Zen Cart v1.5.5f released!
NOTE: SCROLL DOWN TO THE MOST RECENT POST BELOW FOR THE LATEST UPDATES!!!
After much community contribution, the v1.5.5. release is ready. Thanks to everybody for the feedback and help with testing and coding.
Download available here: http://sourceforge.net/projects/zencart/files/
Minimum Requirements
Zen Cart v1.5.5 requires a minimum of the following:
- Zen Cart v1.5.5 is compatible with PHP 5.2.10 through PHP 7.1, and MySQL 5.1 thru 5.7
(Note: PHP versions older than 5.6 are deprecated and no longer supported by PHP ... You REALLY should be using PHP 5.6 as a minimum, for both security and speed benefits.) - MySQL 5.1 - 5.7
- Apache 2.2 - 2.4
- Apache configured with AllowOverride set to either 'All' or at least both 'Limit' and 'Indexes' parameters, and preferably the 'Options' parameter as well.
- PHP configured to support CURL with OpenSSL
- Server's CURL and OpenSSL configured to use the latest modern TLS capabilities (particularly TLS 1.2 is quickly becoming mandatory)
While Zen Cart can run on Windows/IIS servers, Linux/Apache servers are recommended for best results, superior performance, and easier use by shopowners.
CHANGELOG - List of Changed Files
For a list of files that have been changed since v1.5.4, see the changed_files-v1-5-5.html document, located online or in the /docs/ folder of the downloaded zip.
What's New In v1.5.5:
The most notable improvements and bugfixes in v1.5.5 since v1.5.4 include:
- All known v1.5.4 bugfixes and security fixes are included in v1.5.5, including tighter control around XSS as well as clickjacking
- Template: The default out-of-the-box template (called "Responsive Classic") is now a mobile-friendly responsive-design theme built for flexibility with tablets, mobile devices, and desktops.
- Template: The core template_default files have been reviewed for HTML5 compliance, and a number of classes and IDs have been added to move older styling to CSS instead. Specific input-types like email/telephone for easier use on mobiles
- Admin: Admin menu improvements to help it fit tablet screens better
- Admin: Added customer-password reset via Admin
- Admin: Products Price Manager: Added display of taxes into prices
- Admin: Improvements to developers-toolkit and whos-online
- SEO: Numerous updates to canonical-url handling
- SEO: Added hreflang markup for better indexing of multilingual sites, and other HTML page-header metatag improvements
- Checkout: Order Details added to Checkout-Success page
- Payment: PayPal Express Checkout has numerous updated compatibilities added, including their latest InContext mobile support
- Payment: Added SagePay Form payment module (for hosted offsite PCI compliant credit card processing)
- Payment: Added First Data Hosted Checkout Payment Pages (Global Gateway e4) module (for hosted offsite PCI compliant credit card processing)
- Payment: Retired obsolete Linkpoint_API payment module (replaced by the new Payeezy JS module)
- Payment: Added Payeezy JS (First Data/Global Gateway e4) Payment module (for onsite PCI compliant credit card processing)
- Core: Added PHP 7.0 compatibility
- Core: Added MySQL 5.7 compatibility
- Core: Improved error-logging for troubleshooting (included @lat9's debug-backtrace mod)
- Core: Improved/simplified code for db query handling, allowing simple foreach() iterations instead of requiring while(!EOF) loops,
- Core: Added hooks to allow for 3rd-party-handling of taxes, for plugin support with orders, attributes, and much more
- Core: Fix some rounding errors
- Core: Added cron code for automated currency-updating, and currency sources can be selected from Admin->Config->My Store menu, and plugins can auto-show in this list
- Core: Fixed bug with a race condition causing database errors related to sessions
- Core: Simplified the configure.php file contents significantly by retaining only the most-often-customized components, and added an automatic-converter as part of zc_install's initial inspection
- Email: Integrated @lat9's "common CSS styling" for HTML emails
- Email: Added newer phpMailer integration (better compatibility with more email services), and email-failure errors are logged to /logs/ for easier debugging if problems occur
- Some language-file cleanups
- Improved compatibility for payment/shipping modules and SSL/TLS to work with the 2016 SHA-256 Secure Server initiatives being embraced by modern hosting companies and PCI Compliance
- Rewrote zc_install - fresh new look, will make future internal maintenance easier
- Replaced phpBB integration with generic hooks to allow for various external forums
- Security patches for alerts provided from various security watchdog sites
- ... and numerous other small improvements to make things work faster, sleeker, smarter and be easier to use
UPGRADE NOTES
How To Upgrade A Zen Cart Site
The way DrByte does upgrades is described in this blog post: http://www.zen-cart.com/entry.php?3-...d-of-upgrading
Important Note about CONFIGURE.PHP file changes for v155!
The contents of configure.php have changed (to be simplified) ... and they're MUCH SMALLER now!
The dist-configure.php shows the simplified contents, and zc_install will generate the leaner files (when doing fresh installs).
Also, zc_install will upgrade your configure.php files to the new format as long as the files are writable by your server's PHP.
A NOTE ABOUT THE NEW TEMPLATE
While Zen Cart(R) v1.5.5 contains a newer "responsive_classic" template, we STRONGLY recommend that upgraders first upgrade the site using everything (including template_default) except the responsive_classic template contents.
Then once the upgraded site is working properly you can consider what changes you might want to make to your own active template.
(Important notes about template_default are shown below)
AGAIN: The responsive_classic template should NOT be implemented immediately as part of an upgrade; it should be a separate step ... if it is even used at all. IT IS NOT NECESSARY TO USE responsive_classic ON YOUR EXISTING SITE, AND YOU SHOULD UPGRADE THE REST OF YOUR SITE FIRST BEFORE ATTEMPTING TO CONVERT/ADAPT IT TO YOUR USE.
Notes about changes to TEMPLATE_DEFAULT
UPGRADERS SHOULD BE SURE TO UPDATE BOTH template_default AND YOUR CUSTOM TEMPLATE as described here:
In Zen Cart the template_default directory contains the master copy of all storefront page templates. The normal procedure for customizing template files for use in your own personalized template is to make a copy of the corresponding file from template_default, put it into your own template folder (and matching folder structure), and make your customizations in that copy of the file. This way the only files you need in your personalized template folder are those that you have altered in some way from template_default.
With that explained, it is important that whenever you upgrade your site, you should also inspect ALL the template_default files to determine which changes in those files need to be replicated in your customized files.
Often a tool like Beyond Compare or Araxis Merge or GnuDiff can be helpful for this. The process is simple: compare the template_default directory files from your *old* version against the template_default files in the *new) version, and use those results as a reference to copy those updated changes into each of the files you've customized in your custom/personalized template in your store.
Then, and only after you've done all those comparisons and updated your customized files in your custom template folder, you will copy the template_default files from the new version into the template_default directory of your store. This way you'll be left with updated personalized files *and* updated template_default files.
Changes in template_default for v1.5.5
The template_default files previously had a lot of old <table> markup to specify widths, cell borders and padding and spacing. These have been removed in v1.5.5 and relevant styles added to the bottom of the main stylesheet.css file. You will want to add the updated CSS parts to your own stylesheet if your custom template still uses those tables. (A few 3rd-party templates have aggressively ripped out various tables and may not be affected by this change.)
A few CSS changes were made in template_default to change IDs of repeating elements to be classes instead. Of note #cartDisplay is now .cartDisplay, and #cartImage is .cartImage
NOTE:
Many people have asked about the "missing ?> at the end of some PHP files".
This is INTENTIONAL, and explained here: http://www.zen-cart.com/content.php?271
It is NOT an error in the files or the download.
Also a huge thanks to Anne at Picaflor-Azul for preparing the new Responsive Classic template and for Raymond Barbour of zcadditions.com for the DIY responsive components driving it.
Zen Cart v1.5.5a released!
We're pleased to announce the release of v1.5.5a today!
Download available here: http://sourceforge.net/projects/zencart/files/
What's different in v1.5.5a vs v1.5.5?
Since the first iteration of v1.5.5 on 17-March-2016, the following changes have been applied to become v1.5.5a ...
- All the issues-to-date from Known bugs and fixes in v1.5.5, many of which are included in the following list:
- Fix several upgrade-related problems caused by zero-dates in the customers table data/history
- Revamp admin sanitization code to work better with various plugins such as Edit Orders, etc
- Admin orders page had some incorrect CSS classes specified
- Admin customers page had some incorrect HTML tags for span and bold markup
- Admin "Support" link restored to navigation menu
- Admin - fix privilege escalation vulnerability
- Fix missing SEARCH_DEFAULT_TEXT, ERROR_GV_CREATE_ACCOUNT and TEXT_PRICED_BY_ATTRIBUTES language defines
- The zc_install test for availability of SSL and .htaccess could fail due to timeouts when offline
- The zc_install "configure.php file update" was not always handling conversion of old SSL URLs properly
- Fix "uninitialized string offset" error in zen_random_name()
- Fix sort-order of shipping/payment modules when sort-orders are multiple digits
- Responsive Classic: Fix alignment/display of State Dropdown element on address pages
- Fix to inability to choose from address-book during checkout, and fix double "continue" buttons on same page
- Order comments flag was showing incorrectly on PayPal EC transactions
- Restore define for DIR_WS_HTTPS_ADMIN for legacy plugin purposes
- Added several .gitignore files in various folders, to help site developers avoid committing unnecessary files to version control
- For language-specific currency overrides, fix the default
- Fix bindvars to honor string entries that contain 'null'
- add safety to fmod_round
- Fix extra breadcrumb that was appearing when always-open-with-category is enabled
- Update BOC currency parsing to cope with their data changes and division-by-zero errors as a result
- Fix a test-mode bug in Authorizenet AIM module
- No database changes required.
Upgrading from v155 to v155a is simply a matter of replacing some files (or merging your customizations with those files). The list of changed files is here: https://www.zen-cart.com/docs/change...5-5.html#v155a
As always, any additional critical issues will continue to be posted at Known bugs and fixes with v1.5.5
Zen Cart v1.5.5b released!
We're pleased to announce the release of v1.5.5b today!
Download available here: http://sourceforge.net/projects/zencart/files/
What's different in v1.5.5b vs v1.5.5a?
Since the release of v1.5.5a on 5-May-2016, the following changes have been applied to become v1.5.5b ...
- Fix Chrome browser javascript incompatibility
- Several fixes to the Admin Sanitizer rules, to stop translating special characters to html entities unexpectedly
- Fixes from Known bugs and fixes with v1.5.5
- Fix some HTML markup "strict" errors, and CSS alignments in various admin pages
- Relocate shipping-calculation logic in checkout page, to be consistent with other checkout calculations and prevent some shipping rate errors
- Template fix to Responsive Classic to change postal-code to no longer be numeric-only
- Change authorize.net module to use Akamai servers
- Fix Payeezy payment module tokenization problem, and fix sandbox mode problem
- Fix some javascript on checkout pages related to form submission
- Fix out-of-stock alert inconsistency
- Trigger E_USER_ERROR when wrong bindVars rule set
- Update gv_faq language file with community contributions
- Change use of PHP_SELF to SCRIPT_NAME for consistency and to avoid legacy-related problems
- Fix false-positives in error-reporting logic
- Fix leftover indirection variables for PHP7 compatibility
- Fixes to AJAX handlers: reject fake requests; persist session data more effectively
- Change CKEditor trigger to use jQuery CDN instead of Google CDN, for broader global access
- Upgrade PHPMailer to accommodate broader TLS compatibility
- Accommodate MasterCard's recent BIN 2 addition
- Include responsive-classic template layout-boxes in upgrades, even if not using it, for sake of cloning simplicity
- Template fix: fax field was showing even if disabled
- Template fix: fix "back" button on address-book edit screens during checkout
- Multilanguage: make hreflang tag appear for all languages, instead of only for "other than current" language
- Fix admin link to whois resource
- Fix checkout_shipping: No method chosen after cart goes from virtual to mixed
- Handle mysql strict typing issue with legacy PayPal IPN insert
- Fix Free Shipping tax calculation with ot_coupon
- Added several helper functions to shopping_cart class for calculating in-cart properties related to categories
- No database changes required.
Upgrading from v155a to v155b is simply a matter of replacing some files (or merging your customizations with those files). The list of changed files is here: https://www.zen-cart.com/docs/change...5-5.html#v155b
(If you're using v155 and haven't upgraded to v155a already, apply the list of changed files for v155a and v155b, using the v155b zip file contents.)
As always, any additional critical issues will continue to be posted at Known bugs and fixes with v1.5.5
Zen Cart v1.5.5c released!
v1.5.5c has been released!
This fixes a critical bug in PHPMailer, which is the subsystem used for sending emails in Zen Cart.
Download available here: http://sourceforge.net/projects/zencart/files/
What's different in v1.5.5c vs v1.5.5b?
Since the release of v1.5.5b on 2-Nov-2016, the following changes have been applied to become v1.5.5c ...
- Fix serious PHPMailer bug (upgraded to 5.2.19)
- Fix some variable strict-type rule enforcement issues for better PHP 7 compatibility
- Fix sanitizer (admin) overzealous cleaning for Attribute Option Comments
- Fixed bug preventing sending Coupon and GV emails to "all customers"
- Fixed rarely-triggered bug with product-type overrides for delete/copy logic
- Fixed problem where deleting a customer wouldn't delete old product-notification requests associated with that customer
- Fixed PayPal Standard to no longer transmit a comma as thousands-separator. (PayPal is being more strict about this in 2017.)
- Fixed shopping-basket quantity alert problem where changing quantities didn't always fire if min/mix rules were set
- Make null-exception treatment consistent in admin to match catalog
- NOTE: There were NO Database Changes
The list of changed files between minor versions is here: https://www.zen-cart.com/docs/change...5-5.html#v155c
As always, any additional critical issues will continue to be posted at Known bugs and fixes with v1.5.5
Zen Cart v1.5.5d released!
v1.5.5d has been released!
This fixes a critical bug in PHPMailer, which is the subsystem used for sending emails in Zen Cart.
While Zen Cart already sanitizes aggressively against the vulnerabilities published in CVE-2016-10033 and CVE-2016-10045 for PHPMailer this week, we are pushing this new release with the embedded security fixes, as a matter of precaution, in the interest of keeping stores safe. This also has the added benefit of helping provide an extra layer of protection against poorly-sanitized plugins (or completely unrelated software) that might be installed on the store site.
Download available here: http://sourceforge.net/projects/zencart/files/
What's different in v1.5.5d vs v1.5.5c?
Since the release of v1.5.5c on 26-Dec-2016, the following changes have been applied to become v1.5.5d ...
- Upgrade PHPMailer from 5.2.19 to 5.2.21 to fix critical security bug CVE-2016-10045
- Update Authorize.net storage field type in database to accommodate different values returned by Authnet emulator gateways using these modules
- Fix zc_install to prevent DB_CHARSET from being set to blank during upgrades when upgrading v1.3.x configure.php files to new format
- NOTE: There are NO Database Changes to be applied manually.
The list of changed files between minor versions is here: https://www.zen-cart.com/docs/change...5-5.html#v155d
As always, any additional critical issues will continue to be posted at Known bugs and fixes with v1.5.5
Re: Zen Cart v1.5.5e released!
v1.5.5e has been released!
Download available here: http://sourceforge.net/projects/zencart/files/
What's different in v1.5.5e vs v1.5.5d?
Since the release of v1.5.5d on 31-Dec-2016, the following changes have been applied to become v1.5.5e ...
- Upgrade PHPMailer from 5.2.21 to 5.2.22
- Update gmail support to use TLS per published standards
- Fix bug introduced in v1.5.5c related to deleting customers
- Add built-in support for new .htaccess rules required for Apache 2.4, so mod_compat doesn't need to be installed
- zc_install improvements better handling for upgrades from v138 / v139
- zc_install - removed extraneous backticks from upgrade SQL from v154-to-v155
- Bridge compatibility for transition to removal of the ENABLE_SSL_ADMIN constant
- Consolidate to a single upload class, shared between admin/catalog
- Updates to Payeezy and First Data HCO payment modules
- NOTE: There were NO Database Changes
The list of changed files between minor versions is here: https://www.zen-cart.com/docs/change...5-5.html#v155e
As always, any additional critical issues will continue to be posted at Known bugs and fixes with v1.5.5
Zen Cart v1.5.5f released!
v1.5.5f has been released!
Download available here: http://sourceforge.net/projects/zencart/files/
What's different in v1.5.5e vs v1.5.5f?
Since the release of v1.5.5e, the following changes have been applied to become v1.5.5f ...
- **NOTE: v1.5.5f is NOT compatible with PHP 7.2** ... it will trigger dozens of "warnings about undefined constants"
Changes in v1.5.5f:
- Checkout - As a help to people getting PayPal TLS notifications, the CURL Testing tool now reports compatibility with tlstest.paypal.com
- Checkout - Square Payments support is now built-in. Start taking credit card payments in just 5 minutes! See www.zen-cart.com/partners/square_setup
- Checkout - FirstData soft-descriptors now optional via module settings
- Checkout - PayPal - Australia settings explained better in configuration screen
- Checkout - PayPal IPN-handler posts back over ipnpb URL and now gracefully ignores unrecognized new notification types
- Checkout - Payeezy module now also accommodates 2-series MC BINs
- Checkout - Authorize.net AIM - add option to display reason for CVV or date failure
- Checkout - Authorize.net AIM - improvements to detect always-SSL site configuration
- Checkout - Credit Card Slamming threshold now customizable via Observer code or plugin
- Checkout - Internal fix to payment modules to avoid thousands-rounding errors
- Fix upload-class bug related to filtering desired file-extensions
- Fix multi-language error (since v155a) in functions_email for PHPMailer
- Fix possible bug in subdomain handling of secure cookie session handling
- Fix attribute sort-order rules
- Fixed - if an invalid or non-existent tax rate was encountered, would get: PHP Warning: A non-numeric value encountered in /includes/functions/functions_taxes.php on line 172
- Admin: Restored percent calculators on Products Price Manager
- Admin: Fix a few sanitizer fields to avoid over-cleaning
- Admin: Update currency-exchange calculators since BOC change
- Template - Support ISO-8601 style date-of-birth date
- Template - Compatibility updates to accommodate OnePageCheckout plugin integration
- Template - Improvements for jQuery conflict prevention, and support older browsers
- Template - Fix CSS typo in colors
- Template - hreflang URL correction
- Template - Fix incorrect use of logo image height
- Security: CVE-2017-11675 - Low-Risk vulnerability (required your Admin login to be hijacked first). Now prevents exporting to invalid filenames.
- Optimization - Abort ajax requests from spiders
- Enhancement - Cache-bypass added for certain db queries, so retrieved data is always fresh
- Utility - Plugin version-check utility optimized to allow specific version-comparisons, and adapt to timeouts more quickly. - NOTE: There were NO Database Changes
The list of changed files between minor versions is here: https://www.zen-cart.com/docs/change...5-5.html#v155f
As always, any additional critical issues will continue to be posted at Known bugs and fixes with v1.5.5
EDIT: The zip file was updated on 01/01/2018 (called zen-cart-v1.5.5f-12312017b.zip) to incorporate some PHP 5.3-specific fixes, to allow for broader compatibility while upgrading multiple sites on a server before upgrading its PHP to a usable version.
