Announcement

**Rick Wilson** · 05-10-10, 10:02 AM

Re: Miva Merchant Production Release 7 (aka Wombat) Is Released - Part 2

5211: Missing tr tag from first row of tabs in DrawTabs
5215: PopupFileUpload() contains misspelled encodeURIComponent()
5216: Account links use non-secure urls
5222: Runtime >> The Logout Link on Customer Edit screen should be using secure_sessionurl
5223: MMUI >> Runtime >> Customer Account page only shows up on Customer Login
5233: Encryption Keys created through provisioning have empty passphrases
5235: Cannot assign an attribute template to a product more than once
5239: Chase AVS only allows US, UK, CA and GB
5240: Currency, tax, or UI modules cannot create self-referential items during installation
5241: TemplateManager_Create_Page_LowLevel aborts page creation if items from Template_Items do not exist
5242: Importing Category header/footer from flat file does not create compiled template file
5243: XSS: Custom_Fields[n]:name on category batch edit screen
5244: XSS: Submit_Config_Data:login_url on Miva Merchant Submit Configuration screen
5245: XSS: Order_Search on Legacy Order Processing batch edit screen
5246: XSS: Custom_Fields[n]:name on customer batch edit screen
5247: XSS: subTab on google checkout configuration screen
5248: XSS: Shipping_MvFedEx_Services[n]:name on shipping configuration screen
5249: XSS: Shipping_USPS_DomMethods[n]:name on shipping configuration screen
5250: XSS: Shipping_USPS_IntMethods[n]:name on shipping configuration screen
5251: XSS: Custom_Fields[n]:name on product batch edit screen
5252: XSS: Product List components on settings:fields_custom[n]:name
5253: XSS: Category Tree/List components: settings:fields_custom[n]:name
5256: XSS: Product Display components: settings:fields_custom[n]:name
5257: XSS: cmp-mmui-buttons: MMUI_Buttons[n]:prompt
5258: category_list tab has an infinite loop in admin
5259: product_list tab has infinite loop in admin
5270: Custom field provisioning does not verify that the module is installed in the store being provisioned
5293: After deleting a module, control should return to the module batch edit screen
5294: PayPalPro returns no report fields
5309: The copyright dates should be updated.
5313: Canadian VAT not calculating properly
5314: Cannot enable product inventory and set stock level in the same tag
5316: No provisioning for domain SEO settings
5320: remove.mvc not removing tables
5322: InventoryProductSettings_Update does not set proper defaults for non-present optional tags when enabling inventory
5323: PayPal IPN - Shipping Address that's entered on PayPal's side, does not come back to Miva Merchant.
5324: Future PRV_Tag_Date dates are generated with incorrect daylight savings time adjustment
5339: AttributeTemplates.d.refcount not updated
5343: Cannot swap between attribute templates via product update provisioning
5346: SkinsComponentModule_Export fails to export content from more than one item
5347: Pages' IDs, codes and names are not available to the template language at runtime
5348: When modifying a page during uninstall, a module must remove references to all its items
5349: Framework install code fails to apply templates for components with multiple items
5352: NTFD page outputs 200 Success Status code (was: Need to create page-level custom HTTP header component)
5362: prodimpt: Setting the Track Product Inventory field to "No" does not remove relevant records.
5366: UPS is still using the old mmp.miva.com URL
5371: setup.mv: Code which pre-populates UpgradeInstalledPatches was not merged from feature-upg-4
5375: PayPal Pro was missing the build_ident tag.
5378: Flat file import modules allow invalid email addresses for password recovery email field
5379: Admin_Open_Store does not load any information about the UI module
5380: Store_Open: g.Store_Framework_Inuse code is inefficient and inexact
5407: USPS Online Rate Calculation is allowing bolded fields to contain empty values
5416: Order Encryption allows creation of keys with whitespace as prompts
5419: Edit Store >> Maintenance Mode tab >> Warning and Maintenance Messages should be top aligned.
5457: Customer, category, and order export modules do not validate the user-defined email address field
5458: SEO settings functions aren't encoding ampersands when generating traditional links
5459: MMUI Sitemap component has duplicate Miva Merchant footer link in its default template
5465: cmp-mmui-orderlist: Component does not reset to point + click mode from advanced mode via provisioning
5470: MMUI: Sitemap page doesn't support css_fw
5471: Edit Product: Cannot assign an attribute template to a product if it has a colon (:) in its code
5473: setup.mv references support.smallbusiness.miva.com
5482: cusimpt: Does not validate customer login
5495: Payment Configuration Wizard is displaying invalid characters
5499: cbamazon: Shipping Method descriptions use Amazon service levels instead of Merchant configured descriptions
5524: cswizard: Creates encryption keys with empty passphrase

**Rick Wilson** · 05-10-10, 10:02 AM

Re: Miva Merchant Production Release 7 (aka Wombat) Is Released - Part 3

Other Changes
-------------
New order management functionality:
- Tracking of order and order item status.
- Backorder management.
- Support for multiple shipments in a single order.
- Orders may now be created, updated, and otherwise manipulated through the administrative interface.
- Streamlined user interface for easy integration into an existing order processing workflow.
- Template-based shipment picklist.
- RMA generation and return shipment processing functionality.
- New modules allow notifications to be sent when orders are shipped or RMAs are issued or received.
- The previous order management interface is still available as """Legacy Order Processing�� under the Utilities item in the left navigation window.

Support for advanced payment processing operations:
- Multiple payment transactions may now be associated with a single order.
- Support for split capture, refunds, and voids.
- All modules may be used for simple authorization and capture. The following modules support the advanced payment operations:
- CHASE Paymentech Orbital Gateway
- Innovative Gateway
- Order history and status functionality has been added to the shopping interface.
- Customers may view their order history using their Customer account, or look up order history based on billing email address and zip code.
- Encryption private keys are now (optionally) stored in a separate database from the encrypted data, as required by PA-DSS.
- Address Line 2 is now available, with an API compatibility layer for interoperability with old 3rd-party modules.
- Shipping labels may now be generated from inside the administrative interface for USPS and UPS.
- An entirely new CSS-based user interface is now available, and is the default option for newly created stores.
- Redesigned Import and Export module user interfaces.
- Inventory availability and dynamic pricing may now be controlled at the attribute level:
- A new setting (the I column) on the Attributes tab allows attributes to be flagged as Inventory Attributes, and two new tabs on the Edit Product screen are now available for configuring combinations of attributes.
- A new StoreMorph item, "attributemachine", provides functionality to automatically enable/disable attribute values and display live inventory and dynamic pricing.
- Newly added "Active" button on the Product Batch Edit screen allows the user to display only products that are marked as active. This is now the default setting.
- If a secure URL to the administrative interface is configured, a redirect is now used to force administrative users to log in securely. For debugging/repair purposes, the redirect may be avoided by appending "NonSecureMode=1" to the URL.
- Runtime customer and affiliate login error messages are now more ambiguous to avoid leaking sensitive information.
- Provisioning functionality is now available for the domain country list.
- Administrative interface audit logging using the UNIX syslog() facility has been added for PA-DSS compliance, when using the 5.07 engine. A new Domain table column, "log_fac", controls the logging facility used for these messages. The default is "local2".
- A new PA-DSS Checklist tab has been added to the Domain Settings screen. This tab will verify that the software has been configured according to our PCI Implementation Guide.
- The creation date of order encryption keys is now tracked so that the keys may be rotated on a regular basis, as required for PA-DSS. The creation date is displayed on the Store Encryption screen, and the age of the current key is verified on the PA-DSS Checklist tab of the Domain Settings screen.
- The minimum encryption key passphrase length is now 16 characters for newly created keys, as required for PA-DSS.
- User supplied passphrases are now XOR'd with a software key when encrypting a private key, as required for PA-DSS.
- Administrative sessions are now managed by two tokens. A cookie controls visual access to the administrative interface, and the parameter Session_ID now controls actions. Session_ID must be present for administrative actions to execute, and the cookie must be present to render display elements. Existing modules should not require modification as long as they use the existing admin UI API functions and the g.sessionurl or g.secure_sessionurl variables. The admin session cookies expire on both the client and server in the timeout period specified by the domain settings, and are set using the "secure" cookie flag. These changes are intended to combat session fixation, cross site request forging, and session leakage.
- The administrative UI code now passes the Screen and Tab parameters through the URI, to make the HTTP access log more informational. Session_ID, when possible, is passed through POST parameters. New variables g.adminurl and g.secure_adminurl provide the correct URL to the administrative interface without the Session_ID parameter that is present in the sessionurl variables.
- Removed an unnecessary MvLOCKFILE that reduced performance with a large number of concurrent admin accesses.
- The administrative login screen and all administrative screens which collect credit card information now explicitly disallow browser autofill.
- Modules will now fail to update if a store-table level feature (UI, Currency, or Tax) has been added or removed while the module is in use by one or more stores.
- The Product Attribute XML export module now has an option to control whether existing attributes are deleted or updated when running the exported XML data.
- New runtime session management system for enhanced security and to avoid cookie errors from PCI scanners.
- New administrative settings for controlling the output of shopping interface cookies and when session identifiers are included in links.
- Attribute templates may now be "used" on a product more than once, by specifying a unique attribute code when assigning the template to the product.
- The "Copy?" checkbox is now hidden when editing an Attribute (it was never functional in this case).
- Attribute and option prompts are now available through the StoreMorph tokens attr_prompt and opt_prompt.
- SEO settings may now be configured through provisioning.
- When using the 5.07 engine, date/time stamps properly account for daylight savings time.
- The ID, code, and name of the current page are now available through the StoreMorph tokens page:id, page:code, and page:name for all pages.
- A new component, cmp-mv-content, provides one or more templates that may be pulled into pages.
- A new component, cmp-mv-http-headers and associated item http_headers allow HTTP headers to be controlled on a page. This component is used to output a 404 Not Found error on the NTFD page.
- admin.mvc now sets g.Store_Module_UI, which contains the path to the module file providing the current store's UI
- Full module records for Tax, Currency, and UI modules are now available in g.Store:tax_mod, g.Store:currncy_mod, and g.Store:ui_mod
- Category parents are now validated for circular heirarchies at the database layer, in Category_Update. If a circular heirarchy is detected, the update will fail. Module developers may call Category_Validate_Parent( category var ) to perform the heirarchy validation separately.
- Implemented the buySAFE Buyer Preference feature.
- The Create Store Wizard now creates stores using CSSUI.

Announcement

Miva Merchant Production Release 7 (aka Wombat) Is Released - Part 1

Miva Merchant Production Release 7 (aka Wombat) Is Released - Part 1

Comment

Comment