Miva Merchant Empresa Bugs?

[emione]

Re: Miva Merchant Empresa Bugs?

Remik,

I agree with that, let me see what it would take to make the current 5.07 official.

Rick, any ETA on when 5.07 is going to be official?

I have this ongoing PCI compliance issue (persistent cookies set in non-secure mode) with McAfee Secure. I can't believe I'm the only one getting tired of not being PCI compliant and I keep getting the notices about the issue.

Isn't there some way 5.07 can be officially released out of beta so this problem can be taken care of?

McAfee has removed the option of marking this as an "acceptable risk", so there's no way around this unless 5.07 takes care of it.

[Rick Wilson]

Re: Miva Merchant Empresa Bugs?

5.07 is available if you need it, just have your host call and request it.

It's going to stay in "beta" for a while because we're not done adding things, but the McAfee problem is fixed and has no issues.

In addition, McAfee appears to be the only scanning company currently taking this perspective (that insecure cookies which contain no sensitive information are a security risk) and you could always switch scanning companies.

[emione]

Re: Miva Merchant Empresa Bugs?

5.07 is available if you need it, just have your host call and request it.

It's going to stay in "beta" for a while because we're not done adding things, but the McAfee problem is fixed and has no issues.

In addition, McAfee appears to be the only scanning company currently taking this perspective (that insecure cookies which contain no sensitive information are a security risk) and you could always switch scanning companies.

Thanks for the reply Rick.
That's good to hear the McAfee problem is fixed.
Any ETA on when you'll be done adding things and release it from beta?
Dotcomhost has been most patient with me (and I'm sure many others) about trying to keep up to date on this issue. I think I'd prefer waiting until it's out of beta if it's not going to be too much longer. I don't want to create a bunch of work for Dotcomhost going back and forth with different versions or updates.

[Rick Wilson]

Re: Miva Merchant Empresa Bugs?

Personally, I wouldn't wait. It's not in beta because it's unstable, it's in beta because I don't want to divert our focus from Miva Merchant development just to formally release it. We might end up leaving it in beta for a very long time.

[emione]

Re: Miva Merchant Empresa Bugs?

Personally, I wouldn't wait. It's not in beta because it's unstable, it's in beta because I don't want to divert our focus from Miva Merchant development just to formally release it. We might end up leaving it in beta for a very long time.

Thanks.

[Jeff - Wolfpaw Hosting]

Re: Miva Merchant Empresa Bugs?

Rick - just got a copy of 5.07a1 with the McAfee unsecure cookie fix. I remember reading that using this fix meant that the site could not use a shared SSL cert. Is that still true? And, if so, does that apply also apply to websites on a shared server for which the MvCONFIG_COOKIES_SECURE is 'No' ?

Thanks

[Rick Wilson]

Re: Miva Merchant Empresa Bugs?

And, if so, does that apply also apply to websites on a shared server for which the MvCONFIG_COOKIES_SECURE is 'No'

No, in this case shared certs would work just fine.

[Mark Johnson]

Re: [IMPORTANT] Critical Arithmetic Bug in 5.06

Empresa and Mia v5.06 parse simple arithmetic functions wrong and inconsistently which may lead to completely false results in simple calculations. This happens when an expression is passed through MvDO, and possibly in other MIVA Script tags too. Below there is a sample code demonstrating the fatal bug. Compile it and run to see the illogical results for the simple expression A - B - C. In old versions such expressions worked well; currently it is necessary to transcribe them into logically identical equivalent of A - (B + C) :

<h3>Plain expression</h3>
<MvASSIGN NAME="l.res1" VALUE="{5 - 1 - 3}">
<MvASSIGN NAME="l.res2" VALUE="{5 - (1 + 3)}">
<MvEVAL EXPR="{result(l.res1,l.res2)}">
 
<h3>Expression in a function argument in MvDO</h3>
<MvDO FILE="test.mvc" NAME="l.res1" VALUE="{test(5 - 1 - 3)}">
<MvDO FILE="test.mvc" NAME="l.res2" VALUE="{test(5 - (1 + 3))}">
<MvEVAL EXPR="{result(l.res1,l.res2)}">
 
<h3>Expression directly in MvDO</h3>
<MvDO FILE="test.mvc" NAME="l.res1" VALUE="{5 - 1 - 3}">
<MvDO FILE="test.mvc" NAME="l.res2" VALUE="{5 - (1 + 3)}">
<MvEVAL EXPR="{result(l.res1,l.res2)}">
 
<MvFUNCTION NAME="test" PARAMETERS="val">
 <MVFUNCRETURN VALUE="{l.val}">
</MVFUNCTION>
 
<MvFUNCTION NAME="result" PARAMETERS="val1 VAR, val2 VAR">
 <MvIF EXPR="{l.val1 NE l.val2}">
   <MVFUNCRETURN VALUE="{'<span style="color:red">' $ l.val1 $ ' != ' $ l.val2 $ '</span>'}">
 <MvELSE>
   <MVFUNCRETURN VALUE="{l.val1 $ ' == ' $ l.val2}">
 </MvIF>
</MVFUNCTION>

The test program should show three times 1 == 1 but instead it shows the incorrect result 7 != 1 for the last two calculations passing the expression through MvDO. MvASSIGN and MvEVAL work correctly, but I suspect the same problem may pop up in other commands too (such as MvFILTER, index expressions, etc).

It turns out that MvDO uses a completely separate parser to compile its VALUE expression at run time. This parser is also used in the filter expressions of MvIMPORT and in the template compiler. This parser was evaluating all operators of equal precedence right to left. Of course the parser in the compiler evaluates left to right. In the long run I would like to use a single parser to guarantee consistent behavior. In the meantime I just fixed the runtime expression parser. This fix is in engine version 5.07a4 and later.

Here is the revised test program that I used to work on this issue. Thanks again Ivo for documenting this so well.

<HTML>
<HEAD><TITLE>Miva Test Application</TITLE></HEAD>

<BODY BGCOLOR = "#ffffff">
<B>Miva Test Application</B><BR>
Running under Miva v<B><MvEVAL EXPR = "{ s.mivaversion }"></B><br><br>

<h3>Plain expression</h3>
<MvASSIGN NAME="l.res1" VALUE="{5 - 1 - 3}">
<MvASSIGN NAME="l.res2" VALUE="{( 5 - 1 ) - 3}">
<MvEVAL EXPR="{result(l.res1,l.res2)}">
 
<h3>Expression in a function argument</h3>
<MvASSIGN NAME="l.res1" VALUE="{test(5 - 1 - 3)}">
<MvASSIGN NAME="l.res2" VALUE="{test(( 5 - 1 ) - 3)}">
<MvEVAL EXPR="{result(l.res1,l.res2)}">
 
<h3>Expression directly in MvDO</h3>
<MvDO FILE="test.mvc" NAME="l.res1" VALUE="{5 - 1 - 3}">
<MvDO FILE="test.mvc" NAME="l.res2" VALUE="{( 5 - 1 ) - 3}">
<MvEVAL EXPR="{result(l.res1,l.res2)}">
 
<h3>Expression in a function argument in MvDO</h3>
<MvDO FILE="test.mvc" NAME="l.res1" VALUE="{test(5 - 1 - 3)}">
<MvDO FILE="test.mvc" NAME="l.res2" VALUE="{test(( 5 - 1 ) - 3)}">
<MvEVAL EXPR="{result(l.res1,l.res2)}">
 
<h3>Expression directly in implied MvDO</h3>
<MvASSIGN NAME="l.dofile" VALUE="test.mvc">
<MvASSIGN NAME="l.res1" VALUE="{ [ l.dofile ].( 5 - 1 - 3 ) }">
<MvASSIGN NAME="l.res2" VALUE="{ [ l.dofile ].( ( 5 - 1 ) - 3 ) }">
<MvEVAL EXPR="{result(l.res1,l.res2)}">
 
<h3>Expression in a function argument in implied MvDO</h3>
<MvASSIGN NAME="l.res1" VALUE="{ [ l.dofile ].test(5 - 1 - 3)}">
<MvASSIGN NAME="l.res2" VALUE="{ [ l.dofile ].test(( 5 - 1 ) - 3)}">
<MvEVAL EXPR="{result(l.res1,l.res2)}">
 
<MvFUNCTION NAME="test" PARAMETERS="val">
 <MVFUNCRETURN VALUE="{l.val}">
</MVFUNCTION>
 
<MvFUNCTION NAME="result" PARAMETERS="val1 VAR, val2 VAR">
 <MvIF EXPR="{l.val1 NE l.val2}">
   <MVFUNCRETURN VALUE="{'<span style="color:red">' $ l.val1 $ ' != ' $ l.val2 $ '</span>'}">
 <MvELSE>
   <MVFUNCRETURN VALUE="{l.val1 $ ' == ' $ l.val2}">
 </MvIF>
</MVFUNCTION>

[netiskiv]

Re: MIVA Empresa Bugs?

Two bugs on Mia, not confirmed on Empressa.

file_create(l.file, 'data', somedb.d.field) Kills Mia
Assigning the db field to a local variable, and then using the local variable in the file_create solves the problem.

using bf_encrypt on an empty string kills Mia.

file_read(l.file, 'script", somedb.d.field) Kills Mia (5.06) as well.

Irene

[mvmarkus]

Re: Miva Merchant Empresa Bugs

geez it hasnt been implemented on the main servers yet and people are already complaining that its overpowered.... cant ANY class get anything good without ppl QQing bout it?

Hmmm, what are you talking about?

Markus

[Rick Wilson]

Re: Miva Merchant Empresa Bugs?

Markus,

I think I accidentally approved spam, I've deleted it and him.

[Silas Creative]

Re: Miva Merchant Empresa Bugs?

Having a strange bug with Empresa 5.08 on Hostasaurus server...

I get an error with this...
<MvASSIGN NAME="l.val" VALUE="{fsrename(l.old, l.new)}">
that 'moves' a file/dir from the data dir, to the web dir. *It seemed to work on files, but not on dirs.

The other command that failed was 'tar_extract'

Anyone have any thoughts?

[Emma]

Re: Miva Merchant Empresa Bugs?

I think I found a good one. Here is the post:

http://extranet.mivamerchant.com/for...d.php?t=106096

Best
Claudiu

[Emma]

Re: Miva Merchant Empresa Bugs?

I think I found a good one. Here is the post:

http://extranet.mivamerchant.com/for...d.php?t=106096

Please ignore. I wasn't aware about the feature... Thank you

[eageclott]

Miva Merchant Empresa Bugs

I dont personally care for them, but have you tried paypal?