Addons and security

[pasi]

With all the security things coming up for 1.5 ... what about addons?

a miss configured / coded addon might easily make all the new security features void?

Wouldn't installing 3rd party untested addons void the PA DSS??

What are the dev teams views about this?

[DrByte]

"void"? no.

Adding addons simply shifts the responsibility for compliance to the coder/shopowner.

The topic is discussed in the Implementation Guide.


Didn't you already say elsewhere that PCI Compliance is something you have no interest in because you said it doesn't apply to you in Finland?

[torvista]

To hijack this thread to reflect the title....

I have tinkered with quite a few mods since I've been here, in the interests of improving the ones I have used and learnt a lot, but this is only checking other peoples work.

I understand the main driver for Zen Cart 1.5 has been security and so some previously-working-fine code has had to be changed for compliance.

So, having looked at the changed file list I expect to be starting afresh with 1.5 and gradually integrating the many mods I have done to my current site.

While I can more or less understand the code, I have little idea of the "right way" things should be done and even less what is secure or not.

Can you provide some pointers regarding what I (we) should be keeping my eye out for as I integrate each mod?

I have read that GET is a no no, but have not had time to read up why etc.

So without asking for a detailed list, is it possible to provide some guidance as to likely code snippets, methods etc. that I should be looking out for in a mod as maybe requiring attention in this aspect?

Thanks

[kuroi]

This perception that GETs are bad is rapidly turning into an urban myth. There's a more nuanced, detailed explanation in this thread.

[pasi]

Didn't you already say elsewhere that PCI Compliance is something you have no interest in because you said it doesn't apply to you in Finland?

Yes I did. and I do care, but it's not as important thing for me (or my clients) as it might be for shop keepers who do store CC info etc.

And thank you for the response. It answered my question :)