DUAL Pricing v2

[twitchtoo]

DivaVocals,

1 - Logically No wholesale price = $0.00

2 - If you were to add a non dependent attribute it would output the option name, then value. It has not been tested with a dependent product matrix which I believe you are referring to.

There's no reason why it wouldn't support the matrix as long as the data was loaded correctly before it was displayed.

An alternative would be reversing the option names with the attributes.

Twitch.

[hairydog]

Personally I will NOT use any add-on on a client production store that has not been properly updated.

That is all very well in theory, but is it better to use an addon that has not been properly updated, or to stay on 1.3.9 because that addon is required for the way the store works?

[DivaVocals]

That is all very well in theory, but is it better to use an addon that has not been properly updated, or to stay on 1.3.9 because that addon is required for the way the store works?

It's better to have a secure WORKING site.. not in theory, but in actuality.. But to answer your question here's what I DO say..

Zen Cart v1.3.8 has KNOWN security vulnerabilities and anyone running v1.3.8 should upgrade ASAP. For these implementations if:

• all of the add-ons a shopowner is using have not been upgraded to be compatible v1.5
  
• the shopowner's host is not requiring PCI compliance just yet
  
• it is a SHOWSTOPPER to not have these add-ons
  

Then in that narrow set of circumstances shopowner should AT LEAST upgrade to v1.3.9 to ensure that the site is secure.

Zen Cart v1.3.9 is quite secure and for those who have a stable v1.3.9 implementation going and whose hosts are not requiring PCI compliance just yet, IMHO, they should wait until all the mods you use are properly updated for Zen Cart v1.5 before upgrading.

In MY opinion it is NOT better to use a mod that has not been properly updated of test on a live store. I DO NOT use add-ons on any client site unless they have been properly updated and thoroughly tested (Why?? I don't know.. Maybe because my clients kinda like it when their store live functions as it should versus "it sorta works") It is better to update the mod properly so that it works properly.

And as I have stated several times on this forum, if an add-on has not been upgraded to be compatible with Zen cart v1.5, and it is a SHOWSTOPPER item for the BUSINESS owner, then there are three BUSINESS options the owner of the BUSINESS has:

• Find a workaround solution
• Hire a developer to update the add-on
• Wait patiently until the add-on is upgraded by a community member

[hairydog]

And as I have stated several times on this forum, if an add-on has not been upgraded to be compatible with Zen cart v1.5, and it is a SHOWSTOPPER item for the BUSINESS owner, then there are three BUSINESS options the owner of the BUSINESS has:

• Find a workaround solution
• Hire a developer to update the add-on
• Wait patiently until the add-on is upgraded by a community member

Indeed. In fact this business has been sitting on 1.3.9 for months in the hope that one particular add-on would be upgraded, but as Super Orders seems to be stuck again, they have taken an extra member of staff on to do the tasks that SO made easier (I suspect they really needed someone extra anyway).

But the reality is not as clear-cut as you seem to describe it. They have passed PCI audits with 1.3.9 and earlier, and the idea of a workaround solution for dual pricing is pretty unrealistic. Yes, they could hire a programmer to update add-ons, but that really would be re-inventing the wheel. The question that you have not answered (even though you say you have) is whether it is more secure to use 1.5.0 with some 1.3.9 addons that seem to work, or to use 1.3.9 with some 1.3.9 addons that seem to work. I'm not clear about why they would be less secure on 1.5.0 than on 1.3.9. I suspect that you may know, but you clearly are not keen to share this information.

To be honest, I begin to wonder if it might be as easy to migrate them to Magento.

[DivaVocals]

Indeed. In fact this business has been sitting on 1.3.9 for months in the hope that one particular add-on would be upgraded, but as Super Orders seems to be stuck again, they have taken an extra member of staff on to do the tasks that SO made easier (I suspect they really needed someone extra anyway).

It's not stuck.. It's just not done.. Working on remaining bugs.. Call me crazy, but I have this thing about not wanting to put out something that doesn't work as it's supposed to if I can avoid it.. The development is volunteer driven, and volunteers are people with lives.. Lives outside the forum sometimes require some attention & time.. So sometimes updates take time.. Sometimes they a LOT of time (and yep I freely admit that SO is one that fits this category).. Fact of life in open source.. (Ask Twitch.. he can tell you this is true..)

But the reality is not as clear-cut as you seem to describe it. They have passed PCI audits with 1.3.9 and earlier, and the idea of a workaround solution for dual pricing is pretty unrealistic. Yes, they could hire a programmer to update add-ons, but that really would be re-inventing the wheel.

Hire someone, wait, or workaround it.. there isn't a fourth option.. The reality is JUST that clear cut.. As much as folks don't like to hear this, that IS the reality of working with free open source software. IMHO any small business that is hoping that there will be NO capital outlay (even a small one) to maintain the technology that drives their business isn't realistic at all.. An add-on like Dual Pricing could easily be a show stopper for a small business, and that is something that has to be thought about LONG and hard by any small business that may not have a budget for a developer if the need arises. The two clients I have who needed dual pricing features opted to hire someone to update the add-on because they did not want to wait, and they did not have an adequate workaround.. (other than building a parallel wholesale shop) Was it re-inventing the wheel for them?? Nope.. it wasn't doing anything different than doing what folks are looking for a volunteer to do with Dual Pricing.. Update the add-on.. My clients opted to pay and not to wait, but I am glad to see Twitch is back and that he has updated this fantastic mod.. (which is why I continue to monitor this thread)

The question that you have not answered (even though you say you have) is whether it is more secure to use 1.5.0 with some 1.3.9 addons that seem to work, or to use 1.3.9 with some 1.3.9 addons that seem to work. I'm not clear about why they would be less secure on 1.5.0 than on 1.3.9. I suspect that you may know, but you clearly are not keen to share this information.

To be honest, I begin to wonder if it might be as easy to migrate them to Magento.

Not keen to share?? Clearly?? It's CLEAR that I am attempting to NOT share??? Well okay.. I thought I had shared.. so I'm not sure what it is you are indicating that I am not "sharing"..

The ENTIRE purpose of the v1.5 release was to become PCI certified. Zen Cart v1.3.9 is most certainly NOT PCI certified -- and on this point you can take that up with DrByte if you disagree because it's HIS word and the word of other knowledgeable Zen Cart gurus that I take on this point. So based on this, it is my understanding that v1.3.9 is a secure version and unless there is an issue with PCI compliance, there isn't any reason to make the jump to v1.5 if all the add-ons a shopowner wants are not available. Not sure why you feel that you HAVE to make the jump to v1.5 from v1.3.9 in such a hurry.

So if you are asking me should you use v1.3.9 add-ons with v1.5 if they seem to work??? I thought I was clear on my position.. I have made not explicit statements about add-ons being MORE or LESS secure in v1.3.9 versus v1.5.. However the Zen Cart admins have.. They have made a clear distinction between "working with v1.5" and "working while maintaining PCI compliance/security with v1.5"

If the person installing the add-on is not knowledgeable enough to determine whether or not a mod is TRULY v1.5 compatible versus seeing that it "appears" to work, then my answer is NO don't install add-ons until you can get confirmation that yes they are TRULY v1.5 compatible.. There are some v1.3.9 add-ons that WILL NOT work with v1.5 (Dual Pricing is one) and requires upgrades to work correctly. There are some v1.3.9 add-ons that will indeed work with v1.5 without any updates required.. For that matter there are a FEW v1.3.8 add-ons that will work in v1.5.

[hairydog]

So if you are asking me should you use v1.3.9 add-ons with v1.5 if they seem to work??? I thought I was clear on my position.. I have made not explicit statements about add-ons being MORE or LESS secure in v1.3.9 versus v1.5.. However the Zen Cart admins have.. They have made a clear distinction between "working with v1.5" and "working while maintaining PCI compliance/security with v1.5"

That's very helpful, thanks. The former matters to me at present, the latter does not.

As long as 1.3.9 installations pass PCI certification as they seem to be doing at present, it doesn't matter whether ZC is itself PCI certified. That would not negate the need for PCI testing every year in any case. No UK bank will say "OK, you've used PCI certified software so we won't need to check your system" - it isn't their way!

If the person installing the add-on is not knowledgeable enough to determine whether or not a mod is TRULY v1.5 compatible versus seeing that it "appears" to work, then my answer is NO don't install add-ons until you can get confirmation that yes they are TRULY v1.5 compatible.

That does not seem to be easy. Even going through the seventeen page thread about which have been updated for 1.5.0 you get statements like:

"I have a few more to add to the list. These mods have been updated for 150, tested for functionality, and submitted to the downloads section."

Does that mean they seem to work (that's what I'd assume "tested for functionality" means) or does it mean they are "TRULY v1.5 compatible"?

There is a slowly-growing list of addons that work with 1.5 in that thread, but it seems a pity that there is no single table of addons, with an indication that whether a specified version of each addon:
1. Does not work with 1.5
2. "Seems to work" with 1.5 (including your "working with 1.5")
3. Is 1.5 compatible (including "working while maintaining PCI compliance/security with v1.5")
4. Is backwards compatible with 1.3.9
5. Don't know the status yet
and also
6. has a link to where that version can be found

If that could be collated into one single, updated post it would make life so much easier!

There are some v1.3.9 add-ons that WILL NOT work with v1.5 (Dual Pricing is one) and requires upgrades to work correctly.

Again, very helpful. Thank you. I don't think I have managed to find that clearly stated anywhere.

I just wish I knew enough to be able to work out what the issues with Dual Pricing and 1.5.0 are. Or even where they are being discussed.

The basic reason for this store wanting to move to 1.5.0 is that they very foolishly let some graphic design firm update the look and feel (perfectly sensible) by letting them alter the code (much less sensible). They seem to have made a complete mess of some of it, incorporating all sorts of bad practice and old versions of files, and the result is lots of PHP warnings in the error logs each day. But perhaps they need to re-upgrade to 1.3.9.

[DivaVocals]

That's very helpful, thanks. The former matters to me at present, the latter does not.

But security SHOULD matter.. and an add-on WORKING with v1.5 does not mean that it will maintain the security (and hence PCI compliance) of v1.5..

That does not seem to be easy. Even going through the seventeen page thread about which have been updated for 1.5.0 you get statements like:

"I have a few more to add to the list. These mods have been updated for 150, tested for functionality, and submitted to the downloads section."

Does that mean they seem to work (that's what I'd assume "tested for functionality" means) or does it mean they are "TRULY v1.5 compatible"?

Can't give a blanket answer to that..

There is a slowly-growing list of addons that work with 1.5 in that thread, but it seems a pity that there is no single table of addons, with an indication that whether a specified version of each addon:
1. Does not work with 1.5
2. "Seems to work" with 1.5 (including your "working with 1.5")
3. Is 1.5 compatible (including "working while maintaining PCI compliance/security with v1.5")
4. Is backwards compatible with 1.3.9
5. Don't know the status yet
and also
6. has a link to where that version can be found

If that could be collated into one single, updated post it would make life so much easier!

Don't look for this to happen.. Consolidating the reported working apps in that thread is enough work for any one volunteer to do.. I don't see anyone taking all these extra steps..

Again, very helpful. Thank you. I don't think I have managed to find that clearly stated anywhere.

Twitch did.. So did I in this thread for that matter.. There has been a fair bit of discussion of the v1.5 compatibility of Dual Pricing..

I just wish I knew enough to be able to work out what the issues with Dual Pricing and 1.5.0 are. Or even where they are being discussed.

Well you know the options you can exercise if you NEED Dual Pricing and can't work it out yourself.. Consider getting your client to consider INVESTING in the dev work if they can't wait..

The basic reason for this store wanting to move to 1.5.0 is that they very foolishly let some graphic design firm update the look and feel (perfectly sensible) by letting them alter the code (much less sensible). They seem to have made a complete mess of some of it, incorporating all sorts of bad practice and old versions of files, and the result is lots of PHP warnings in the error logs each day. But perhaps they need to re-upgrade to 1.3.9.

Sounds to me like your last suggestion a better on and will get you better prepared for the v1.5 upgrade when the time comes..

[hairydog]

But security SHOULD matter.. and an add-on WORKING with v1.5 does not mean that it will maintain the security (and hence PCI compliance) of v1.5.

Security matters, box ticking does not.

As I said before, PCI compliance from the client's point of view is not related to whether ZC code is PCI compliant: it depends on whether the company checking it for the bank considers it to be PCI compliant, and to date, they have been happy to sign off 1.3.9 as compliant.

You seem to be saying that 1.3.9 with 1.3.9 addons is more secure than 1.5.0 with 1.3.9 addons. I'm not sure I understand why that should be, but I don't know enough to have an opinion on the subject.

Getting a client to invest in dev work is almost impossible unless you are able to present them with realistic budget estimate and a business case to justify that expenditure. It just ain't gonna happen.

[DivaVocals]

You seem to be saying that 1.3.9 with 1.3.9 addons is more secure than 1.5.0 with 1.3.9 addons. I'm not sure I understand why that should be, but I don't know enough to have an opinion on the subject.

I seem to be saying exactly what I have stated.. no hidden message in my words.. No read between the lines.. I said that v1.3.9 is secure.. v1.5 was built to IMPROVE the security of v1.3.9. if you have a stable v1.3.9 install then there is no rush to upgrade to v1.5.. I am saying that unless you know HOW to upgrade 1.3.9 add-ons so that they maintain the SAME security that is the MAIN THRUST of v1.5, then you should not install v1.3.9 add-ons that have not been updated or tested to work with Zen Cart v1.5.. I think this is a pretty clear statement..

Getting a client to invest in dev work is almost impossible unless you are able to present them with realistic budget estimate and a business case to justify that expenditure. It just ain't gonna happen.

I would say not having an app that they NEED is the justification for a business owner to INVEST in the tools they need to do business.. Most of my clients usually make the investment in their business.. Only 1 opted to do without their "must have" add-ons and work around the issue.

[DivaVocals]

I seem to be saying exactly what I have stated.. no hidden message in my words.. No read between the lines.. I said that v1.3.9 is secure.. v1.5 was built to IMPROVE the security of v1.3.9. if you have a stable v1.3.9 install then there is no rush to upgrade to v1.5.. I am saying that unless you know HOW to upgrade 1.3.9 add-ons so that they maintain the SAME security that is the MAIN THRUST of v1.5, then you should not install v1.3.9 add-ons that have not been updated or tested to work with Zen Cart v1.5.. I think this is a pretty clear statement..

I would say not having an app that they NEED is the justification for a business owner to INVEST in the tools they need to do business.. Most of my clients usually make the investment in their business.. Only 1 opted to do without their "must have" add-ons and work around the issue.

Also at this point we are hijacking the Dual Pricing thread with what has become an off-topic discussion, and this probably should be moved to a more appropriate place on the forum.... There is a whole thread in the upgrade forum which will provide you with the information about why you can't just simply install v1.3.9 add-ons with v1.5.. Suggest you head over there and check it out..