X-Cart forums

[Triple A Racing]

Originally Posted by mvs

Currently, this is not a prior task. Unfortunately, this tutorial will not be included in 5.4.0.x Stable release

Being polite, somebody at XC is NOT doing their job correctly. How has 'aesthetics' suddenly jumped ahead of security over at Upgradesville?

This IS a priority task. The now infamous tutorial is only being provided in lieu of the fact that XC promised to deliver an effective CSP as part of ~/xcart/etc/config.php in XC 5.4.*.* a long time ago. Now and quite suddenly, this has NOT can NOT be delivered, purely because "...cannot add rules for 3-d party modules" (sic)

That's a very questionable excuse anyway and one that isn't given anywhere else. It's often the exact reverse in fact c/w many binding rules. The convenient, module dependency issue should have been known (if indeed it actually does exist...) back at the time the above promise was made.

A logical, albeit speculative, conclusion based on the preceding and other historical examples, is that nobody at XC has actually thought about this properly, at all. AKA "...we might get away with it..." This despite CSP being the "elephant in the room" for all paying XC5 license holders (but in fairness, some may still be unaware at this point).

People do seem to like avoiding reality on here sometimes, but where we're from, a spade is a spade, regardless of any happy, vague, PR style, PC official response that's given.

Originally Posted by mvs

Thank you for testing!

Obviously this will now be limited testing because this ^^ and several other things are not actually ready.
There's beta testing & then there's latest overnight compiled output testing. The two are vastly different.

Originally Posted by mvs

Please let me know if you find anything else

We won't be providing any feedback on colour shades or image border hues & saturation content just so we're 100% clear

[Triple A Racing]

Originally Posted by mvs

Please welcome X-Cart 5.4.0 Public Beta ~~ You’ll love the revised email notifications builder, brand-new upgrade system with one-click rollbacks, the updated webmaster mode and template editor, and many more improvements...

Our experience (so far) with the XC 5.4.0.3 public beta release:

@mvs The irksome "Trial Has Expired" notice / graphic reminder etc has arrived today, despite the previous advisory note advising that the trial period was 28 days Why this is even present in a Public Beta release anyway, is still a mystery to us, but that fact that it doesn't work properly, relates to item b) below.

a) All the items mentioned above are welcome, particularly in our case, the e-mail notification editing, and the upgrade / rollback back processes. Well done XC. Looking forward to XC 5.4.0.* becoming stable and becoming a public release.

b) There are still, minor system glitches all of which, need to be fixed before a public release. We've already PM'd you @mvs relating to a few of them but there's others too.

c) The XC approach to CSP is very poor. We summarized that in #post21 on this thread. This will not prevent the forthcoming public release of XC 5.4.0.* but, it's a security oversight / avoidance, so it does need to be fixed. Properly and quickly please, not just put in the "too hard" tray and left to fester.

d) XC 5.4.0.* was supposed to provide an Nginx only version. It didn't. This too, has no effect on the forthcoming public release of the normal Apache based) XC 5.4.0.* but it's a big opportunity wasted. The Nginx 'solution' that's been provided in this beta release doesn't work properly, well not for us anyway. We'll add a separate post on this.

Finally, an item for debate; One big XC 5.4.0.* irritation is the incessant and every increasing up-selling attempts (text / icons / graphics / prompts with links etc) that now reside within XC5. If somebody at XC doesn't quickly deal with this, there's a real danger of XC5 becoming "Bloatware". Any links to services provided by 3rd parties and/or other XC5 chargeable services / news or blog items etc could ALL very easily be changed to very short, small text notes only c/w appropriate links but presented in a much more controlled and focused manner. XC keep trying to emulate Apple in many ways, well this is a very good example of how to do it (Apple) / how not to do it (XC).

In our opinion this beta release of XC 5.4.0.3 includes up-selling items that are too big / too intrusive / unnecessary and over sold. It's like a throwback to Windows Vista but distilled down further, so that it's suitable for primary school kids. Your own opinion / experience / feedback may vary

[Triple A Racing]

Nginx - Please read these previous posts in this thread first: Post#5 & Post#6 & Post#7

After trying the XC 5.4.0.3 Apache based release first, we changed the domain that the dev store is running on, to be pure Nginx 1.14.2 OS, with no Apache OS at all and then applied the Nginx coding (the with web directory version) that's provided by XC within the supplied "nginx.conf.sample" config file. Observations / issues:

a) Initially, this would not run at all. In our case, this section was the reason:

location ~ \.php$ {
    try_files      $uri = 404;
    fastcgi_pass   fastcgi_xcart;
    fastcgi_index  index.php;
    fastcgi_param  SCRIPT_FILENAME $document_root$fastcgi_script_name;
    include        fastcgi_params;
    fastcgi_read_timeout 300s;
    fastcgi_connect_timeout 300s;
 }

specifically, the fastcgi_pass fastcgi_xcart; line.
We amended this to: fastcgi_pass unix:/run/php/php-fpm.sock; and then it did run and things improved.
For reference, we're using PHP 7.3.5 and running this via 'FPM application served by Nginx'.

The results so far are as follows:

a) We can display and login to the admin back ('admin.php' within the url) & it and works well.
b) Until... items which have 'service.php' within the url are called, in which case nothing happens at all and nothing works. Nothing.
c) This may / may not be related to the irksome "Trial Has Expired" mentioned in the previous post. Please advise XC? If it is, then....

d) We can display the store's home page c/w all graphics / menus / link etc but...
e) No other pages can be displayed. A 404 Nginx error page is provided as a result of utilizing any menu or product links.
f) This time, this is definitely not related to any irksome "Trial Has Expired" coding.
g) This is the XC provided Nginx coding being mis-configued, either, by XC by default, or, as part of the applied setup on our sever.

Our previous comment in Post#19 "...we still think this is just a stick-on Nginx 'plaster' as opposed to being a pure, well designed Nginx only version of XC5 ..." still applies.

[mvs]

Content-Security-Policy Question

No updates to post #20 so far (https://forum.x-cart.com/showpost.php?p=410784&postcount=20). I'll keep you updated about next steps.

Nginx Question

Unfortunately, we cannot create a configuration file for Nginx that would work on any server. We have only *examples* on the basis of which the administrator can configure own server.

Regarding post #23 (https://forum.x-cart.com/showpost.php?p=410819&postcount=23)
I'm not sure we can understand the problem remotely. Many of our developers are working with Nginx and X-Cart 5.4.0.x. The default LAMP stack also works well.
But all above not a strong argument I want to help, could you please provide more details, configurations files etc.

Thank you for the feedback, it helps us build a better product.

[Triple A Racing]

Originally Posted by mvs

No updates to post #20 so far (https://forum.x-cart.com/showpost.php?p=410784&postcount=20). I'll keep you updated about next steps

Thanks Max. It should have been a much higher priority than was originally given by XC, so hopefully your "catch up" exercise will resolve that.
Please don't overlook the "Feature Policy" too, which is another applied security measure, similar to the Content Security Policy.

Originally Posted by mvs

Unfortunately, we cannot create a configuration file for Nginx that would work on any server.

Yet many, many different product suppliers CAN and DO!

An easy example to illustrate this, is Plesk. The complete Plesk administrative side, is provided with a self-compiled Nginx package to run and operate this on lots of different server OS packages... Either XC should do Nginx properly (as has been suggested previously) or not at all. Providing a few guessed at, setup *examples* never has been and never will be sufficient.

Originally Posted by mvs

Regarding post #23 (https://forum.x-cart.com/showpost.php?p=410819&postcount=23)
I'm not sure we can understand the problem remotely... ~~ ...could you please provide more details, configurations files etc

No problem. However before we do, can somebody answer the far more prevalent issue that we posted, i.e. the expired trial licence? That gets in the way of everything at present and needs to be excluded from the data we provide. Do we have to download and setup another public beta release, just to fix this? Or is there a far more simple XC solution to allow competent beta testing?

[Triple A Racing]

Originally Posted by Triple A Racing

.....However before we do, can somebody answer the far more prevalent issue that we posted, i.e. the expired trial licence? That gets in the way of everything at present and needs to be excluded from the data we provide. Do we have to download and setup another public beta release, just to fix this? Or is there a far more simple XC solution to allow competent beta testing?

Not sure we could have asked a more simple question... The answer to solving the fault please XC?
The data is self explanatory & as stated previously, surely shouldn't have happened anyway on a longer time period, public beta test package?

[mvs]

Originally Posted by Triple A Racing

"the expired trial licence" question

Thank you for pointing out on this.
Here is a license key that is valid until 5.4.0.x Stable release:
XBBZ-CUXX-MCUZ-MVHW

[Triple A Racing]

@mvs After further testing, just to confirm; The expired trial licence issue (which you fixed in your last post - thanks!) is NOT a contributory factor to the Nginx failures that we posted in Post #23 of this thread. So, the resultant question you posted was "....could you please provide more details, configurations files etc" Can you be more specific? You've read that post and can see our forum sig, but please tell us exactly what extras you need and we'll supply everything. Maybe you could raise an XC Helpdesk ticket or a bug ticket (if it involves considerable data / privacy issues etc) and then we could then easily reply to that / upload there. Thanks!

[Triple A Racing]

Originally Posted by Triple A Racing

@mvs After further testing, just to confirm; The expired trial licence issue (which you fixed in your last post - thanks!) is NOT a contributory factor to the Nginx failures that we posted in Post #23 of this thread. So, the resultant question you posted was "....could you please provide more details, configurations files etc" Can you be more specific? You've read that post and can see our forum sig, but please tell us exactly what extras you need and we'll supply everything. Maybe you could raise an XC Helpdesk ticket or a bug ticket (if it involves considerable data / privacy issues etc) and then we could then easily reply to that / upload there. Thanks!

So.... several days have elapsed, but still no reply....
This thread; X-Cart 5.4.0 Public Beta is out, is supposedly here, for XC to gather feedback from paying end users.
Should it have the suffix "...but we'll only reply if... we like the feedback given..." appended to its title?
This is why posts like THIS ONE make perfect sense

[kevinrm]

My cart (5.3.6.2) is asking me to upgrade to 5.4. I'm getting this warning:

"Upgrade not allowed
X-Cart v5.4 requires MySQL version 5.7.7 or better. Please update the MySQL version installed on your server before you proceed."

However, I have the latest MySQL Maria 10.3 version. That's the latest available, right? This won't upgrade with Maria 10.3?