osCommerce News
Recent posts
post item
osCommerce 4.05 release
September 21, 2022
osCommerce 4.05 has been released! Read more to find out how to upgrade to the latest version and what has changed ...
post item
Hybrid Ecommerce
August 16, 2022
osCommerce brings a new type of Ecommerce platform to the market - a so called Hybrid Ecommerce. So what is Hybrid Ecommerce? We see it to be the best of both worlds - an open source (and free) Ecommerce solution that is also hosted as if it was SaaS (or EaaS - Ecommerce as a Service). This means users (businesses and developers) do not need to worry about hosting requirements and at the same time have full access to the source code and can change or implement any custom features, integrations, etc. Of course, it is always possible to host osCommerce on your own server! It is just so much easier (and quite likely more cost effective!) to use osCommerce's own hosting solutions.  Hybrid Ecommerce from osCommerce Users can choose to have osCommerce installed for free on one of our servers to try osCommerce before use.  Once satisfied with its features, speed, robustness - they can choose to move to a paid osCommerce hosting account or to download and use osCommerce site on their own server. Move to an osCommerce-managed server is done automatically. Server environment is optimised for osCommerce, allowing it to give the best performance. It is also managed and upgraded with the latest server software. Most importantly, osCommerce installation can be automatically updated to the latest version of osCommerce (and Applications) as well. Any customisations, done right, will stay but all the standard modules and the core of osCommerce will be regularly updated, bringing fixes, changes, new features. Full FTP and mySQL access are offered to businesses and developers should they require such.   ...
post item
osCommerce 4.03 release
August 16, 2022
osCommerce 4.03 has been released. Read more about what's new in the latest version of popular open source free shopping cart! ...
post item
osCommerce 4.02 release
August 09, 2022
osCommerce 4.02 release, update notes, download instructions ...
post item
osCommerce 4.01 release
August 04, 2022
osCommerce 4.01 is available from https://www.oscommerce.com   Changes are available from osCommerce Wiki:  https://wiki.oscommerce.com/index.php?title=Change_Log We will continue working on fixing issues and adding features, osCommerce will be regularly developed and updated. ...
post item
osCommerce 4.0 Interview
August 03, 2022
What is osCommerce 4.0? How it was created and why? What is the team behind osCommerce? How was osCommerce released during the war in Ukraine?  All of this and more in the video interview, done by David Goodale of Merchant Accounts (Canada):     Visit Merchant Accounts Canada  for the full video and transcript ...
post item
osCommerce proudly developed in the UK and Ukraine
July 27, 2022
As many readers would know, osCommerce is headquartered from the UK but the majority of our team members are in Ukraine. Same as it was for Magento btw, and for many other amazing technological solutions. What many readers perhaps do not realize is that osCommerce continues to be developed while the war is raging in Ukraine.  For example, the final touches to version 4 were made in the evening, while air raid sirens were wailing in many locations in Ukraine where our colleagues are located. We would like to once again express our appreciation and applaud the strong spirit of our colleagues who managed to complete their task (be it with a delay) and release osCommerce 4.0! Those men and women who continue to work hard on adding more features, enabling the App Shop, fixing those teething problems that users of osCommerce report to us. We are working hard to release more features and solutions, and will be updating you in due course! ...
post item
osCommerce v4 release
July 25, 2022
osCommerce 4 released today ...
post item
osCommerce Roadmap
July 25, 2022
Read more about osCommerce Roadmap ...
post item
osCommerce is dead... Long live osCommerce!
July 25, 2022
How osCommerce started, became extremely popular, went into decline and almost died... And was re-born and is being launched today on the way to success! ...
Products

osCommerce Online Merchant v2.3.2

osCommerce Online Merchant v2.3.2 is a security improvement release which improves the customer password forgotten routine and generation of random strings.

Previously, the customer password forgotten routine would automatically generate a random password and e-mail it to the customer. The code was based on tep_create_random_value(), the PHP mt_rand() function, and a weak seeding of the random number generator. Now, tep_create_random_value() uses Phpass' stronger get_random_bytes() method to generate random strings, and the customer password forgotten routine e-mails a personal link to the customer and gives them 24 hours to change their password. If they do not, they can continue to use their existing password and their personal password reset link is discarded.

The customer password forgotten routine is also now protected with a new Customer Password Reset Action Recorder module which, by default, limits the generation of personal password reset links to once every 5 minutes.

Changes

The following changes are included in this release:

  • Changed customer password forgotten feature to e-mail a personal link to the customer where they can change their password up to 24 hours, instead of directly changing the password to a random string and e-mailing it to the customer.

    Added new password_reset.php page to manage personal password reset links.

    Added new ar_password_reset.php Action Recorder module to log and limit the request of personal password reset links to once every 5 minutes
  • Improve logic of tep_create_random_value() by using Phpass' random number generator.

    If function parameter $type is not 'mixed', 'chars', or 'digits', return a 'mixed' string instead of false.
  • Add openssl_random_pseudo_bytes() and mcrypt_create_iv() to Phpass' get_random_bytes() class method. These are used if /dev/urandom is not available.
  • Only seed the random number generator if PHP < 4.2 is used.

Upgrade from v2.3.1 to v2.3.2

A detailed upgrade guide is available online at:

https://forums.oscommerce.com/page/docs/_/oscom/23/release-notes-v2/oscommerce-online-merchant-v232-r12

Download

Full and Update Packages of osCommerce Online Merchant v2.3.2 can be downloaded at:

https://www.oscommerce.com/solutions/downloads

Acknowledgements

We'd like to thank Gary Burton and George Zarkadas for testing and reviewing the upgrade guide, and George Argyros and Aggelos Kiayias for bringing the issue of insecure random number generators to our attention.