osCommerce News
Recent posts
post item
Managing FedEx Shipping
March 28, 2024
Managing FedEx Shipping ...
post item
Managing DHL Shipping
March 27, 2024
Managing DHL Shipping ...
post item
Managing Search Plus
March 26, 2024
Managing Search Plus ...
post item
Managing Universal Log Report
March 25, 2024
Managing Universal Log Report ...
post item
Managing Temporary Stock Report
March 21, 2024
Managing Temporary Stock Report ...
post item
Updating Opayo Server Module
March 20, 2024
Updating Opayo Server Module ...
post item
Updating Opayo Pi Module
March 19, 2024
Updating Opayo Pi Module ...
post item
Managing Summary Report
March 19, 2024
Managing Summary Report ...
post item
Managing Stock by Manufacturer Report
March 18, 2024
Managing Stock by Manufacturer Report ...
post item
Managing Purchase Report
March 15, 2024
Managing Purchase Report ...
Products
Tags

Management

Ecommerce

Integrations

newsite

launch

grant

fund

replatforming

osCommerce 4.x

shopping cart

hosting

Installation

New PayPal Module (Latest API 2.0)

osCommerce 2.2

osCommerce 2.3

Shopping cart customizations

Manually

PayPal Express

APM (Alternative Payment Method)

Standard Variant

Advanced Variant

Configuration

Testing

Front End

Install osCommerce for Me

Let me install myself

Multiple sales channels

Single active sales channel

Installation on your own server

Assigning theme to sales channel

Deleting sales channel

Connect

App Shop

Adding Free Module

Admin Area

Adding Paid Module

Installing Module

Opayo Pi Module

Development Mode

Email Verification Before Registration

Managing Languages

Managing phpMussel

Managing Orders

oscommerce.com account

Creating Manual Orders

Managing Customers

Managing Customer Groups

Managing Brands

Managing Categories

Managing Filters on Categories

Managing Products

Managing Stock

Assigning Products and Categories to Front Ends

Assigning and Moving Products to Categories

Managing Default Sort Order on Product Listing and Category

Managing Cross-Sell and UPSell

Managing Reviews

Managing Attributes

Managing Product Groups

Managing Properties

Managing Suppliers

Managing Warehouses

Managing Sales Statistics and Purchase Report

Managing Stocktaking Costs

Managing Deleted Orders

Managing Coupons

Managing Virtual Gift Cards

Managing Sales Price

Managing Giveaways

Managing Featured Products

Managing SEO

Managing Meta Tags

Managing XML Sitemap

Settings of E-commerce Tracking for Google Tag Manager

Setting up GA4

Managing Pages

Managing Menus

Assigning Theme to Sales Channels

Deleting Sales Channels

Managing Translations

Managing Email Templates

Managing Catalog Pages

Managing Shipping Modules

Managing Payment Modules

Managing Order Structure

Managing Socials

Managing Extensions

Managing Managers

Managing Access Levels

Managing Back End Menu

Managing Configuration

Mail Sending via SMTP

Setting up SMTP

Status Groups

Order Statuses

Comment Templates

Stock Indication

Notify Me when in Stock

Stock Delivery Terms

Cross Sell Type

Cache Control

Filters

Managing Countries

Managing Counties and States

Geo Zones

Managing Cities

city settings

Postal Codes

Managing Taxes

Managing Currencies

Backups

Viewing Who is Online

Managing IP Restriction

Error Log Viewer

Creating Installation

Address Formats

Image Settings

Sales Tags

Managing Front Ends

Managing App Shop

Going Live with osCommerce

Affiliate Module

Awin Module

B2B Module

Business To Business module

Bazaarvoice Module

Managing Blog

Collection Points

Managing Competitors

Customer Code Module

Customer Modules Module

Customer Multi Emails Module

Customer Products Module

Delayed Despatch Module

Delivery Options Module

Fraud Address Module

Frontend Session Module

Invoice Number Format Module

Maximum Order Quantity

Merge Customers Module

Merge Orders Module

Minimum Order Quantity

Neighbour Module

One Trust Module

Order Flags and Markers

Pack Units

Covered by Coupon Module

Klarna Module

LiqPay Module

Mollie Pay

Pay360 by Capita Module

pxPay Module

RBS WorldPay Module

Tyl by NatWest Module

Personal Catalog

Personal Discount Module

Product Bundles

Product Collections

Product Easy View

Product Global Sort

Product Ignored Payment Methods

Product Ignored Shipping Methods

Product Press Reviews

Product Relocation

Managing Refer Friend

Bookkeeping Detail Report

Changes History Report

Compare Report

Deficit Product Report

Emails History Report

Report by Email Module

Expected Products Report

Managing Freeze Stock

In Cart Stock Report

Low Stock Report

Manufacturer Sales Report

Ordered Products Report

Purchase Report

Stock by Manufacturer Report

Summary Report

Updating Opayo Pi Module

Updating Opayo Server Module

Temporary Stock Report

Universal Log Report

Managing Search Plus

Managing DHL Shipping

Managing FedEx Shipping

Issue #25: March 17, 2003

By Harald Ponce de Leon

March 17, 2003

Security And Privacy Proposal
Filenames And Database Tables Definitions
Cross Site Scripting Vulnerabilities
Tax Implementation Update
New Wiki Documentation Site
Contributions Added/Updated In The Last 3 Days

Security And Privacy Proposal

The Security And Privacy Proposal discussed on the Developers forum has been realized and is now in CVS.

The implementation introduces a new Sessions configuration group with three parameters:

SESSION_WRITE_DIRECTORY (default /tmp)

It is recommended to change the location of where the file based sessions are being stored as /tmp is generally accessible to all users on the server.

SESSION_FORCE_COOKIE_USE (default False)

When enabled, sessions are only started when a set cookie is readable.

As cookies are depended on, this option will only successfully work when HTTP and HTTPS servers have the same top level domain, for example:

https://www.server.com and https://ssl.server.com will work, whereas

https://www.server.com and https://www.ssl.com/server/ will not work.

SESSION_CHECK_SSL_SESSION_ID (default False)

When enabled, the SSL_SESSION_ID automatically generated on secure HTTPS requests is stored in the session and verified on subsequent secure HTTPS requests. If the value has changed the customer must log in again to continue their actions.

Ross Lapkoff and Marcel van Lieshout are looking for workarounds on the SESSION_FORCE_COOKIE_USE option for it to be able to work on servers that use shared SSL certificates.

The discussions of the proposal can be read at:

https://www.oscommerce.com/forums/viewtopic.php?t=31928

The updated proposal is available at the new Wiki documentation site at:

https://www.oscommerce.com/wiki/proposalSecurityAndPrivacy

Filenames And Database Tables Definitions

During the implementation of the Security And Privacy Proposal, the application_top.php file on the Catalog went through a clean-up process.

Part of the process moved the filename and database table definitions to their own files.

This will ease the merging of the Catalog and Administration Tool files when it occurs for Milestone 4.

Cross Site Scripting Vulnerabilities

Daniel Alcántara de la Hoz alerted the team of 2 cross site scripting vulnerabilities existing in catalog/includes/header.php.

These and other vulnerabilities have been fixed, and can be seen with the Bug Reporter by viewing all Cross Site Scripting reports.

As these vulnerabilities exist on the developing Milestone releases, no point release of Milestone 1 will be made available.

Point releases will be made available when vulnerabilities are found on stable project releases.

The Cross Site Scripting bug reports can be seen here:

https://www.oscommerce.com/community/bugs/action,search/type,Cross Site Scripting

Tax Implementation Updates

The tax implementation has been updated again as tax rates that were meant to be compounded were not compounding at all.

Updates were also made on the tep_round() function as PHPs native number_format() and round() functions produced different results when float and string values were parsed.

A bug report at PHP was opened due to this issue but turned out to be a float/mathematical issue instead of a PHP issue.

The updated tep_round() function now produces the expected results but may again be updated soon to increase its performance.

The PHP bug report can be seen here:

https://bugs.php.net/bug.php?id=22712

An updated proposal for the tax implementation can be read at the new Wiki documentation site at:

https://www.oscommerce.com/wiki/proposalTaxes

New Wiki Documentation Site

A new Wiki documentation site has been setup to start a public effort in writing documentation for the project.

Melinda Odom from oscdox fame has contributed a lot of help related documentation, Ian Wilson has started off the programming documentation, and Harald Ponce de Leon has started off the proposals section.

If you're interested in participating in the effort, or have questions to the Wiki site in general, get in touch at the Wiki forum channel provided at:

https://www.oscommerce.com/forums/viewforum.php?f=15

The Wiki documentation site can be reached at:

https://www.oscommerce.com/wiki

Live Shops List

Recent Live Shop entries are still pending to be activated which will be done during the week.

Contributions Added/Updated In The Last 3 Days

AdminLogin-0.0.5
SVFlix Bank Transfer
Low Stock Report
MS1 to L5 db upgrade
french-zone france metropolitaine
Product Attributes - Option Type Feature
Gift Certificates - Generic
Protx Form Payment Module
PaySystems Module
Add Shopping Cart Info to Your Header
Big Images
Customer specific discount percentage
ot_commission 1.0
Bluepay Web Link Gateway
Ship 2 Pay v1.0 (MS1)
PDF data_sheet maker 1.1
Banner Picture Hack in Banner Manager
Infoboxes outside OSC
newsdesk_v_1.4_tarred
admin_controlled_bestsellers_images_scroll
NewsDesk
Card Zapper
Conditions, Privacy & Shipping with MySQL v1.0

 

You can further discuss it on our Forum