46
Quote:
I didn't even have to disable the authtoken check

it's better to generate urls in smarty using the Gallery url generator which adds the authToken to controller-type urls automatically.

Having said that, being able to access the addToCart controller without an authToken is not a big hole in security.

Login or register to post comments
DaveRH
DaveRH's picture

Joined: 2005-08-27
Posts: 15
Posted: Mon, 2009-11-02 20:49
alecmyers wrote:
Quote:
I didn't even have to disable the authtoken check

it's better to generate urls in smarty using the Gallery url generator which adds the authToken to controller-type urls automatically.

I figured that - using standard internal facilities is usually better than rolling your own. That's what I did. I had to make the JS add in the rel node but the rest is generated the standard way.

alecmyers wrote:
Having said that, being able to access the addToCart controller without an authToken is not a big hole in security.

I was fairly certain of that too. But I have been amazed at what some people will squeeze through a small hole :) Anyway, getting it at "no cost" can't be bad.

It's a shame that Lightbox isn't a module and has to be edited in. Probably the only sensible way to make it generally available with my mods in is as a theme.

Now for the next bit: I don't like the look of the checkout basket page so I'll go play with that for a while. Hopefully I won't need to dream up any more kludges like that last one :} Jut as well I enjoy finding my way around new stuff.

Thanks again for your time.

Dave Harris
This space accidentally left blank

Login or register to post comments
alecmyers

Joined: 2006-08-01
Posts: 3371
Posted: Mon, 2009-11-02 23:13
Quote:
It's a shame that Lightbox isn't a module and has to be edited in.

I spent a lot of time with G2 bemoaning the fact that something "couldn't be done" until I found out exactly how it could be done because the developers are actually quite smart people. I don't know how lightbox integrates, but don't overlook the Gallery block/callback structure to insert custom html and/or javascript into a page.

Quote:
I don't like the look of the checkout basket page so I'll go play with that for a while.

I shall look forward to seeing what you come up with - please post when you're "done"!

Login or register to post comments
DaveRH
DaveRH's picture

Joined: 2005-08-27
Posts: 15
Posted: Tue, 2009-11-03 14:30
alecmyers wrote:
Quote:
It's a shame that Lightbox isn't a module and has to be edited in.

I spent a lot of time with G2 bemoaning the fact that something "couldn't be done" until I found out exactly how it could be done because the developers are actually quite smart people.

I have no doubt about that - I'm very impressed with the way it's been done.

alecmyers wrote:
I don't know how lightbox integrates, but don't overlook the Gallery block/callback structure to insert custom html and/or javascript into a page.

It makes use of Scriptaculous and I don't think it would fit well as a block. Installation requires editing several Gallery files. Not ideal :{ I will have a look at making it integrate "properly" once I have got my own site up and running and learnt a bit more about Gallery internals.

alecmyers wrote:
I shall look forward to seeing what you come up with - please post when you're "done"!

With pleasure. I've been using OS software for some time now & would be nice to have something to give back.

Dave Harris

This space accidentally left blank

Login or register to post comments
alecmyers

Joined: 2006-08-01
Posts: 3371
Posted: Tue, 2009-11-03 17:12
Quote:
It makes use of Scriptaculous and I don't think it would fit well as a block.

Again, you might be surprised. Javascript libraries are trivial to include in blocks - I'm using jquery on my site for custom popups that depend on page contents, in exactly that manner, no code modifications or template mods needed. Checkout the preload() function that can be used by blocks to insert stuff in the page header. Having said that, though, it's better not to include javascript libraries in the header as it slows down the page load. It's actually better to put it right at the end of the page - this is from informal conversations with the G2 developers.

Login or register to post comments
DaveRH
DaveRH's picture

Joined: 2005-08-27
Posts: 15
Posted: Wed, 2009-11-04 12:01

Ummmm... Alec, do I gather you're the author of the Checkout subsystem? That'll teach me to open my mouth without finding out who I'm speaking to first <blush />
Please don't take my comment re the look of the checkout page as a criticism. I meant it the way I said it - it just isn't to my taste :)
Mine does seem to have a minor layout issue used with the Matrix theme: the legends for the paper type wrap,
partially underneath their radio buttons & it looks ugly.

Later:
I actually forgot to post the above yesterday: never clicked the button :/

Turns out I don't actually need to make major changes to the checkout page as the facility I was going to incorporate is so
unlikely to be used (not to mention much more complicated to implement than I thought!) that I would have been wasting my time.
I've mostly made the changes I really wanted and am having a minor problem but I'm going to try using the Smarty debug console,
so learn that as I go along, & see if I can sort it myself.
If not, I'll be back :)

In Ligthbox all the HTML for displaying a single photo is generated dynamically browser-side and this makes using the normal
G2 way of doing things a bit difficult AFAICS.
What I might be tempted to do, eventually, is extract the "effects" code from Scriptaculous and make it apply to static HTML.
That would mean I could ditch the 160kB Prototype JS library and it would be pretty easy to make a G2 template that was "normal"
or a block that other templates could use.

One final thought: I would like to charge P&P on the basis of how many items have been ordered.
Given that once the site is operational, I shall be very happy to selling one or two prints at a time, this isn't an urgent issue
so I'll look at that later if it becomes one.

Dave Harris

This space accidentally left blank

Login or register to post comments
alecmyers

Joined: 2006-08-01
Posts: 3371
Posted: Wed, 2009-11-04 12:17

No problem about critiqueing the code or the templates... I'm the maintainer, strictly, but I rewrote most of the code bit by bit. I didn't create the templates (which I don't like very much either) but I'm not a web-designer so I'm not much motivated to improve them. The ones that I use in my customized theme look ok to my eye, that's about as far as I'll go. When I said I'm interested to see what you come up with, I only meant I was hoping for some improvements that could be included in the module!

Quote:
Mine does seem to have a minor layout issue used with the Matrix theme: the legends for the paper type wrap,
partially underneath their radio buttons & it looks ugly.

I agree. It's very difficult to formulate a generic solution, and of limited appeal since not everyone will be using different paper types, and individual layouts vary. In my head I imagine that anyone who wants to make use of checkout in any kind of serious way will create their own themes and stylesheets and will want to modify the checkout templates anyway to suit their site. I certainly have.

I'll take your word for what you say about Lightbox as I don't know the specifics. But I have found that there's usually a Gallery2 way that works.

P&P on a per-item basis: the code hooks are there if you want to write a module to do that; it's about 15 minutes work and doesn't involve modifying any core or checkout code.

Login or register to post comments
DaveRH
DaveRH's picture

Joined: 2005-08-27
Posts: 15
Posted: Fri, 2009-11-06 09:25

:))

OK. I'll see what I can do. I have a colleague/friend who is a usability/HCI/Human Factors expert (and a photographer)and she cast an eye over my site. Her biggest problem was with the checkout layout and I'll have her look at what I've done shortly & see if I really need to tmake any further changes. Then I'll show you what I've done. She takes a very minimalist approach, sometimes IMO to the point of a site looking visually unattractive. It's unfortunate that making a site attractive to potential customers is not the same as making it as easy as possible for them to use (and convincing them to buy), so maximising conversion rate.

I hadn't intended to make huge changes to templates as I wanted to get the site up as quickly as possible and then probably improve it incrementally. However, I've just had a look at your dance photos site & I see what you mean about customising things :) I've seen several ideas I will probably "steal" (imitation being the sincerest form of flattery :). Nice photos BTW.

It's odd how I have no problem advising other people on their websites but when it comes to mine, the brain just goes blank :{

Dave Harris

This space accidentally left blank

Login or register to post comments
alecmyers

Joined: 2006-08-01
Posts: 3371
Posted: Fri, 2009-11-06 09:47

Sure - which 'features' do you like, btw?

Login or register to post comments
DaveRH
DaveRH's picture

Joined: 2005-08-27
Posts: 15
Posted: Sun, 2009-11-15 12:09

Alec - sorry for the long delay in replying. Work got seriously in the way.

1) All thumbnails the same orientation.
Looks really neat - unfortunately won't work for my collection but it's worth bearing in mind when choosing the album image.

2) Useful information wherever it is useful! I.e., the user doesn't have to go searching for it.
Having it all collected together in a FAQ as well is good, of course, but saving the user clicks is always a good idea.

3) Permanent nav buttons at the top of the page.

4) Upsell (extra print button) on the "check your order" page.

5) The large legends, done as images I think, in some places.

6) It dawns on me that the best thing I got out of looking at your site was some inspiration to have a serious play with Gallery.

I've pretty much sorted Gallery for now although this will be R1. There will be an R2 later :)
Now I have to integrate G2 with a Wordpress site, which should be simple enough
as we're only talking about switching between WP, G2 & a few assorted pages e.g. FAQ.

Dave Harris

This space accidentally left blank

Login or register to post comments
alecmyers

Joined: 2006-08-01
Posts: 3371
Posted: Sun, 2009-11-15 12:55

Dave,

1. That's just the pictures I take. Mostly portrait format - it's not a checkout thing.

2 - 5. All done just by editing the templates and adding a few graphics. However it's all *added* stuff, I haven't changed the basic checkout table structure. Most of the visible differences are due to the theme and css, if I switched back to the default Matrix theme it wouldn't look very different from any other site.

Login or register to post comments
DaveRH
DaveRH's picture

Joined: 2005-08-27
Posts: 15
Posted: Mon, 2009-11-16 11:33

Alec,

1) I realised that - I just thought it looked neater that way :)
2-5) Most of the changes I have made for Checkout have been to the template & CSS. The Lightbox stuff - and in particular integrating the two - required some changes elsewhere. I've been hacking away at things so I would have to go back & see exactly what I've done. Once I have it the way I want it, then anything that might be worth releasing will need to be tidied up & done "properly". I know this is not necessarily the best way of going about it but for me it was he quickest way to get things done. I have a lot to learn about Smarty, Prototype, Objects in PHP & the structure of Gallery 2. I've Been programming for a long time but it's still a lot to pick up quickly :)

For example, I wanted to change the HTML returned by some of the Smarty tags but I'm having a problem relating the tag params to the code, e.g.'g->linkId view="checkout.SelectProducts"' to the code in Checkout that actually does the work.

Dave Harris

This space accidentally left blank

Login or register to post comments
alecmyers

Joined: 2006-08-01
Posts: 3371
Posted: Mon, 2009-11-16 11:56

useful pages for you:

http://codex.gallery2.org/Gallery2:MVC_Structure
http://codex.gallery2.org/Gallery2:Code_Overview

Checkout has (amongst others)

* a checkout.Select View - which shows the basket contents,

* a checkout.Confirm Controller, which writes the order into the db then shows the checkout.Confirm View (which tabulates the order and gives you the payment options) - or sends you back to the Select view, if you don't have postage set, etc

* a checkout.AddToCart Controller (self explanatory)

* a checkout.Complete Controller which the user accesses on return from (eg) Paypal, that sends the "Order Confirmed" email

I hope that's useful.

Login or register to post comments
DaveRH
DaveRH's picture

Joined: 2005-08-27
Posts: 15
Posted: Mon, 2009-11-16 21:15

Alec,

Just finished reading the MVC structure page. Very useful - and very well written :) It's all very well knowing what MVC "theory" is but one needs to know how it's applied in this particular case. Onwards and downwards...

BTW, would I be right in guessing, from something on that page, that you're e LOTR fan?

Dave Harris

This space accidentally left blank

Login or register to post comments
alecmyers

Joined: 2006-08-01
Posts: 3371
Posted: Mon, 2009-11-16 21:25
Quote:
BTW, would I be right in guessing, from something on that page, that you're e LOTR fan?

Tolkein? Er, no, not especially! Why?

Login or register to post comments
DaveRH
DaveRH's picture

Joined: 2005-08-27
Posts: 15
Posted: Mon, 2009-11-16 21:34

Neither am I but some things just stick in your mind. Silly really - it was the "There & back again" which is part of the title of the hobbit's book.
Like many other implementers, I have a habit of sometimes embedding "references" in comments/docs.
I once implemented a "SPoolfile Access Manager", aka SPAM. It ended up with Monty Python quotes in the header block, amongst other things.

Dave Harris

This space accidentally left blank

Login or register to post comments
alecmyers

Joined: 2006-08-01
Posts: 3371
Posted: Mon, 2009-11-16 21:44

Lol - yes, that was a reference to The Hobbit - I'd forgotten about that!

Login or register to post comments
DaveRH
DaveRH's picture

Joined: 2005-08-27
Posts: 15
Posted: Fri, 2009-11-20 21:10

Glad to hear it's not me getting senile then :)

One thing I will definitely be doing is to look at using the encrypted interface to Paypal. I have implemented this on a couple of sites and need to see if it can be used here as well. It's not trivial but I can probably reuse the code I already have.

The links you sent me were very useful. I'm beginning to find my way around Gallery generally now. I've had to change a few core modules and that's been an education :) I've also fixed a couple of bugs in the Tag Tree module (although IIRC it was actually Tag Management classes where the problems lay). Once I've tested the fixes I'll look at posting them in the appropriate place (if someone hasn't beaten me to it :).

I have about another week of work, on and off, to finish the theme mods I'm doing, maybe a few days on Paypal & then Gallery part of the site should be ready.

Dave Harris

This space accidentally left blank

Login or register to post comments
alecmyers

Joined: 2006-08-01
Posts: 3371
Posted: Fri, 2009-11-20 23:10
Quote:
One thing I will definitely be doing is to look at using the encrypted interface to Paypal. I have implemented this on a couple of sites and need to see if it can be used here as well.

I started work on this, but quickly realised there was nothing to be gained. I'm curious to see if you can actually articulate a benefit.

Login or register to post comments
DaveRH
DaveRH's picture

Joined: 2005-08-27
Posts: 15
Posted: Fri, 2009-11-20 23:52

I have read of people spoofing the call to Paypal - putting in false prices, that sort of thing. I have no idea what the incidence of such hacks was although PP seemed to think it was a real risk. When I first looked at this it must have been 3 years ago, & I don't remember the details of why I thought it pretty much essential at the time (other than PP's urgings), & maybe the plaintext PP interface has been improved since then so that it's now more secure. Anyway, at the time I wasn't happy with the security provided by the plaintext interface so implemented the encrypted one. Given that, essentially, I already have working code, if it gives me just a little bit more security I may as well do it :)

Dave Harris

This space accidentally left blank

Login or register to post comments
alecmyers

Joined: 2006-08-01
Posts: 3371
Posted: Sat, 2009-11-21 00:08
Quote:
I have read of people spoofing the call to Paypal - putting in false prices, that sort of thing.

Ok - I need to step on this one before anyone reads it and gets the wrong impression. You can, if you want, change the price that gets sent to paypal, but when the IPN is received it's compared with the order total recorded in the database, which isn't suceptible to any kind of intervention. If the amount paid doesn't match the order total for any reason the order isn't marked as paid. So as far as checkout/gallery is concerned there's no way to get a spoof order accepted.

To my mind the unencrypted plain IPN mechanism is a good deal more secure than, for instance, the Google mechanism which relies on passwords/secrets to maintain security, and uses only TLS connections (which are actually a total pain to set up in a shared server environment).

Login or register to post comments
DaveRH
DaveRH's picture

Joined: 2005-08-27
Posts: 15
Posted: Sat, 2009-11-21 06:09

I agree - you can check the IPN message in the server (my Paypal code on other sites does that as well as using encryption). I also agree that, as far as I can see, it isn't possible for Checkout to be fooled by a spoofed message to Paypal. However, I've learnt never to be complacent about such things. Very little code is bug free (including mine :) and I think an extra layer of security to prevent such spoofing in the first place is a good idea. Like I said, I'll need to revisit the Paypal encryption system & see what's what.

BTW, I'll be more careful how I word things in future - it hadn't occurred to me that people might take my comments that way.

Dave Harris

This space accidentally left blank

Login or register to post comments
alecmyers

Joined: 2006-08-01
Posts: 3371
Posted: Sat, 2009-11-21 13:14
Quote:
I've learnt never to be complacent about such things. Very little code is bug free (including mine and I think an extra layer of security to prevent such spoofing in the first place is a good idea.

Complacent... no, I don't think I'm that!

I'm just not sure throwing in extra security features is worth the effort; better to keep simple code that's easier to demonstrate is bug-free!

Login or register to post comments
DaveRH
DaveRH's picture

Joined: 2005-08-27
Posts: 15
Posted: Sat, 2009-11-21 18:06

Oh dear - I didn't mean it like that! Again :{

I used to be somewhat complacent when I started in this business, as most of us were - but that was a long time ago.

The encryption code is actually very simple and I have it working.

I don't believe it's possible to demonstrate, conclusively, that any code is bug free (there are some computer scientists who claim to be able to do so mathematically, under particular circumstances). I have worked on "mission critical" software: I once had to rewrite the interrupt analysis routine, in assembler, for a mainframe OS. This went out to several hundred sites worldwide, including the TSB, as-was, for their online system. Once compiled, the code occupied, IIRC, 158 bytes but we spent some 6 weeks exploring every path through it. At the end, we were fairly sure it was bug free and that credible hardware failure modes wouldn't crash it. I was still shitting bricks for weeks after it was released :) That piece of code was, I think, the nearest I have come to being demonstrably bug-free and even then I didn't trust it. As it happened, by two years later, when I left the project, there had been no incidents with it :preen:.

I probably don't have to tell you that security is always a compromise: more can mean more code with more chance of errors and security usually has a cost operationally and to the users (although not so in this case :). However, I think it's often a judgement call, despite all the methods that have been devised for trying to formalise it.

I'm far to tired to really be thinking about this now. I'll go away & have a look at the current PP situation & the code & came back when I've done that & can be cogerent.

Dave Harris

This space accidentally left blank

Login or register to post comments
alecmyers

Joined: 2006-08-01
Posts: 3371
Posted: Sat, 2009-11-21 18:35

I've just been reminding myself about the various checkout API's. There are various methods that paypal provide, but I think that anything that uses encryption requires an X.509 certificate, the generation of which I think is beyond most Gallery users.

Login or register to post comments