X-Cart 4.0.16 released

svowl · #1 09-21-2005, 08:25 PM

X-Cart 4.0.16 is now in your File area along with the upgrade kits that will take you from X-Cart 4.0.15 to 4.0.16

Here is the changelog:

Quote:

-----------------X-CART v4.0.16 RELEASED

Wed Sep 21 10:20:00 MSD 2005 [!] - svowl - Bug: ESD products did not turn into ordinary products after 'Egoods' module was disabled. Fixed.

Mon Sep 19 11:12:30 MSD 2005 [!] - max - Bug: A news message was not displayed in the customer front end if the corresponding news wasn't marked as 'Available for subscription'. Fixed.

Mon Sep 19 10:43:11 MSD 2005 [!] - max - Bug: Products from disabled categories could be found via product search. Fixed.

Mon Sep 19 09:32:52 MSD 2005 [!] - max - Bug: The body of an e-mail message sent via the 'Contact us' form got corrupted if the customer filled the form using quotes (additional fields). Fixed.

Thu Sep 15 17:17:28 MSD 2005[*] - mclap - Improvement: SQL error logging is improved: more details (QUERY_STRING, remote IP etc) are added.

Thu Sep 15 14:30:58 MSD 2005[*] - mclap - Security of the payment/smartpag_return.php script is improved.

Tue Sep 13 19:11:51 MSD 2005 [!] - max - Bug: The order totals were not recalculated after administrator deleted some product and right after that clicked on the 'Save' link (X-AOM). Fixed.

Tue Sep 13 17:21:41 MSD 2005 [!] - max - Bug: A user could not be edited by administrator ('User modify' page) if the user's login contained a '&' symbol. Fixed.

Tue Sep 13 16:50:35 MSD 2005 [!] - max - Bug: An order that got declined by LinkPoint could be accepted by X-Cart because of an error in parsing of some types of the LinkPoint server responses. Fixed.

Tue Sep 13 16:18:33 MSD 2005 [!] - max - Bug: The message 'Error: Your cart was lost' was displayed after submitting an order via 'Protx VSP Form' payment module if 'order prefix' field ('Protx VSP Form' settings page) contained special symbols (#, etc). Fixed.

Tue Sep 13 15:42:28 MSD 2005 [!] - max - Bug: If the option 'Redirect customer to cart' was turned off, and a customer added some product which had product options to the cart from the HTML-catalog by using the 'Buy now' button, the customer got an 'Access denied' page instead of being redirected to the product details page. Fixed.

Tue Sep 13 15:07:00 MSD 2005 [!] - svowl - Bug: The cart was not saved for a registered customer when he added some products to the cart (with the option 'Redirect customer to cart' disabled) and logged out before he came to 'Your cart' page. Fixed.

Tue Sep 13 13:50:00 MSD 2005 [!] - svowl - Bug: The product subtotal was not displayed correctly in the cart details table during the checkout process. Fixed.

Tue Sep 13 12:04:17 MSD 2005 [!] - max - Bug: A product with defined product variants and a product option in the form of a custom text field could not be added to the cart (or wishlist) if the customer added a single quote to the text of the product option. Fixed.

Tue Sep 13 10:44:00 MSD 2005 [!] - svowl - Bug: Administrator with 'Fulfillment staff' membership was able to access the scripts hidden from him by entering the script URLs directly into the browser address line. Fixed.

Fri Sep 09 16:44:08 MSD 2005 [!] - max - Bug: The wrong referred sales statistics was displayed in the admin area (X-Affiliate). Fixed.

Thank you.

svowl · #2 09-22-2005, 12:05 AM

The main reason why we released 4.0.16 so soon after 4.0.15 is two minor security issues described in the CHANGELOG:

Quote:

Thu Sep 15 14:30:58 MSD 2005[*] - mclap - Security of the payment/smartpag_return.php script is improved.

Tue Sep 13 10:44:00 MSD 2005 [!] - svowl - Bug: Administrator with 'Fulfillment staff' membership was able to access the scripts hidden from him by entering the script URLs directly into the browser address line. Fixed.

Detailed information on these issues will be provided today via newsletter; patches are available for downloading from the File area of Help Desk (Updates/security-patch-2005-09-22.tgz).

donavichi · #3 09-22-2005, 01:05 AM

how cool would it be to be able to terminate a user's session via the admin control panel!
When you use tracking software on your site and can see where the live visitors are going, whether it's sales and stats or another program, you often see people doing strange things and are open to all manner of abuse, potentially.
If you could bin the user's session and then block the ip address, it would warn dodgy visitors off and allow you greater protections from spambots and nasty robots!