Miva Merchant Empresa Bugs?

[emione]

Re: Miva Merchant Empresa Bugs?

5.07 is available if you need it, just have your host call and request it.

It's going to stay in "beta" for a while because we're not done adding things, but the McAfee problem is fixed and has no issues.

In addition, McAfee appears to be the only scanning company currently taking this perspective (that insecure cookies which contain no sensitive information are a security risk) and you could always switch scanning companies.

Thanks for the reply Rick.
That's good to hear the McAfee problem is fixed.
Any ETA on when you'll be done adding things and release it from beta?
Dotcomhost has been most patient with me (and I'm sure many others) about trying to keep up to date on this issue. I think I'd prefer waiting until it's out of beta if it's not going to be too much longer. I don't want to create a bunch of work for Dotcomhost going back and forth with different versions or updates.

[Rick Wilson]

Re: Miva Merchant Empresa Bugs?

5.07 is available if you need it, just have your host call and request it.

It's going to stay in "beta" for a while because we're not done adding things, but the McAfee problem is fixed and has no issues.

In addition, McAfee appears to be the only scanning company currently taking this perspective (that insecure cookies which contain no sensitive information are a security risk) and you could always switch scanning companies.

[emione]

Re: Miva Merchant Empresa Bugs?

Remik,

I agree with that, let me see what it would take to make the current 5.07 official.

Rick, any ETA on when 5.07 is going to be official?

I have this ongoing PCI compliance issue (persistent cookies set in non-secure mode) with McAfee Secure. I can't believe I'm the only one getting tired of not being PCI compliant and I keep getting the notices about the issue.

Isn't there some way 5.07 can be officially released out of beta so this problem can be taken care of?

McAfee has removed the option of marking this as an "acceptable risk", so there's no way around this unless 5.07 takes care of it.

[d_host]

Re: Miva Merchant Empresa Bugs?

Grazie!

[Rick Wilson]

Re: Miva Merchant Empresa Bugs?

Remik,

I agree with that, let me see what it would take to make the current 5.07 official.

[d_host]

Re: Miva Merchant Empresa Bugs?

Totally understand that part. But if anything, it would be nice to know there's a non-beta version that addresses the dreaded persistent cookie issue. We continue getting tickets from clients asking to have this PCI vulnerability resolved, but when we mention "beta" almost every client has declined having 5.07 installed so far.

Addressing security issues vs adding more features should really be two separate items. I hope the "adding features" part doesn't make it more important than releasing a fix for a security issue - even if it is rather minor, but unfortunately preventing some clients from getting their sites PCI certified.

[Rick Wilson]

Re: Miva Merchant Empresa Bugs?

It's going to go into a public beta here shortly, we may leave it in that state for a while so we can keep adding features without revving it. The hold up isn't stability it's the difficulty in releasing too many Empresa updates.

[d_host]

Re: Miva Merchant Empresa Bugs?

5.07 also addresses some PCI compliance security issues (persistent cookies set in non-secure mode), but as of today, 5.07 is still in beta. You should be able to get a copy from Miva direct - it's not available as a general download on their ftp site just yet.

Rick, or anyone else at MM... is there an ETA on when the final version of VM 5.07 may be released?

[truXoft]

Re: Miva Merchant Empresa Bugs?

Just a follow-up for the arithmetical bug in v5.06 reported more than year ago. As Mark claimed, being serious it ought to be handled with priority, so I wonder if it was fixed in the meantime. Was v5.07 with the bug fix already released? If so, where can it be downloaded? I did not see anything new on the FTP server since a while.

[timeshifting]

Re: Miva Merchant Empresa Bugs?

Hi,
Another bug seems to be XHR POST's from Firefox 3 fail because the XMLHTTPRequest adds the charset to the mime type. It looks like Empressa is doing a literal string match and chokes on the "; charset=UTF=8" part, returning a 500 Internal Server Error on Apache/Linux, and a blank body 200 OK on Mia/Win32.

Normal Post:

Content-Type: application/x-www-form-urlencoded

XHR Post:

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

It would be good if Empressa could parse the headers correctly as per RFC.

Matt.

[Emma]

Re: Miva Merchant Empresa Bugs?

Hello everyone....

Create a file with " <) " inside. Try to call it from another file.. and you'll get:
Runtime error in /yourfile.mvc @ [00000000:0000002c]: W:yourfile.mv: Line 1: MvCALL: Unexpected EOF in tag

Is there any workaround for that problem?

Thanks in advance
Claudiu

[Mark Johnson]

Re: [IMPORTANT] Critical Arithmetic Bug in 5.06

Ivo,

Thanks for catching this one. As it is potentially quite serious we have begun looking into it already. I will post when we find a cause and when we expect to have a fix in place.

[truXoft]

[IMPORTANT] Critical Arithmetic Bug in 5.06

Empresa and Mia v5.06 parse simple arithmetic functions wrong and inconsistently which may lead to completely false results in simple calculations. This happens when an expression is passed through MvDO, and possibly in other MIVA Script tags too. Below there is a sample code demonstrating the fatal bug. Compile it and run to see the illogical results for the simple expression A - B - C. In old versions such expressions worked well; currently it is necessary to transcribe them into logically identical equivalent of A - (B + C) :

<h3>Plain expression</h3>
<MvASSIGN NAME="l.res1" VALUE="{5 - 1 - 3}">
<MvASSIGN NAME="l.res2" VALUE="{5 - (1 + 3)}">
<MvEVAL EXPR="{result(l.res1,l.res2)}">
 
<h3>Expression in a function argument in MvDO</h3>
<MvDO FILE="test.mvc" NAME="l.res1" VALUE="{test(5 - 1 - 3)}">
<MvDO FILE="test.mvc" NAME="l.res2" VALUE="{test(5 - (1 + 3))}">
<MvEVAL EXPR="{result(l.res1,l.res2)}">
 
<h3>Expression directly in MvDO</h3>
<MvDO FILE="test.mvc" NAME="l.res1" VALUE="{5 - 1 - 3}">
<MvDO FILE="test.mvc" NAME="l.res2" VALUE="{5 - (1 + 3)}">
<MvEVAL EXPR="{result(l.res1,l.res2)}">
 
<MvFUNCTION NAME="test" PARAMETERS="val">
 <MVFUNCRETURN VALUE="{l.val}">
</MVFUNCTION>
 
<MvFUNCTION NAME="result" PARAMETERS="val1 VAR, val2 VAR">
 <MvIF EXPR="{l.val1 NE l.val2}">
   <MVFUNCRETURN VALUE="{'<span style="color:red">' $ l.val1 $ ' != ' $ l.val2 $ '</span>'}">
 <MvELSE>
   <MVFUNCRETURN VALUE="{l.val1 $ ' == ' $ l.val2}">
 </MvIF>
</MVFUNCTION>

The test program should show three times 1 == 1 but instead it shows the incorrect result 7 != 1 for the last two calculations passing the expression through MvDO. MvASSIGN and MvEVAL work correctly, but I suspect the same problem may pop up in other commands too (such as MvFILTER, index expressions, etc).

[leslienord]

Re: MIVA Empresa Bugs?

Naw - I have one of those long laundry lists of work work work too.

[BillBuilt]

Re: MIVA Empresa Bugs?

N/P Sorry if i was rude.... one of those awful "work, work, work and get nothing done" days.