Zen Cart v1.5.0 BETA release now available

We are pleased to announce that the Zen Cart v1.5.0 BETA is ready for poking and prodding. We do expect it that it may have some bugs ... that's why it's a BETA.

As with any BETA software, DO NOT USE ON LIVE SITES!!!

Why BETA?
This BETA release has a two-fold purpose:
- identify any major bugs which can be fixed before final release
- allow add-on authors a head-start to update their add-ons for compatibility

It is also intended to bridge some time between PA-DSS certification submission and completion of final certification steps.

How Long Is The BETA Period?
The BETA period will last until the development team deems that major bugs are identified and handled and/or the PA-DSS certification process is complete. This might mean a few weeks, or many weeks.

Support
We will evaluate *real* bugs and provide support for those issues as appropriate.
We will also provide support for features added in this release; however, please read the supplied documentation since most questions will already be answered there.
We WILL NOT provide support for problems you encounter on your LIVE site using BETA software. Any problems, even emergencies, which you encounter while using BETA software on a LIVE website are your own responsibility. DO NOT USE BETA SOFTWARE ON LIVE SITES!

Reporting Bugs
REAL bugs specific to v1.5.0-BETA should be posted as New Threads to the Bug Reports ( http://www.zen-cart.com/forum/forumdisplay.php?f=140 ) section of the forum. Please check existing posts first, and don't post duplicates. If your issue is identical to an existing real bug, reply to that post with any additional information you can add. "Me too" posts with no additional information are not so useful. Please post as much DETAIL as possible so we can properly evaluate each report.

Discussion About Listed Changes in v1.5.0-BETA
A number of features were changed in v1.5.0-BETA. Many of them related to enhancing security and admin access controls. The list of these changes is posted below.
A forum section http://www.zen-cart.com/forum/forumdisplay.php?f=156 has been opened for discussion about changes found in the changelog for v1.5.0-BETA. This is NOT a place to request new features! (There's a Features Wish List area of the forum for that.) PLEASE READ THE EXISTING DISCUSSIONS BEFORE POSTING. Duplicates and "me too" posts make it hard for both you and others to sort through the information.

MINIMUM REQUIREMENTS
Zen Cart v1.5.0BETA requires the following minimum server configuration:
- PHP 5.2.14
- MySQL 4.1.3
- Apache 2.0
- Apache configured with AllowOverride set to either 'All' or at least both 'Limit' and 'Indexes' parameters, and preferably the 'Options' parameter as well.
- PHP configured to support CURL with OpenSSL

Documentation
The Zen Cart Implementation Guide can be found in the /docs/ folder. This manual contains instructions on installing and securing your site in a manner consistent with PCI requirements. It also contains references to other documentation already found in FAQ/wiki articles where appropriate. IT IS IMPORTANT that you follow the recommendations in this guide as part of your own PCI compliance process. (Remember: DO NOT INSTALL BETA SOFTWARE ON A LIVE SITE!)

Documentation on the new admin access controls can be found in section 8.3 and 8.4 of the Implementation Guide.

Documentation on the Admin Password changes required by PA-DSS can be found in section 8.2 of the Implementation Guide.

Documentation on coding changes required in admin modules can be found here: http://www.zen-cart.com/wiki/index.p...velopers-notes

List of new features can be found in the /docs/whatsnew_1.5.0.html file in the v1.5.0-BETA zip file. The issue-changelog is also posted below.

PCI/PA-DSS Certification Steps For A Store Owner
This Zen Cart code has been submitted for PA-DSS certification.
THIS IS A BETA RELEASE, SO SHOULD NOT BE USED ON A LIVE STORE, AND IT IS NOT APPROPRIATE TO USE THIS SOFTWARE VERSION FOR YOUR PCI CERTIFICATION.
Once certification is completed, appropriate documentation will be posted to explain what part the Zen Cart certification plays in your own PCI Compliance process, including what boxes to check on your self-assessment questionnaire, etc.

How Do I Get It?
The v1.5.0-BETA zip can be found here: Updated to fix:
- admin/installer password rules to now accept symbols
- admin login timeout more friendly, remembering where you were when expired
- numerous admin pages updated to fix a form generation issue --- MANY CORE FILES ALTERED HERE!
- misspelling of Zurich which appears to have survived many years without detection
- add text to explain admin user password requirements in installer and admin reset page

UPDATED zip: zc-v1.5.0BETA-08022011.zip
MD5: 9296B096A390298990CBB865AE0925A4
SHA1: E62E95D5B143065190400B3199A987E5B105FC6E
Use the MD5 or SHA1 checksum shown to verify file integrity: https://www.zen-cart.com/tutorials/i...hp?article=405

NOTE: THE LATEST ZIP CAN BE FOUND IN THE LAST POST IN THIS THREAD ... which may be on the next "page" of posts ...

The following improvements and bugfixes are included in v1.5.0beta since v1.3.9:
-CHANGE-12 - Numerous system changes to support PA-DSS compliance certification
-- Admin passwords now expire every 90 days, as per PA-DSS specification
-- Admin passwords now require a combination of letters and numbers, as well as uniqueness (cannot use already-used passwords)
-- Admin passwords can have a configurable length, but no less than 7 characters
-- Admin passwords also expire, for security reasons, when changing admin configuraton from non-SSL mode to SSL mode.
-- Admin Profiles - is now built-in, with a significant number of additional features, and simpler to use.
-- Add basic admin Activity Log Viewer/Exporter tool
-HTMLarea editor removed from core due to obsolescence. Use preferred plugin instead if similar functionality is required.
-FCKeditor components removed from core due to obsolescence. CKEditor is the replacement editor by the same author. Switch to the new plugin if desiring to use this editor.
-USPS module removed from core in favor of being an addon, due to the volatility of frequent changes made by USPS. The addon is available in the Free Addons section of the Zen Cart website.
-CHANGE-12 - PA-DSS - prevent payment modules from ever storing more than 10 characters of sanitized CC numbers
-CHANGE-12 - PA-DSS - prevent built-in "gateway" payment modules from functioning if the site is not protected by SSL
-CHANGE-12 - PA-DSS - add admin detection of SSL mode change and auto-expire all passwords if SSL mode is enabled either with ENABLE_SSL_ADMIN or using an https address for HTTP_SERVER
-CHANGE-12 - PA-DSS - add two-factor authentication hook in admin login
-zc_install now treats supplied initial admin password (during install) as temporary ... requiring the admin user to select a new password at first login. This is to prevent abuse from password sniffing.
-Incorporate TZ (timezone) support, with ability to override/disable simply by defining a DISABLE_MYSQL_TZ_SET constant. c/f http://www.zen-cart.com/forum/showthread.php?t=174346
-PADSS-30 - Admin SSL now enabled by default in configure.php file if Enable-SSL is selected during zc_install
-BUGSFORUM-1774 - Add 'secure' flag support for session cookie when site is running entirely in SSL
-BUGSFORUM-1081 - Fixed: no default set for shipping radio buttons if module is disabled after previously selecting a shipping method
-BUGSFORUM-1347 - Remove file-based session handling support due to security concerns and chicken/egg situation caused by garbage collection processes.
-BUGSFORUM-1497 - Admin order totals section of orders.php page ignored currency-formatting display rules in some cases
-BUGSFORUM-1550 - Fix occasional problem with "duplicate entry" in sessions table caused by some servers using longer session ID keys
-BUGSFORUM-1558 - typefilter incorrect lookup problem in case of (unlikely) file-not-found scenario
-BUGSFORUM-1554 - Shopping Cart Problems when updating product quantities for products with Max limit set
-BUGSFORUM-1564 - orders_status wrongly set to 0 in rare cases
-BUGSFORUM-1584 - no_picture.gif could be accidentally deleted if specified as an actual product image
-BUGSFORUM-1589 - Fixed problem with some downloadable orders where an update of an order might set the number of days to a wrong value
-CHANGE-151: Fix rounding and tax calculation issues in Cart/Order Class
-CHANGE-90 - SECURITY: Fix Local File Inclusion Vulnerability
-Whos_online - several improvements to allow the option to exclude spiders and/or admin IP's from the list of displayed results
-Improvement: Developers Toolkit can now optionally search .js files too.
-CHANGE-136 on new installs, DB_CHARSET now defaults to UTF8, not latin1
-CHANGE-137 Removal(deactivation) of CDE payment modules when SSL disabled
-BUGSFORUM-1592 - Fix rounding problems affecting coupon min-purchase eligibility calculations
-CHANGE-70 - zc_install now checks whether .htaccess rules will work, and provides an alert if there's a problem.
-BUGSFORUM-XXXX - PayPal improvements - allows Transaction ID to show on admin order confirmation emails for WPS, just like other payment modules do
-BUGSFORUM-XXXX - PayPal - partial fix for bug where currency code not specified during partial refunds causes request to fail
-BUGSFORUM-XXXX - PayPal - fixed bug where debug logging might happen even if switched off (caused by broader server-config issues)
-BUGSFORUM-XXXX - PayPal - fix bug in Express Checkout where a shipping-override would still send a shipping phone number, causing a 10001 error without explanation.
-BUGSFORUM-XXXX - PayPal - fix bug where EC button was removed from login page but left PayPal text prompts, resulting in confusion.
-BUGSFORUM-XXXX - PayPal - fix various rounding problems in all modules
-BUGSFORUM-XXXX - PayPal - Change to VPS-Timeout-90 instead of 45 at PayPal's request. This means customers might have to wait longer for transactions to complete, but will reduce timeout errors when PayPal's systems are slow.
-BUGSFORUM-XXXX - PayPal - include product ID number on line-item details since is needed for order fulfillment
-BUGSFORUM-1673 - PayPal - Fix minor html table syntax bug in paypal history details on admin orders screen
-BUGSFORUM-1760 - PayPal - Fix problems with Hungarian Forint and other 0-decimal currencies
-BUGSFORUM-1926 - PayPal - Fix problem with attributes -- if a product had attributes, the product name was being replaced with attribute details, instead of being appended to
-BUGSFORUM-1971 - PayPal - Trap cases where PayPal returns a blank address unexpectedly, and ask them to supply address details by creating an account
-BUGSFORUM-1971 - PayPal - Minimize address matching issues which arise when storeowners rename their countries to non-ISO standard names (something they should not do)
-BUGSFORUM-1892 - PayPal Express: Item details were shown as "Tax included in prices: 0 (0)"
-BUGSFORUM-1959 - PayPal IPN and Express Checkout Missing free Items, or listing free items without description
-BUGSFORUM-2024 - PayPal IPN - address-override alert might insert duplicate update notices in order status history
-BUGSFORUM-1613 - Media Manager Assign to Products wouldn't allow assigning of new products due to security change in 1.3.9h
-Fix to admin customer search: search for new customers by customers_email_address to get correct customer and not everyone named Smith
-Fixed display bug with category icons generating link to cPath=0 if cPath not set
-Fix the display of Discount Coupons when a redemption code is applied so it is more readable by the customer
-Fix Add to Cart to stay on listing when set to not display cart
-Fixed coupon admin screen to land on correct page after adding new coupon
-Various Admin pages: Fix pagination problems when changing status, searching, etc.
-Improvement: Shorten CPU cycles on double-parsing an array needlessly in Authorize.net modules. Also improved sanitized debug output.
-BUGSFORUM-1645 - Adding Featured Products ERROR Warning Warning: Product ID already on Special
-Admin products-to-categories copier: Add additional message for clarity when Copy to categories_id is invalid but allow for obscure usage
-Fixed bug on Order History going to page not found when set to not display cart
-Fix: restore shopping cart products in the order they were added
-BUGSFORUM-1662 - Gift Certificates Will Not Release
-Fixed Error message when restricting coupons
-Fixed hard-coded table names which should have been using constants, to allow for prefixes properly.
-Fix problems with the word "search" in spiders.txt
-Admin orders page now passes unformatted value back for availability to customizations which want to redisplay the values differently.
-BUGSFORUM-1696 - clear COUPON_GV_QUEUE when deleting an order
-BUGSFORUM-1681 - fix links in GV mails
-BUGSFORUM-1689 - email validation regex improvements
-BUGSFORUM-1634 - Bugfix: Prevent loading of non-PHP files in some admin autoloading routines
-BUGSFORUM-1650 - sanitize whosonline output
-Downloads - improvements and addition of support for IE9
-BUGSFORUM-1708 - Combine class methods to reduce chance of race conditions and add error suppression to filemtime
-Fix potential GZIP error if server configuration is overly generic
-CHANGE-74 Sanitization
-VARIOUS changes made to admin/catalog page forms to protect against CSRF using security token
-VARIOUS changes for date fields to be handled consistently and to remove some pre-quoting which was breaking bindVars
-CHANGE-102 Fix broken error checking in SQLPatch tool
-CHANGE-128 obscure sql injection fix
-CHANGE-135 add default value to zen_draw_pull_down_menu call to stop the value being drawn from the GLOBALS array and tested as a string.
-CHANGE-138 Set CURL Proxy Status to FALSE by default, and remove from display since it's now deprecated
-CHANGE-139 fix sprintf() error when generating an outgoing email notification caused by language file refinement
-CHANGE-142 fix tax calculation
-CHANGE-143 fix sidebox query to ensure a correct limit statement is built, if necessary
-CHANGE-143 catch SQL errors and output generic message to user and write message to log instead
-CHANGE-144 XSS mitigation for admin forms -- adds logging for inputs flagged as "rogue" by blacklist algorithm.
-CHANGE-145+146 Blank values for various Maximum Values settings causes PHP errors
-CHANGE-147 zc_install was throwing warning for MySQL versions over 5.2
-BUGSFORUM-1709 Fix extraneous products_id in url
-BUGSFORUM-1783 Fix Virtual Product defaults for all core Product Types
-BUGSFORUM-1798 Preview icon was linked directly to product-general type. Now linked to the product type handler, allowing correct language defines to be loaded when previewing a product via this icon.
-BUGSFORUM-1862 status filter not retaining state, restrict to first char for safety
-BUGSFORUM-1754 change to calculate price/tax on zen_round(zen_add_tax(price,rate)*quantity, decimals)
-BUGSFORUM-1696 SQL error due to non-matching field name
-BUGSFORUM-1907 Fix ambiguous description on admin search switch
-BUGSFORUM-1905 Adjust schema to handle ipv6 addresses
-BUGSFORUM-1949 various ISO country updates
-BUGSFORUM-1973 Downloads might deliver an empty file if readfile() is disabled in PHP and symlink support is off
-.htaccess - add safety around apache directives to prevent errors with poorly configured servers
-Fix bug in properly detecting SSL mode with zen_redirect calls
-Addressed SSL logoff scenario specific to shared SSL on shared hosting.
-Fix email error handling - was only setting error info if the message succeeded, thus always blank.
-Fix broken markup in admin layout-controller
-add extra line-break before "spam" disclaimer in email footers
-Disable language/currency sideboxes by default, to minimize some confusion
-Fix some collation errors encountered during upgrades
-And all the security fixes and bugfixes from prior versions

ISSUE FIXED: http://www.zen-cart.com/forum/showthread.php?t=183641 - Template selection problem. Zip link updated.

Updated to fix:
- admin/installer password rules to now accept symbols
- admin login timeout more friendly, remembering where you were when expired
- numerous admin pages updated to fix a form generation issue --- MANY CORE FILES ALTERED HERE!
- misspelling of Zurich which appears to have survived many years without detection
- add text to explain admin user password requirements in installer and admin reset page

New zip: zc-v1.5.0BETA-07282011.zip
MD5: 471F02006FA70DEB376ADE01359FF08C
SHA1: D7945D39138418F2C58F8D07667733875B2B2578

Updated to add alt_nav fix and to put the implementation guide file back into the zip (it was missed in the 0728 zip).

New zip: zc-v1.5.0BETA-07292011.zip
MD5: 14ECC41DA6D09A8D174D912C83925BC8
SHA1: 0A6DB479331D5948DA6C07C41037AEA5B25BD2A0

Updated:
- fix SQL blob error on upgrade/install
- admin profile names can be edited while in edit mode
- email validation issue
- fix iso country code url

UPDATED zip: zc-v1.5.0BETA-08022011.zip
MD5: 9296B096A390298990CBB865AE0925A4
SHA1: E62E95D5B143065190400B3199A987E5B105FC6E

Updated:
- fixed admin edit screens so that entities like € and & survive edits instead of being converted by the browser to literal symbols (THIS AFFECTS NUMEROUS ADMIN FILES ... THUS ADDONS ARE QUITE LIKELY TO BE AFFECTED)
- Refinements to support proposed changes in PHP 5.4 alpha releases
- small updates to the implementation guide and typos in language files


UPDATED zip: zc-v1.5.0BETA-08082011.zip
MD5: F8E21115FF6AB93FC4B48DE040376657
SHA1: CFF9BC4F0E5BE0ABB16F33685AE8F0AB3B3CBF5F

Updated:
- fixed customer-delete bug in admin
- fixed customer-telephone-validation bug in admin
- finished removal of email_welcome_preview removal ... menu options had been left behind

zc-v1.5.0BETA-08162011.zip
MD5: 37E5C7F9B693DBE06B3E4A210F40781E
SHA1: B4F9399B045587D194383088BD878EE04CBD798E

Updated:
- Changes to admin configure.php file to prevent the need for editing the file when renaming the admin folder. Now just need to rename the admin folder, no edits required! (NOTE: May have a few glitches ... feedback requested)

- 141406: Missing pmt id when only one payment method
- Fix admin HTML edit problem on media page
- Fix unclosed input tag
- SecurityToken typo
- Add notifier for adding extra info into admin order email
- Attributes: Fix Text Required to allow for 0 to work as Required Text content
- Helper function for de-registering admin pages from access control
- Fix Maximum limit to manage merge of cart on login

UPDATED ZIP: zc-v1.5.0BETA-08242011.zip
MD5: B62D1E5F03B663DEF64A36C116BECA77
SHA1: 8A1B519C267CD51AD03FC1F60351BE6626AB914B

Updated:
- fixed a bug in the admin configure.php from last update which caused problems on shared SSL servers
- fixed a problem with admin folder rename notification screen

Updated zip: zc-v1.5.0BETA-08282011.zip
MD5: 71C37D2B7DAD20BF58EEAABA38FEDB1F
SHA1: 9FD81AA39816033159506FEB53E4D80195749E30

Updated:
- fix bug with deleting orders in admin
- fix broken link on activity-log warning message
- fix broken link in installer help text
- fix zone misspellings
- further sanitization to mitigate false-positives in overzealous pci scanners
- fix loopback problem with admin alert screen
- adjustments to account for shared SSL easier
- fix broken $sql var in mfg query
- updates to implementation guide

Updated zip: zc-v1.5.0BETA-09192011.zip
MD5: AE50095A04FA52F0A5F848F1101A072D
SHA1: 9A5843E937C071320A470F89EF4653D027EDFFC6

Updated:
- Change breakpoint for loading admin page functions to allow for plugin authors having easier installation code
- stripslash keyword in first parsing of search keywords, to protect against broken sql
- fix minor Warning: strlen() expects parameter 1 to be string
- documentation html/pdf updates
- improvements to dist-configure.php and admin configure.php files
- fix problem with delete-orders
- activity log reset was pointing to wrong page
- zc_install updates to code and help text

Updated zip: zc-v1.5.0BETA-10072011.zip
MD5: A9F6FD7CBD5F1E1D72CFE71B2CC46001
SHA1: 9A2C21D4697E53E69884C668860AC1BF51F59A6C

****UPDATE: PLEASE USE THE LATEST Release Candidate ZIP INSTEAD
http://www.zen-cart.com/forum/showthread.php?t=187524