Zen Cart Logo
Forums / Upgrading to 1.5.x / How should 'customers_secret' be handled in upgrade?

How should 'customers_secret' be handled in upgrade?

Views: 1,478

Results 1 to 3 of 3
14 Jul 2024, 01:16
#1
clam_man avatar

clam_man

New Zenner

Join Date:
Jun 2019
Location:
Austin TX
Posts:
65
Plugin Contributions:
0

How should 'customers_secret' be handled in upgrade?

I'm moving a 1.5.6b database into a fresh install of 1.5.8 and everything has been working well so far but I noticed that 'customers_secret' was not a column in the old database and that it is not nullable in the new database. I was able to properly import the old data without issue but I was wondering if that was creating a security issue since every customer's secret is just an empty varchar(64). Does that mean customer accounts are at risk of unauthorized password resets if someone tries to enter a blank secret to reset an account's password?

14 Jul 2024, 16:48
#2
lat9 avatar

lat9

Administrator

Join Date:
Sep 2009
Location:
Stuart, FL
Posts:
14,065
Plugin Contributions:
56

Re: How should 'customers_secret' be handled in upgrade?

clam_man:

I'm moving a 1.5.6b database into a fresh install of 1.5.8 and everything has been working well so far but I noticed that 'customers_secret' was not a column in the old database and that it is not nullable in the new database. I was able to properly import the old data without issue but I was wondering if that was creating a security issue since every customer's secret is just an empty varchar(64). Does that mean customer accounts are at risk of unauthorized password resets if someone tries to enter a blank secret to reset an account's password?
That new field is used only when using the admin-login-as-customer feature introduced in zc157.

15 Jul 2024, 00:19
#3
clam_man avatar

clam_man

New Zenner

Join Date:
Jun 2019
Location:
Austin TX
Posts:
65
Plugin Contributions:
0

Re: How should 'customers_secret' be handled in upgrade?

Thank you for the reply. I appreciate you clearing that up for me. I was worried and wanted to make sure before making the new site live. Looks like nothing at all to worry about then!