Apsona CSV data exporter [support thread]

[moesoap]

Can I export, change and then import mass attribute prices using your shop program rather than updating prices individually using zen cart admin?

[apsona]

moesoap - The Apsona CSV exporter export-only, it doesn't have an importing or uploading part to it. But you can use Apsona ShopAdmin (which is a very different and more capable app, also free) to do the export/edit/re-update cycle not just for product attributes but for products, categories, orders and customers.

Apsona
http://apsona.com

[BlessIsaacola]

I tested the Apsona ShopAdmin and I can say it's loaded with useful features. Unfortunately, for us we decided not to use it because it requires our server to have allow_url_fopen to be turn on and we decided against that for security reasons.

[apsona]

BlessIsaacola - I'd like to address the security concern and the reasons for the choices we made with ShopAdmin. I will provide some brief technical details here, but please feel free to follow up.

• ShopAdmin has to download the user interface software layer (JavaScript and CSS files) into the user's browser. This is obviously necessary, otherwise we can't paint the browser's screen.
• It can't download that software directly from the ShopAdmin server, because it will run head-on into the Same-Origin-Policy issue that Ajax programmers have to deal with. So it will have to provide a pass-through so that the software is downloaded from the ShopAdmin server via the Zen Cart application.
• PHP provides two ways of implementing such a pass-through: either allow_url_fopen or curl. But curl, to my mind, is the less desirable choice because it spawns a new child process on the server, with two undesirable results:
  
  1. It will require the child-process-spawning capability, and there are lots of attack vectors that open up if you include that capability. This is in fact the usual trick that Windows viruses use to get in to a victim computer.
  2. It increases the load on the server, because spawning another process is a high-overhead operation (the same reason why FastCGI is preferable to CGI).
  
  In contrast, allow_url_fopen has neither of these drawbacks, since it is implemented directly within the PHP virtual machine. It also offers fine-grain control to the web server setup.

The ShopAdmin code is written to take care that we do not download anything else through the server, and more importantly, it does not write anything to the server's file system (other than updating the database, according to the user's instructions). As you well know, when it comes to security, we have to be paranoid. And when someone is trusting their business and their livelihood with a piece of software, that software had better be totally reliable, or it will soon be a forgotten memory.


Hope this helps.
Apsona
http://apsona.com

[BlessIsaacola]

BlessIsaacola - I'd like to address the security concern and the reasons for the choices we made with ShopAdmin. I will provide some brief technical details here, but please feel free to follow up.

• ShopAdmin has to download the user interface software layer (JavaScript and CSS files) into the user's browser. This is obviously necessary, otherwise we can't paint the browser's screen.
• It can't download that software directly from the ShopAdmin server, because it will run head-on into the Same-Origin-Policy issue that Ajax programmers have to deal with. So it will have to provide a pass-through so that the software is downloaded from the ShopAdmin server via the Zen Cart application.
• PHP provides two ways of implementing such a pass-through: either allow_url_fopen or curl. But curl, to my mind, is the less desirable choice because it spawns a new child process on the server, with two undesirable results:
  
  1. It will require the child-process-spawning capability, and there are lots of attack vectors that open up if you include that capability. This is in fact the usual trick that Windows viruses use to get in to a victim computer.
  2. It increases the load on the server, because spawning another process is a high-overhead operation (the same reason why FastCGI is preferable to CGI).
  
  In contrast, allow_url_fopen has neither of these drawbacks, since it is implemented directly within the PHP virtual machine. It also offers fine-grain control to the web server setup.

The ShopAdmin code is written to take care that we do not download anything else through the server, and more importantly, it does not write anything to the server's file system (other than updating the database, according to the user's instructions). As you well know, when it comes to security, we have to be paranoid. And when someone is trusting their business and their livelihood with a piece of software, that software had better be totally reliable, or it will soon be a forgotten memory.


Hope this helps.
Apsona
http://apsona.com

Very well stated and written. I wasn't saying anything bad about Apsona. I don't have any issues with Apsona and actually wished we can use it on site. It's a business decision for us nothing against Apsona.

There are way too many documented cases online of how hackers have used turning allow_url_fopen on as means of carrying out attacks. While Apsona product will cause no harm, leaving the door open to others by turning on allow_url_open is not something we are comfortable with it. Purely business decision nothing against your product.

Although both Curl and allow_url_fopen presents security risks, allow_url_open has a long documented cases online of abuse than curl.

[goagal]

I have used this addon, it's nice and easy to use.
But there is a big problem with me, when I export the customers, I could not export the total account, I don't know why, I have tried this on 2 of my sites, and local, unfortunately, I get the same problem.

And I found a wired thing, the customers from USA,Canada,Spain, would not be missed, and from others such as UK, Russian...could not be exported,

In fact, at the web admin, I have 807 customers, but I could only export 459 of it.

I don't why, please help.

By the way, my store is 1.3.8a

[goagal]

and I have checked the customers at web admin,
such as the customers no. 800-807, there are 4 missed no. such as 801,802,805,806. and the rest could be exported.