anvc / scalar

Born-digital, open source, media-rich scholarly publishing that’s as easy as blogging.

Scalar

Congratulations on discovering Scalar, the next generation in media-rich, scholarly electronic publishing!

If you just want to create a Scalar project, the easiest route is to work from our servers. You can register and learn more at http://scalar.usc.edu/scalar. Using the version of Scalar that is hosted on our servers guarantees that you are working on the most up-to-date version of the software. During our beta phase, updates will continue to happen with some frequency as features are added, user feedback is incorporated and Scalar continues to broaden the horizons of electronic publishing. If you are technically inclined and decide to host your own version of Scalar, you’re free to customize and modify it in any way, but it’s up to you to download, install and troubleshoot updates as they become available.

We are also very grateful for all feedback based on your experiences using Scalar. We are especially interested to know where and how you are using it, innovative or unexpected uses of Scalar, requests for features, opportunities for future development, potential press, archive or scholarly society partnerships, as well as reports on any bugs or difficulties you may experience. Learn more at http://scalar.usc.edu/scalar.

To install Scalar on your own server, you can download the most recent build from GitHub. Or, if you are concerned about downloading from the "live" GitHub codebase, we periodically create a GitHub Release. The code kept in a release can be assumed to be tested in both development and live environments (e.g., scalar.usc.edu). For help installing Scalar, see either INSTALL.txt or UPDATE.txt in the project root folder.

As we update the software, we periodically make changes to Scalar's config files or database structure. If you have installed Scalar on your own server and are planning to update from GitHub, you'll likely need to make updates to your local config files or database. We're keeping track of the config changes on the wiki: https://github.com/anvc/scalar/wiki/Changes-to-config-files-over-time.

scalar's Issues

Question about site import

We recently migrated our site to Reclaim Hosting because of performance issues, but now the site media links appear to be missing. According to the import/export instructions:

Uploaded media: Media uploaded directly to a source book will not be physically transfered to a destination book. Rather, the destination media pages will point to the URL of the media housed in the source book. This means that in the event that the source book is deleted, the media link will go dead. However, this problem can be corrected using the "Replace existing" feature at Import > Local media files.

When I choose replace existing on the new site, I get an empty dropdown menu. Is this because the site was imported incorrectly, or is this just a limitation of the beta import/export tool? Is there a way to use local files without having to re-upload all of the ~90 images for our site and relink them?

Uploaded media not available in UI

I've uploaded a couple of images to include in a book, they exist on the file system in the books media folder, but the "choose and image" list is empty, etc.

is there a config or permission that I'm missing?

paths missing on image header layout

Hi, When we use the image header layout, the paths are not included at the bottom of the page. Is there any way to include the paths?

404 error when clicking on 'register' link

(The following is an anonymized email to Scalar Info Design Director Craig Dietrich from a person installing Scalar on their own server)

---------- Forwarded message ----------
From: (redacted)
Date: Tue, May 21, 2013 at 11:19 AM
To: Craig Dietrich

I can't seem to register an account or log in. I get 404 errors upon clicking the links:

"The requested URL /scalar-master/system/login was not found on this server."
"The requested URL /scalar-master/system/register was not found on this server."

Upon navigating to these locations they are indeed not present. Any ideas on this?

Problem with Media as Annotation

A couple of times, when I allow a Media element (in this case, a jpeg) to also serve as an annotation - and then later change my mind and remove that annotation, the media element's page loses its content.

That is, if scalar.usc.edu/works/fooproject/media/dog is a jpeg, and I make it an annotation on another media file scalar.usc.edu/works/fooproject/media/dogs_poker, and then REMOVE the annotation, and then return to the page scalar.usc.edu/works/fooproject/media/dog, that page no longer displays the image, nor the record of other pages that refer to it.

SSL using Scalar

Hello,

On my virtual Redhat VM server, my Scalar site is giving me "404 Page Not Found" in the error log ("/var/www/html/scalar/system/application/log/log-2017-07-05.php")

When I go to http://scalar.domainnname.edu, I get the scalar HOME screen, but as soon as I click "Sign-In" link,the page does NOT render. I get an "HTTP ERROR 500".

This page isn’t working.
https://scalar.domainname.edu is currently unable to handle this request.
HTTP ERROR 500

Is this an SSL thing ?? Can someone please help me asap? Thank you

ERROR - 2017-07-05 00:21:59 --> 404 Page Not Found -->
ERROR - 2017-07-05 00:22:23 --> 404 Page Not Found -->
ERROR - 2017-07-05 00:22:25 --> 404 Page Not Found -->
ERROR - 2017-07-05 00:22:34 --> 404 Page Not Found -->
ERROR - 2017-07-05 00:22:36 --> 404 Page Not Found -->
ERROR - 2017-07-05 02:51:02 --> 404 Page Not Found -->
ERROR - 2017-07-05 08:40:13 --> 404 Page Not Found -->

Error Reporting Levels

There are several places where the error reporting level is being overridden to display all errors.

https://github.com/anvc/scalar/search?utf8=%E2%9C%93&q=error_reporting

It would be much better to have this as a configuration option. For instance, I'm getting lots of Deprecation errors from the mysql_* functions.

Registrations fails

Upon user-registration, I get the error
Field 'password' doesn't have a default value
for the query
INSERT INTO scalar_db_users (fullname, email) VALUES ('My Name', 'my@email')
generated by
$data = array('fullname' => $fullname, 'email' => $email);
$this->db->insert($this->users_table, $data);
in https://github.com/anvc/scalar/blob/master/system/application/models/user_model.php (MySQL 5.6)

The reason is that you set password as NOT NULL without a DEFAULT in:

CREATE TABLE IF NOT EXISTS scalar_db_users (
...
password varchar(255) COLLATE utf8_unicode_ci NOT NULL,
..
)

but you only set fullname and email in the insert

Disable Registration

There should be a simple way to disable registration

ARC2 fails to connect to MySQL running on non-standard port

I've set up an instance of Scalar running here at the University of Washington. As it is a shared hosting environment, we need to run our instance of MySQL on a unique port. I added a port to system/application/config/database.php as described in the CodeIgniter documentation:
$db['default']['port'] = 1234;
This works and lets us connect to the database from the CI application, but apparently not from ARC2. I am getting these error messages multiple times on every page I access:

A PHP Error was encountered

Severity: Warning

Message: mysqli_connect(): (HY000/2005): Unknown MySQL server host 'oursubdomain.u.washington.edu:1234' (2)

Filename: store/ARC2_Store.php

Line Number: 51

It appears arc is not properly passing the separate $port parameter to mysqli_connect as is required.

Media import silently fails (HTTP 200)

Hello,

We are running Scalar on Apache + PHP-FPM (v5). When trying to upload a book cover or to import local media into a book, the upload fails.

When changing the book cover, after the upload I am redirected to the dashboard page (system/dashboard). I can see the following log lines:
[31/Mar/2017:09:26:26 +0000] "POST /system/dashboard HTTP/1.1" 200 892 "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"

(I removed the referrer but it comes from "/system/dashboard?book_id=7&zone=style")

When using "import local media", if I click on Upload the button becomes deactivated, I see some lines in the log file but nothing happens:
[31/Mar/2017:09:25:08 +0000] "GET /my_book_name/upload HTTP/1.1" 200 5445 "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"
[31/Mar/2017:09:25:20 +0000] "POST /my_book_name/upload HTTP/1.1" 200 896 "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"

Any suggestions? Thanks!

JSON parsing error displayed to user when uploaded file is too large

If a user attempts to upload a file for a book, and that file is larger than the local PHP configuration allows, the user receives a JavaScript alert with the confusing message: “There was an error saving the file: SyntaxError: Unexpected token <”

This appears to trace to system/application/views/arbors/html/common.js, in which validate_upload_form_file_return() parses the server’s response as JSON. However, since PHP threw an error, the response is HTML; the resulting parse error is presented to the user.

I’m not sure exactly who handles the upload route (CI_Upload?), but it should probably have an option to respond in JSON or HTML, or a try/catch block to intercept errors (and turn them into JSON), whichever’s appropriate.

Delete a book?

I don't see any functionality to delete a book, Am I missing something?

PHP Error

After following the instructions for installation, this is the page that comes up for main Scalar webpage. Can you provide any insight?

template->add_css(path_from_file(FILE).'title.css'); ?>
load->view('modules/cover/login'); ?>
Scalar

template->add_css(path_from_file(FILE).'book_list.css'); ?> '; foreach ($books as $row) { $uri = confirm_slash(base_url()).$row->slug; $title = trim($row->title); $book_id = (int) $row->book_id; $thumbnail = (!empty($row->thumbnail)) ? confirm_slash($row->slug).$row->thumbnail : null; $is_live = ($row->display_in_index) ? true : false; if (empty($thumbnail) || !file_exists($thumbnail)) $thumbnail = path_from_file(FILE).'default_book_logo.png'; $authors = array(); foreach ($row->users as $user) { if ($user->relationship!=strtolower('author')) continue; if (!$user->list_in_index) continue; $authors[] = $user->fullname; } echo '
'.$title.'
'; if (count($authors)) { echo implode(', ',$authors); echo "
"; } echo '
'; } echo ''; }; ?>
Thank you for registering your Scalar account
A PHP Error was encountered

Severity: Notice

Message: Undefined variable: uri

Filename: libraries/Loader.php(673) : eval()'d code

Line Number: 33
" style="float:right;">clear
config->item('index_msg')):; ?>
is_logged_in):; ?> book_id; $is_live =@ ($row->display_in_index) ? true : false; $is_featured =@ ($row->is_featured) ? true : false; $hide_other = ($this->config->item('index_hide_published')) ? true : false; if ($is_featured && $is_live) { $featured_books[] = $row; } elseif ($is_live || $login_is_super) { $other_books[] = $row; } if (in_array($book_id, $login_book_ids)) { $user_books[] = $row; } }; ?> is_logged_in)?'':' class="wide"').'>'; if (count($featured_books) > 0) { echo '
Featured Books
'; print_books($featured_books); echo '
'; } if (count($other_books) > 0) { echo '
'.((!empty($featured_books))?'Other ':'').'Public Books
'; print_books($other_books); } echo '
'; ?> is_logged_in) { echo '
Your Books
'; if (count($user_books) > 0) { echo '

'; print_books($user_books, true); } else { echo '

You haven\'t created any books yet.
'; } echo '

'; }; ?>

"No input file specified." when clicked on Register/Login

Hello,

I have an instance of scalar installed at http://rahman.veeven.com/scalar/
When I click on Register or Login, I get a page with "No input file specified." and nothing else.
What might be wrong?

Omeka Classic media source hardcodes insecure URL

in system/application/rdf/omeka_to_json.php, the given Omeka URL has its scheme stripped, and then http:// prepended. If the Omeka installation is running over HTTPS, it is inaccessible to Scalar.

Get parameters like ?path=index

I have installed the git version of scalar. This creates urls with parameters
like ?path=index.

And subsequently I get an 404.

Centralized authentication mechanism

Is there a way to have our own hosted instance of Scalar use our campus CAS or an LDAP server for authentication of users? It's fine with me if users still have to register for an account in Scalar before logging in, but I want the actual authentication to be done by one of these external authentication mechanisms. I couldn't find any configuration options or plugins that handle this when setting Scalar up on my server.
Thanks,
-Chris Creswell

Scalar 2 Google Map Layout Page Problem

I'm not very good with web design stuff and I'm not sure if this is where I'm supposed to put these types of questions but in the last three days I have been tried to create a page using the Google Map layout and whenever I try to add spatial metadata the page says it's saving but never fully saves, then when I leave the page it messes up what I had done before. For example, it made a version of the page where the page no longer annotated two media files and took the page off of the path it was part of. I am using the WYSIWYG editor on Firefox/Chrome though I did try to add my own custom CSS/Javascript though I have since deleted these features from my pages.
Scalar 2 has also been randomly signing me off before I was able to save changes and creating a site on here has been a very frustrating experience. I don't know what is going on.

Excess space in importer, CTDA media issues, TIFF media issues

Submitter: Shalin Hai-Jew
Email: [email protected]
Windows 7
Google Chrome 43.0.2357.81

I went into the data importer...for the Shoah Foundation VHA Online and found the following:

In the data importer, when I have it open full screen, the results button at the bottom is invisible. If there could be less white space, that would be helpful… The following came up because nothing was found…but the information below is still helpful to know it’s there.

Then, I went to the Cuban Theater Digital Archives resources and found the following:

During the archive search and data download, the check (box) and Preview enables .jpgs to visualize but not .tifs. So is there anything like a .tif viewer for possible downloadable images?

Also, once the .tif images are downloaded to the project and placed on the page, they actually do not show up. The placeholders show on the edit view...but when the page itself is saved, the images do not show. So .tif imports do not seem to work in terms of not showing on the page.

Install fails on mysql:5.7

system/application/config/scalar_store.sql fails with

ERROR 1067 (42000) at line 71: Invalid default value for 'datetime'

on mysql version 5.7

Unable to Import SQL files

I've tried importing both SQL files (each with the proper collation) using both the command line and PHPMyAdmin but keep getting the following error:

#1064 - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '-----
CREATE TABLE IF NOT EXISTS scalar_db_books (
book_id int(10) unsigne' at line 1

I could edit the SQL, but am worried that the database will be built wrong if I do. Is there an issue with SQL files in the most recent release? Or perhaps the necessary version of MySQL could be stated in the install.txt?

Thanks!

Blank Error Page on install

Trying to set up a docker based install and running into a blank page. Any thoughts on what is wrong or how to get it to spit out an error (or where it might be pitting out an error) would be appreciated.

I've tried setting $config['log_threshold'] = 0; in system/application/config/config.php to values 1,2,3 and 4 but there is no effect.

If you're not familiar with docker, it is basically just a way of building very lightweight virtual machines.

The the file below defines what is done on top of a base image to build what you're looking for. I've added some comments in the file below reflecting what is going on.

It starts with this docker supplied php file:
https://raw.githubusercontent.com/docker-library/php/7bd5c38db974ee629a815896add1ec568a1cc88c/5.6/apache/Dockerfile

Which is basically just an apache and php install on top of a barebones debian base. Then my Dockerfile

DockerFile:

FROM php:5-apache

MAINTAINER [email protected]

# Setup; updates packages
ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update && apt-get -q -y upgrade

# Apache; enables mod_rewrite
RUN a2enmod rewrite

# PHP; install mbstring and mysql extensions
RUN docker-php-ext-install mbstring
RUN apt-get -q -y install php5-mysql


# Scalar; downloads the code from the git repo
RUN apt-get -q -y install git
RUN rm -R /var/www/html/
RUN git clone https://github.com/anvc/scalar.git /var/www/html/

# Copies my custom php.ini file
COPY php.ini /usr/local/etc/php/

php.ini

short_open_tag = true

date.timezone = "US/Eastern"

Installation confusion

I am trying to install scalar by aliasing the folder in apache2 but its not working.
Current config is...

<Directory "/pathtoscalarfolder/scalar">
    Options FollowSymLinks
    AllowOverride All
    Order allow,deny
    Allow from all
</Directory>

I have tried setting the alias to
Alias /scalar /pathtosclarafolder/scalar and
Alias /scalar /pathtosclarafolder/scalar/system but no luck.
How should this be setup?

Trouble creating an account

Hello,
One of my coworkers was trying to create an account and can't seem to prove that he is not a robot and has been doing CAPTCHA tests for far too long (something like 20 minutes). The mountain one in particular gave him a lot of trouble. He is on Firefox and also has to do another CAPTCHA test to make a new book. As far as I know, he is a human.

scalar SSL settings - mixed content issue on scalar site

I am trying to get scalar to work on SSL

Is there something wrong with my configuration?
The server listens on 80 and my router does the SSL offloading from 443 to 80

Getting MIXED CONTENT. Any way to fix this ??
Here is a snippet of my system/application/config/config.php

$config['is_https'] = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') ? true : false;
$config['base_url'] = 'http'.(($config['is_https']) ? 's' : '').'://'.$_SERVER['HTTP_HOST'].str_replace('//','/',dirname($_SERVER['SCRIPT_NAME']).'/');

$config['base_url'] = 'http://scalar.mysite.edu';
$config['base_url'] .= preg_replace('@/+$@', '', dirname($_SERVER['SCRIPT_NAME'])).'/';

LacunaStories - update to Drupal 7.5.1

Hello,
I am running LacunaStories on Drupal core 7.5.0 on a Ubuntu 16.04 virtual host.
When I click on Report-->Status Report , I noticed that Drupal 7.5.1 is available.
Can someone let me know how I can perform this update manually?
Will LacunaStories work on 7.5.1 ? Anything to look out for?
I already backed up the database (via Backup and Migrate).

Thank you

Google Photos media support

Submitter: Christopher Schreck
Email: [email protected]
I'm having trouble adding a photo from url provided by Google Photos/Google Drive into my Scalar book. I've made the photo public and obtained a sharable url for a photo that I took myself and saved to Google Drive, and the Scalar program seems to think it has found it, but nothing appears when I save the media page. I had no problem with another file that I got off of a different website, just my own photos from Google Drive. I'm using a 2014 Macbook Air with the most recent OS X Yosemite operating system, with the most recent version of Safari as my browser.

Githubs Fenced highlight code block Support

How about support Fenced code block features?

Scalar and Firefox problems?

Hi!
I tried to sign on http://scalar.usc.edu/ using Firefox (pretty close to default version of Firefox with a few plugins from Adobe and MS Office) and it leads to a 404 Not Found page. I am signed in when I go to the page for the book and I can sign in with Chrome fine. Is Chrome the recommended browser for Scalar? Are there browsers that are preferred/ should be avoided? Any information would be great thanks!

Page's media not showing in Gallery view

Submitter: Annie Johnson
Email: [email protected]
Hi,

I embedded an image on my page and set the page to Basic View. All was well. Then I changed the view to Media Gallery. When I hit save, the image did not appear on the page.

I am using Firefox 38.0.5 on a Mac (OS X).

Best,

Annie

Media Import issue within Scalar

why the Media Import feature of Scalar routinely gives Internal Server error messages when you try to import from partner archives.

In Scalar, if you you are in a book (from tech professor: [email protected] has), and you go to the Import Option:
and try to get anything from Affiliated Archives, or Other Archives:
( try searching for Picasso, at the Met, for example,) you get:
"Internal Server Error"---> See picture attached
![internal_server_error]
(https://cloud.githubusercontent.com/assets/12171475/20438158/89a6a20e-ad84-11e6-813a-3d94809e897d.png)

The other two options work: Local Media Files and Internet Media Files both work just fine.

Thank you,
Patrick

Way to turn off comments by default?

A user at Lehigh University wants to know if there's a way to disable comments by default for newly published pages. Can this be done at the page or book level?

Questions about CKEditor config and plugins

A user at Lehigh University wants to me to customize some aspects of the WYSIWYG editor in the Scalar 2 interface.

First, he wants to know if it can be configured to auto-save changes while he's working on a page. I found this CKEditor plugin:
http://ckeditor.com/addon/autosave
If I were to install this plugin in ${scalar_dir}/system/application/views/widgets/ckeditor/plugins and configure it in ${scalar_dir}/system/application/views/widgets/ckeditor/config.js, would that likely work? Is this a bad idea?

This same user is also asking about font styles and sizes. The way CKEditor is configured in the Scalar 2 interface, it looks like the user doesn't get to choose the font, and the size is only configured using the "H1" dropdown. I could install another plugin like this one to give the user more font related options:
http://ckeditor.com/addon/font
Same question -- is this likely to work? Is it a bad idea?

Reset password in scalar not working

I can't seem to reset my password in scalar. As soon as I click forgot password and enter my email address and click "reset password" ...nothing happens.

Scalar is not doing anything...just waiting.

Restrict user access to scalar for a particular domain

Is there a way to restrict access to Scalar, so only university students (students with @university.edu in their email address) can register only? Is there any way to restrict to non-university students ?

Thank you,
Patrick

getting error message on scalar home page

Hi, sometimes scalar will show a page with a short text saying the site is unavailable. I cannot remember the exact phrasing. Deleting cookies for the site restores it. It seems to be something to do with multiple people either working on the same book or same doc, but not sure about that. I can provide more details as needed, but the occurrence is semi-random, so it might take a while to repeat it. Not sure what version of scalar it is but installed it this semester so fairly recent.

Multiple author credits

For books with multiple authors, it would be great to be able to see who authored what material, both on individual pages and in visualizations for the book.
The information seems to be there in the edit history for individual pages. Though we know that a page will store an author as having edited the page even if she only made a typo correction, would be better to just include every author who "touched" a page/object and then perhaps allow for edits after the fact (some sort of "remove author from this page" option perhaps).

Anonymous Scalar 2 Issue

Submitter: Erik
Email: [email protected]
This is a test of anonymous bug reporting on github

scalar SSL settings

Hi.
I am hosting scalar on a Ubuntu virtual host to support some faculty members for the university I work for. What settings can I change to get scalar to support SSL (https://scalar.domainname>)
What config files (if any) do I need to look at modifying?

Our Netscalar (router) supports HTTP--> HTTPS redirect.
Will the scalar application config require any modifications ?

Thanks for any assistance.
Patrick

I can't get your site to load!

Currently having issues with your site at this link http://scalar.usc.edu/scalar/

I can't get it to load due to timeout errors, and this was the only place I could find to get in touch with your project.

Move book files

It would be great to have the ability to move where the books file (and the directories) are stored.

HELP HELP!!! Scalar redirects back to login screen after I log in

I have a problem with scalar. It keeps REDIRECTING me to login screen after I LOG IN.
I am never LOGGED IN (in scalar).
My virtual host is NOT using SSL. Strictly standard virtual host with port 80 listening
I am using the default .htaccess (that came with scalar) in my /var/www/html/scalar directory.
On a Redhat virtual host.

Can someone please help me find out WHY this is HAPPENING?
I really need to get this working for faculty by tomorrow. Some information on it below

I enabled php (mbstring module as mentioned in the INSTALL.txt)

PHP version is 5.3
[root@ace-linux11 conf]# php -v
PHP 5.3.3 (cli) (built: Jul 25 2016 05:47:24)
Copyright (c) 1997-2010 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2010 Zend Technologies
[root@ace-linux11 conf]#

Snippet of /etc/httpd/conf/httpd.conf
<VirtualHost *:80>
DocumentRoot /var/www/html/scalar
ServerName scalar.ace.fordham.edu

  <Directory /var/www/html/scalar>
       Options Indexes FollowSymLinks
       AllowOverride All
       Order allow,deny
       allow from all
 </Directory>

MySQL 5.6 datetime issues

Upon creating a new page, I get the error:
Incorrect datetime value: '2016-03-03T14:45:21+01:00' for column 'created'
for
INSERT INTO scalar_db_content (book_id, slug, type, is_live, color, user , created, thumbnail, background, banner, custom_style, custom_scripts, audio) VALUES
(1, 'index', 'composite', '1', '', 1, '2016-03-03T14:45:21+01:00', '', '', '', '', '', '')

The +01:00 comes from
$data['created'] = date('c')
in page_model.php (similar in reply_model).

In book_model.php / version_model.php you use
'created'=>$mysqldate = date('Y-m-d H:i:s')

It probably makes sense to add a constant or a method to use the same datetime-formatting (without the timezone-appendix) everywhere.

Import support for Omeka S

Omeka S has a significantly different API than Omeka (now called “Omeka Classic”). It would be nice to use Omeka S as a media source with Scalar.

Markdown support feature

This is great tool. I don't know Why this tool is not famous ....

Anyway, could you make Markdown support feature?

or convert from markdown... I have a bunch of markdown document...

and the convert process is so pain.

Scalar messages in system/application/logs

Seeing these errors in /var/www/html/scalar/system/application/logs
Can you let me know what is causing this.
I have at least 20 users on my Redhat6 scalar server.
Thank you.

ERROR - 2016-11-17 21:38:56 --> Severity: Notice --> Trying to get property of non-object /var/www/html/scalar/system/application/views/modules/dashboard/book_style.php 19
ERROR - 2016-11-17 21:38:56 --> Severity: Notice --> Trying to get property of non-object /var/www/html/scalar/system/application/views/modules/dashboard/book_style.php 222
ERROR - 2016-11-17 21:38:56 --> Severity: Notice --> Trying to get property of non-object /var/www/html/scalar/system/application/views/modules/dashboard/book_style.php 249
ERROR - 2016-11-17 21:38:56 --> Severity: Notice --> Trying to get property of non-object /var/www/html/scalar/system/application/views/modules/dashboard/book_style.php 252

Malicious code injection opportunity

When loading media resources from a remote service, the XSL transformation file is specified in the form submission parameters as a URI. The Scalar server fetches this resource from the specified URI and applies it; the form submission could easily be presented with a maliciously-crafted XSLT, and Scalar will naïvely execute it. The remote-resource processing XSLT should only be loaded from the local filesystem, installed with Scalar or with a trusted plugin.

404 not found in import section of dash

hi, in my install of scalar (http://dahi.manoa.hawaii.edu), I get a 404 error in the import/export tab for the import function section of the page

it is a fresh install from a day or so ago from git clone

Media upload sometimes silently fails

Using Scalar 2.3 in our own installation (downloaded from GitHub).

A user is testing the system, uploading a series of JPEG images into her book. Some files succeed: the file uploads, a thumbnail is created on the filesystem, a database entry is created, and her browser is forwarded to the Scalar page for that asset.

Some files succeed but hang: a thumbnail is created, as is a database entry, but the browser hangs on the import page. Returning manually to the dashboard shows the asset as present.

One file, at least fails: the thumbnail is created on the system, but no database entry is created. The upload page hangs as above, but returning to the dashboard does not show the asset (predictably, since it’s not in the database). Interestingly, the thumbnail created is identical to the uploaded file—this has been reproduced with multiple uploads of the file under different filenames.

The broken file is attached.

I’m investigating this in our local installation, but help would be appreciated. It seems to be different from the issue described in #54.