are the 1.3.8 security patches included in 1.3.9?

[mzimmers]

Have the 1.3.8 security patches been incorporated into 1.3.9? I thought they were, but a file diff on html_output.php revealed that 1.3.9 doesn't seem to have Security Patch v138 20090619 (or at least, it's not in the same form as 1.3.8).

Thanks for any information.

[DrByte]

Have the 1.3.8 security patches been incorporated into 1.3.9?

Yes, they are.
See the release notes and/or the original announcement here: http://www.zen-cart.com/forum/showthread.php?t=153088

[mzimmers]

Thanks, doc. I did look at that page you cited, but I didn't find a specific reference to 20090619. And since the file I looked in didn't have the same code for that patch, it made me wonder. i guess it was implemented differently in 1.3.9?

[barco57]

from the change log for 1.3.9a

OLD Security Patch Files TO BE DELETED
The following files which were included in patches for 1.3.8/a are no longer needed in 1.3.9, and should be deleted from your server:

* /admin/includes/auto_loaders/config.security_patch_v138_20090619.php
* /admin/includes/extra_configures/security_patch_v138_20090619.php
* /admin/includes/functions/extra_functions/security_patch_v138_20090619.php
* /admin/includes/init_includes/init_security_patch_v138_20090619.php

(There are files by this name inside the 1.3.9 zip, but they are essentially blank, so if you use them to overwrite the older ones on your old site, that will prevent duplication if you forget to delete them from the server. But, it's better to clean up instead of leaving a mess behind.)

[mzimmers]

Ah, thanks, barco. I guess I didn't look deep enough. I'll wipe them out from my old install before merging.

Regarding admin/includes/functions/html_output.php, it appears that, while some of the comments weren't picked up, the patch itself was. I'll just use the new file.

Thanks again.

[kobra]

Regarding admin/includes/functions/html_output.php, it appears that, while some of the comments weren't picked up, the patch itself was. I'll just use the new file.

You should use all the new files for 1.3.9....a mis-mash of 1.3.x files will cause issues

[mzimmers]

Hey, Kobra -

I am doing that. But I'm also comparing old vs. new files to make sure I'm not leaving any changes behind. When I didn't see this particular patch in the new release, it made me wonder, and that's why I asked the question.

Despite my best efforts, though, I'm sure that this upgrade will be filled with "issues" for me.

[kobra]

mzimmers,

Just wanted to insure that you were not combining file releases!!!