Zen-Cart 1.3.8a PHP5.3 ereg after patch

[Diavire]

Hello,

Our host is moving to PHP 5.3 soon, so I installed the PHP 5.3 patch that's been made available.

We'll be upgrading when 1.5.0 comes out of beta, but since that's not out yet, and it'll take some time to move everything to 1.5, we need a functioning store in the meantime.

On my local testserver running PHP 5.3, everything seems to work well.

However, I've done a search for ereg_replace in the zen-cart files. and there are still references to it in several files, like functions_email.php and functions_lookups.php, for example.

Are these going to cause problems in certain situations that I've not run into in testing yet, or did the PHP 5.3 patch somehow do some fix-work for that too?

Thanks and kind regards,
Wouter

[DrByte]

The "patch" simply suppresses the warnings about "deprecated function calls". It does not change the actual code, which will work fine. So, no, if you're still using v1.3.8 then you'll still see ereg() calls in the code.

You should be WAY MORE concerned about the security vulnerabilities that are in 1.3.8 than about ereg issues.

[DrByte]

We'll be upgrading when 1.5.0 comes out of beta, but since that's not out yet, and it'll take some time to move everything to 1.5, we need a functioning store in the meantime.

As for your 1.5 upgrade, you should START that process now. There will be very few changes to the final release code vs the existing RC2 code that's presently posted.

[Diavire]

The "patch" simply suppresses the warnings about "deprecated function calls". It does not change the actual code, which will work fine. So, no, if you're still using v1.3.8 then you'll still see ereg() calls in the code.

You should be WAY MORE concerned about the security vulnerabilities that are in 1.3.8 than about ereg issues.

Thanks for the clarification.

I am, naturally, all security patches are installed however, I take it that hardens the install up a bit, or are there other known issues that haven't been patched?

As for your 1.5 upgrade, you should START that process now. There will be very few changes to the final release code vs the existing RC2 code that's presently posted.

I understand that's the optimum (and in your eyes probably only) way to go now, but as it is, with the holidays and us being a brick and mortar store as well, and the site being only one of my responsibilities, there just aren't enough hours in the day to start right away. Literally ASAP though.

One more thing I was wondering about the upgrade to 1.5.0:

Will extra fields in the database pose a problem with the database upgrade? Like an exta table, or a field added to an existing table (or in our case, multiple of both).

Thanks for your time.

[DrByte]

One more thing I was wondering about the upgrade to 1.5.0:

Will extra fields in the database pose a problem with the database upgrade? Like an exta table, or a field added to an existing table (or in our case, multiple of both).

Not a problem. If you follow the recommended process, then the zc_install database-upgrade step will simply massage the pieces that are normally there, leaving everything else alone. The only time it would have a problem is if you removed core components from the database ... which is very unusual/unlikely.

[Diavire]

Not a problem. If you follow the recommended process, then the zc_install database-upgrade step will simply massage the pieces that are normally there, leaving everything else alone. The only time it would have a problem is if you removed core components from the database ... which is very unusual/unlikely.

Thanks much for the enlightenment.

Now just to be sure, 1.3.8a, with it's noted patches, still has XSS vulnerabilities for the admin, but no SQL injection problems, if I understand correctly?