• 5969: authnet shows captured in admin even though authnet is holding it for review
• 6310: Framework export/install functions inconsistently tokenize store IDs encountered in external file sources
• 6324: AJAX_Call_LowLevel content-length check breaks functionality when mod_deflate or mod_gzip is enabled
• 6325: cmp-mv-adminorderfields: OrderItem list is not sorted
• 6326: Display order should always be used when generating variant codes
• 6338: chasepaytech: PaymentModule_Process returns incorrect value on some errors
• 6340: chasepaytech: PaymentModule_Authorize ignores the auth/auth capture setting
• 6347: templateorderemails: Generated template content is sent in a manner that violates RFC 821
• 6355: Admin, utilities, imports, edit settings, assign all, clicking assign all button causes JavaScript error.
• 6357: Upgrade_Store_Index_Exists does not handle deleted records in MivaSQL schemas properly
• 6358: Authorize.Net: MD5 mismatch error isn't being returned correctly
• 6359: Authorize.Net: Commas in the billing/shipping fields aren't being stripped
• 6360: Report configuration using select multiple="multiple" only returns first set value.
• 6362: Import add/edit dialog not sending multiple values from select elements
• 6363: Manage Orders: Authorize dialog not sending multiple values from select elements
• 6364: Shipping label dialog not sending multiple values from select elements
• 6366: Authorize.Net: Sending incorrect first and last name fields
• 6367: Authorize.Net: cust_id field is no longer being sent as "Online Customer"
• 6368: Product Batch Edit screen forces long product codes to wrap
• 6369: next and previous buttons in Edit Customer display Not Found Error
• 6370: igsgroup: PaymentModule_Process returns incorrect value on some errors and does not properly handle legacy sale mode authorizations
• 6371: paypalpro: PaymentModule_Process returns incorrect value on some errors
• 6372: Authorize.Net: Legacy PaymentModule_Authorize function isn't passing the correct amount variable
• 6373: igsgroup: MvCALL Errors are fatal and display in IgsGroup_Call
• 6374: LaunchPad: Cannot configure a button to link to a "log" module
• 6375: LaunchPad: Links are allowed to 5.70 API import modules that do not support the IMPT screen
• 6376: Authorize.Net: PaymentModule_Process returns incorrect value on some errors
• 6377: Authorize.Net: MvCALL errors are fatal and display
• 6379: Admin, utilities, legacy order processing, search when viewing all orders always returns no results.
• 6381: Authorize.Net: Legacy PaymentModule_Authorize is calling OrderPayment_Create
• 6382: paypalpro: Legacy PaymentModule_Authorize returns Unable to authorize payment: The totals of the cart item amounts do not match order amounts.
• 6383: Authorize.Net: Legacy PaymentModule_Authorize is sending a l.order arguments when they should be from g.Basket
• 6384: Order_Update_Payment updates the wrong OrderPayment record if a 5.60 or newer API module creates an OrderPayment record in PaymentModule_Process
• 6385: Legacy order processing code, thru Order_Update_Payment, gets encryption key refcounts out of sync if OrderPayment_Update was called in PaymentModule_Process
• 6386: Authorize.Net: SSN is not sent in the request when using Secure Source Validation
• 6387: Coupons with the same total as a basket sometimes display a total of 0.01 or -0.01
• 6388: First Data Global Gateway, CVV2, 500 Internal Server Error when cvv code is incorrectly formatted.
• 6390: Authorize.Net: Test mode field is not being included in the request
• 6391: cmp-[cssui|mmui]-invc-order components needlessly calculate l.total
• 6395: admin/group.mv: Action_Group_Update makes extra database calls and does not properly handle database errors
• 6396: admin/product.mv: Screen_Product_BatchEdit uses MvEVAL to construct HTML tags instead of just embedding expressions in the tags
• 6397: features/imp/imp_ad.mv: ImportXGroup_Load errors are not handled in Import_Group_Update
• 6398: features/imp/imp_json.mv: JSON_ImportList_Load_Query does not specify a table alias for search/sort columns
• 6399: features/upg/upg_ad.mv: Upgrade_Install_Error passes the error message through a URL parameter when not required
• 6400: features/upg/upg_ad.mv: errorcode is not specified when calling UpgradeProgress_Patch_Insert or UpgradeProgress_PatchStep_Insert
• 6401: Authorize.Net: Capture transactions secure data is missing fields
• 6402: New Authorize.net module stores pay_data differently than the previous version
• 6403: authnet.mv: Subversion revision 26586 code review remediations
• 6404: fdggwsapi: Method provisioning does not work
• 6407: PA-DSS Checklist: Log File and Log Level are always blank
• 6408: Authorize.Net: Require Admin CVV setting uses incorrect tag name in provisioning
• 6409: Authorize.Net: Provisioning requires Store Entire CC Number setting to be true when in auth only mode

Changes

Template Based Emails

• New "Visible For" checkboxes allow users to explicitly control whether a particular email appears on the Template Based Emails tab of the Edit Customer screen, Edit Order screen, or both.

Bugs Fixed

10268: Module: mvga: Provide ecommerce category values on the INVC page
10922: Module: cmp-cssui-stateselect: Having <select one> as a state option empties the state select box at runtime.
10923: Utility Library: Duplicate email headers (From, To, CC, Subject) when using engine 5.17 or older
10924: Module: mvfedexsoap: Mvfedexsoap doesn’t return an error if updating the settings fails due to SSL misconfiguration.
10925: Module: customfields: Custom fields installation throws fatal error if the store or shipment item extensions can not be created.
10929: Module: mvga: Google analytics returns fatal error on install if there is a page compilation error.
10932: Module: cmp-mv-imagemachine: Empty thumbnail images are output in the JSON at runtime
10933: Module: mvga: Google analytics should leave notes on templates that it updates.
10966: Module: mvga: modules/util/mvga.mv: Google Analytics module does not include the Search parameter in the URL sent to Google
10967: Module: customfields: Module_Provision_Store_OrderField_Value should use PRV_Attribute_Number for the "order" attribute
10968: Module: customfields: Module_Provision_Store_Group_Update: The Code and Name subtags should not be required
10971: Module: productimport: Permitted Shipping methods get erased if specified during product update from CSV.
10991: Administrative Interface: Add import, module specific dropdown fields lose alignment after a validation error.
10993: Module: prodexp: Export products to flat file, the Inventory fields select box should be updated
10997: Import Subsystem: Module import fields are always being set to bold

Bugs Fixed

11467: Module: mvusps: USPS_BuildRateRequest_FromBasket modifies the reference package weight
11610: Module: mvusps: Express Mail and Express Mail International are being renamed to Priority Mail Express and Priority Mail Express International, respectively
11724: Module: mvusps: No shipping rates are returned after 2013-07-28 USPS API changes

New Features

NEW PAYMENT MODULE: Intuit Merchant Services

NEW PAYMENT MODULE: Amazon Payments

• New Amazon Payments payment module allows shoppers to use shipping and payment information from their Amazon account during checkout, without requiring them to leave the site (like Checkout by Amazon).

Admin Changes

Administrative session tracking now separately displays the number of logged-in users and active sessions. Previously it displayed all sessions lumped together, which lead to confusion as the number of sessions was occasionally higher than expected. Additionally, a new tab, Administrative Sessions, has been added to the Domain Settings screen. This tab allows Administrator-privilege users to view a list of valid Administrative Interface sessions.

Shipping Changes

The Endicia Shipping Labels module has been updated to display the current Endicia logo and use the new naming for USPS Priority Mail Express shipping methods.

Security Changes

Security improvements have been added to prevent a malicious shopper from forcing an unavailable shipping method to be used when placing an order.

Other Changes

• The PayPal Payments Pro and/or Express Checkout payment module has been updated to support Bill Me Later and PayPal's new In Context Checkout, which executes the Express Checkout process in a lightbox, without taking the shopper to PayPal's website. In Context Checkout is enabled with an option inside the module, however template code changes are also required. Please see our Community Forums for additional information.
• The Variant Import module now supports import of custom fields.
• Google Wallet has been discontinued. Google is retiring its Google Checkout products on November 20th, 2013.
• Checkout by Amazon has been discontinued at Amazon's request. The module will continue to function for existing merchants but will no longer be updated. We recommend that merchants transition to the new Amazon Payments module.

Bugs Fixed

11009: Module: variantimport: Variant Import should support custom fields like Product Import
11010: Module: variantimport: Variant import part product should use the product columns when creating a part product
11112: Module: customfields: JSON_CustomFieldGroupList_Load_Query does not use DB_OPENVIEW_Range so pagination never works correctly
11128: Module: variantimport: Creating Variants can not properly be created due to Part Product being updated from previous row instead of creating new product
11183: ZPL Preview: Java "application contains both signed and unsigned code" error when viewing a ZPL label with Java 7u21
11270: Module: paypalpro: during install the column "finalCaptr" is not listed in the INSERT INTO sNN_PaypalPro.
11418: Module: endicialabels: Update Endicia logo image
11451: Shipping/Packaging Rules: Rename ShippingMethodRules_Adjustted_Price to ShippingMethodRules_Adjusted_Price
11453: Shipping/Packaging Rules: Shipping method rules restricting the availability of a shipping method can be bypassed at runtime
11511: Administrative Interface: Empty Secure Root Directory for Graphics configuration when logged in securely breaks Additional Image uploads
11517: Module: upsxml: Packages should have a total minimum weight of 0.1lbs so that rates are always returned.
11520: Module: templateorderemails: unable to send a manual email if the email has no "send when" triggers set
11524: Shipping/Packaging Rules: Product shipping method exclusions can be bypassed at runtime
11593: Core JSON: Session_ID and Session_Type must be passed to json.mvc as POST parameters
11692: Administrative Interface: Generate shipping label "To" dialog can be set to blank space
11722: Module: paypalpro: during checkout PayPal pro should use the name attached to the selected address and not the account holder’s name.
11746: Database Layer: Administrative sessions for a user should be deleted when the user is deleted
12124: Module: variantimport: Variant Import is missing the ImportModule_Persistent_Provision function
12126: Module: variantimport: ImportModule_Persistent_Validate needs to validate the mapped columns when not using auto map
12130: Module: variantimport: Track Product Inventory is never used and should be utilized to track product and part products
12152: Module: customfields: DrawRadio function call does not use encodeentities on the text parameter
12156: Administrative Interface: Session Token in URL: Left navigation "Pack Data"
12157: Module: paypalpro: Session Token in URL: Left navigation "Delete PayPal Tokens"
12158: Administrative Interface: LaunchPad buttons that include an Action parameter include a Session Token in a URL
12160: Module: buysafe: Session Token in URL, multiple locations
12162: Module: vat: Session Token in Add Product and Edit link URLs
12164: Affiliates: Database error when clicking "Payout (This Affiliate Only)" link on Commission tab of the Edit Affiliate screen on MySQL in strict mode
12165: Affiliates: Session Token in "Payout (This Affiliate Only)" link on Commission tab of the Edit Affiliate screen
12166: Provisioning: Provisioning frameset passes session token in frame URLs
12167: Upgrade Subsystem: Session Tokens in multiple URLs during patch installation process
12169: Administrative Interface: Session Token in URL when running legacy batch reports from Manage Orders
12171: Reporting Subsystem: Fatal error when running custom export report module
12179: Administrative Interface: Add items dialog add+ button gets a style "display none" when it should not.

New Features

NEW MODULE: Canada Post

• New Canada Post module supports rate and label generation for both contract and non-contract Canada Post customers.

Bugs Fixed

12256: Module: amazonpay: Amazon Payments Advanced: Reinstalling the module does not reassign the items to existing AMAZONPAY_* pages
12259: Module: paypalpro: Authorization with delayed capture is always seen as immediate sale at paypal
12261: Module: amazonpay: Amazon payments edit settings screen has Confrim instead of confirm
12263: Module: amazonpay: Amazon payments uses sandbox urls when in production mode.
12270: Module: amazonpay: Message tag is not always included when an error occurs
12282: Module: amazonpay: ModuleProvisionStore_Settings will double-encrypt the previous (encrypted) secretkey if the SecretKey tag is not specified
12283: Module: qship: Quantity based shipping gets invalid shipping method when using 2nd tier or above pricing
12323: Module: paypalpro: Runtime BillMeLater informational links should open in a new browser window/tab
12324: Module: paypalpro: Runtime BillMeLater informational link positioning CSS should be removed
12369: Module: amazonpay: Amazon payments can not refund an auth+cap transaction
12382: Module: amazonpay: Amazon payment is sending store code as seller name.
12384: Administrative Interface: Synchro can no longer download a list of stores in pr8-update-11
12387: Module: variantimport: Product variant import doesn't insert records into InventoryProductCounts.
12407: Module: amazonpay: AMAZONPAY_OPAY page does not display shipping and tax charges

• 6333: templatebatchreports: Misspelling: "Email Adress" in default templates
• 6334: templatebatchreports: Address boldfaced text looks bad when wrapped
• 6335: templateorderemails: Address boldfaced text looks bad when wrapped
• 6336: authnet: Module allows cards of a different type than originally selected to be used
• 6415: Template Based Order Invoice does not display the correct item subtotal
• 6417: cmp-mv-adminorderfields: Special characters in payment/shipping module fields should be converted to _
• 6418: Admin, Manage Orders, edit order, when refunding a large dollar amount, buttons are pushed off of dialog box.
• 6420: linkpt: Tabs were not renamed to reflect legacy api status
• 6421: Admin, Manage Orders, edit order, when capturing a large dollar amount, buttons are pushed off of dialog box.
• 6422: Admin, Manage Orders, edit order, when voiding a large dollar amount, buttons are pushed off of dialog box.
• 6423: Numerous errors in the handling of multiple periodic license number validation failures
• 6424: Uploaded additional images and generated images do not get explicit permissions
• 6425: productimagecustomfields: Module does not properly handle an image type being set to a blank value
• 6427: Template Based Order Emails all missing html and body tags

• 5848: attempting to edit a module with no modulexfeature record gives fatal error
• 5856: payflow pro xml has a space character in the billing country causes AVS problems
• 6186: InventoryProductSettings_Update creates InventoryProductSettings and InventoryProductCount records when inventory is not enabled
• 6244: "Delete PayPal Tokens" link appears under Utilities to Users with View-only privileges of Utility Settings
• 6328: paypalpro: Unable to checkout with JavaScript disabled
• 6330: paypalpro: Address mismatch returns shoppers ot the OSEL page, where they can't do anything about the invalid address
• 6332: Email, Phone, and Zip code are not validated for form when they are optional
• 6343: templatebatchreports: Default templates do not page break between orders/shipments when printing
• 6392: with strict mode enabled you get a fatal error when attempting to add an item to your basket
• 6393: cmp-cssui-hdft: Compile errors in global header/footer template result in empty tab
• 6405: PayPal Express Checkout: Sales tax is not properly calculated when a customer checks out from Canada
• 6430: User that is a member of multiple groups loses all privileges if one group is deleted.
• 6432: Administrative sessions can timeout during a long file upload
• 6433: Template based order email, Order confirmation: customer, does not display correct item subtotal.
• 6434: Template based order email, Order confirmation: Merchant, does not display correct item subtotal.
• 6435: StoreWizardModule_Validate_Step is always called with an empty module parameter
• 6437: IE6: Selects show through modal backing after scroll
• 6439: Typo on license manager lockout and validation failure screens
• 6442: Admin, manage orders, edit order, add item, look-up list formatting breaks after adding an item that has attributes, in Google chrome.
• 6445: newElement does not properly set className in IE6, causing styles not to be applied
• 6446: cmp-mmui-prodlist: No provisioning for "Layout" setting (settings:mode)
• 6447: Image management: items per page does not work correctly with mivasql.
• 6448: Image management: delete unreferenced, process freezes when deleting a large number of images in mivasql.
• 6450: Image management: check for updated images, creates a 0kb image file if the file its looking for dose not exist. (windows server only)
• 6452: Chase payment gateway does not store CC expiration date
• 6453: productimport: Does not properly handle empty fields when updating a product record
• 6458: Manage Orders: Relative date ranges (last N days) operate on hours instead of complete days
• 6459: fdggwsapi: Transactions cannot be placed using Discover or Diners Club cards
• 6460: fdggwsapi: Pass Miva Merchant Order # in User ID field to be more compatible with the old linkpt module
• 6464: Image Managment link is displayed in the left navigation for users regardless of their product privileges
• 6466: customerimport: Does not properly handle empty fields when updating a customer record
• 6467: Runtime customer login fields need to have autocomplete disabled

PRODUCT AND CATEGORY PAGE IMPROVEMENTS [MMUI and CSSUI]
• Alternate Display Page - Merchant can set an Alternate Display Page for Product or Category.

BASKET CONTENTS PAGE [MMUI and CSSUI]
• Shipping, Handling and/or Sales Tax can be displayed in Basket Contents.

• Store-wide Weight and Dimension Unit settings:
  • Weight Units can be set to Ounces, Pounds, Grams or Kilograms
  • Dimension Units can be Inches or Centimeters
• Store-wide Shipping Rules - New Admin page provides the following options:
  • When no Shipping Methods are Available:
    • Use Fallback Shipping Method
      -OR-
    • Display Error Message and Redirect Shopper to Page - Merchant may select either a fallback shipping method or a page to which to redirect shoppers
  • Global Handling Charge - Handling charge may be specified based on:
    • Order Subtotal
    • Quantity of Items
      -OR-
    • Shipping Weight
  • Handling charge can be Fixed, a percentage of the Shipping Amount or a percentage of the Order Subtotal. The handling charge can be included in the shipping rate or a separate line item.
  • Support for Global Handling by Google Checkout (separately displayed handling charge always included in the shipping rate)
  • Support for Global Handling by Checkout by Amazon (separately displayed handling charge always included in the shipping rate)
  • Shipping Method Rules:
    • Priority - Merchant can determine the order in which shipping methods appear
    • Renaming - Shipping method display name can be changed
    • Availability Restrictions - Shipping methods can be restricted by:
      • Basket subtotal
      • Quantity of items in basket
      • Total weight of basket
      • Geographic restrictions (restrict shipping to specific countries, states, zip codes)
      • Inter-method exclusions (one shipping method may trump another)
  • Product Shipping Method Rules - Shipping methods may be set on a per product basis, including the following options:
    • Product always ships in separate packaging
    • Limit to specific shipping methods
• Packaging Rules:
  • Configurable list of boxes - can specify the following:
    • Fallback Package Dimensions - If the item is too large for the merchant's largest box size, the software will select this option to permit realtime shipping rates
    • Pack by Quantity - Packaging is optimized by number of items per box
    • Pack by Weight - Packaging is optimized by weight per box
• Improved Shipping Label Generation:
  • A single order shipment may now contain multiple packages and generate multiple shipping labels.
  • Shipments can be reconfigured from the Generate Shipping Label dialog.
  • Improved label display screen with print button.
• New UPS rate calculation module that uses UPS API:
  • Replaces table-based UPS module and UPS Shipping Labels module
  • Negotiated rate support
  • Functional label generation, including international labels
  • Requires registration from within Miva Merchant

• Canonical Category Code - Merchant can set the Category for Smart Breadcrumbs on a per product basis.
• MySQL 5.5 Support
• Image Machine improvements - Resized JPEG image quality control
• IP address whitelist for maintenance mode - Merchant can specify IP addresses that are allowed access while store is offline.
• Product Sales Report module now includes both the Product Code and the Product Name in exported data
• Basket Inventory module - New module tracks inventory allocated to Baskets that has not yet sold allowing a definitive inventory count.

• 5067: Merchant handling of Require Shipping [x]
• 5832: Checkout pages use SALESTAX setting flag that is not configurable to display tax basket charges
• 6233: Miva Merchant is not compatible with MySQL 5.5
• 6463: JSON: Dummy baskets for Order_Recalculate_Charges and ShippingMethodList_Load_Order do not contain variant_id
• 6472: cod: The "COD Charge" basketcharge should not be created when the charge amount is $0.00
• 6473: config.mvc attempts to load language.dat, despite language functionality having been removed from most of the software
• 6478: Additional Images, edit image display order dialog has incorrect title
• 6481: Missing required shipping redirect page, exception errors are not handled correctly.
• 6483: Action_CalculateShipping permits empty g.ShippingMethod when shipping is required
• 6484: Shipping method select shows " ()" when shipping supermod has excluded all methods
• 6492: CyberSource: Transactions cannot be placed using Discover or Diners Club cards
• 6493: PA-DSS Checklist fatal errors are not reported correctly
• 6495: chasepaytech: AVSname field must be limited to 30 characters
• 6497: Design Your look Wizard on MMUI PR8 update3 unable to find function error
• 6499: Runtime: basket: handling charge is displayed on the basket page
• 6500: Runtime, OSEL, shipping method "display as" name changes once it is added to the order.
• 6501: USPS Online Rate Calculation has ShippingModule_Label_Invalid defined with only two parameters
• 6503: Free orders do not allow the fallback shipping method.
• 6506: Shipping rules, shipping method rules, negative values allowed
• 6508: Provisioning, ProductRelatedProduct_Assign allows a product to be assigned to itself.
• 6509: Packaging rules, box dimensions allow negative numbers.
• 6511: Shipping Method Rules, Shipping method options, shipping method is not encoded.
• 6512: Category tree components should figure out the current category when g.Category_Code is not present
• 6513: Product Batch Edit: "Edit Here" without SKU field visible wipes out product sku when updating
• 6514: Manage Orders/Shipments: Add Item and other dialogs lose ability to tab between controls
• 6515: Shipping rules: fallback shipping method always includes handling charge on OSEL page.
• 6516: Runtime: placing an order for a free item causes runtime error.
• 6517: Edit product: shipping rules: limit shipping methods always blocks all shipping methods.
• 6518: Frameworks: Missing close table tag on the apply framework screen
• 6520: Edit Variant dialog needs to resize modal backer when changing variant calculation method
• 6521: upsdevkit: is viewable from a user with no privileges.
• 6524: Radio input values are not being sent through in import add/edit dialog
• 6525: Radio input values are not being sent through in report add/edit dialog
• 6526: Radio input values are not being sent through in labels configuration dialog
• 6527: Additional images, edit display order, images sorted inconsistently.
• 6530: Shipping Settings, Packaging Rules, Boxes, boxes do not paginate correctly.
• 6531: Shipping Settings, Packaging Rules, Boxes, pagination buttons wrap.
• 6532: Upsxml, Cant generate label for UPS Next Day air ® Early A.M. because the phone number never gets sent.
• 6533: Upsxml: The name UPS OnLine® tools should be UPS Ready®
• 6535: Upsxml: UPS Next Day Air® Early A.M. ® delivery confirmation is selectable during generate label.
• 6536: Upsxml: UPS shipping methods should use numbers instead of being spelled out.
• 6537: OrderShipmentLabel records are not being deleted when their OrderShipments are deleted
• 6542: Upsxml: generating a label for any international method returns the error "invalid or missing ship to phone number"
• 6547: UPSxml: "please enter a description" error pops up for all labels
• 6548: baskinv: numbers overflow bounding box on inventory tab of edit product page
• 6549: Store closed AND warning message both display when no baskets, no new customers set, and store offline
• 6550: Runtime: CTGY: breadcrumbs display when category item is not assigned to the page
• 6552: Shipping Rules:Redirect shopper to page:prod display: returns a blank category not found error.
• 6553: cmp-cssui-breadcrumbs: Breadcrumbs include siblings of parent categories when using the heirarchy from the category tree
• 6554: Last-Modified header is output with the incorrect date/time when "clientside" feature modules output content
• 6555: If non-number is entered for Items Per Page, Pagination becomes infinity and products do not display properly
• 6556: Product List Components: Rick finds the boldfaced portion of the Default Sort Method warning message confusing
• 6558: Upsxml: shipping method rules do not have automatic exclusions for "mvfedexsoap"
• 6562: Shipping labels should have a filename specified in their Content-Disposition header
• 6565: Fatal Error: MER-DBP-ORD-00001: Unknown column 'ship_info' in 'field list' when placing orders in runtime
• 6566: Basket Timeout is arbitrarily short
• 6581: upsxml: Must specify LargePackageIndicator for both rates and labels
• 6582: Basket Option weight is not included in packaging solutions
• 6583: Shipping label dialog does not validate the dimension or weight fields
• 6585: upsxml: Empty shipping method names when shipping from Ontario, Canada to San Diego
• 6590: OrderShipment_Insert does not handle legacy callers who do not provide batch_id
• 6591: Provisioning, shippingmethodrules_update does not work in mysql strict mode.
• 6593: Shipping settings, shipping rules, shipping method rules, exclusions do not work in mysql strict mode.
• 6594: Runtime, breadcrumbs, after applying the default cssui framework the bread crumbs do not work correctly.
• 6595: Shipping rules, handling charge, handling charge amount does not validate for non-numeric values
• 6596: shipping settings, packaging rules, pack by weight, Max weight field allows negative numbers.
• 6597: upsxml: No shipping rates returned on MivaSQL
• 6598: shipping settings, packaging rules, pack by quantity, Max quantity field allows negative numbers.
• 6599: upsdevkit: Chokes on not-perfectly-formed phone number
• 6600: Shipping settings, shipping method rules, Fedex inti and Fedex 2day freight are not excluded by UPS.
• 6602: Inventory status for variants containing a mixture of inventory and non-inventory parts are incorrect
• 6603: AttributeMachine.js throws the variant_changed MivaEvent before it updates the inventory and price fields
• 6604: Upsxml: unable to calculate shipping from manage orders screen
• 6605: Admin, shipping settings, shipping method rules, in the edit rules section "Priority" must be a positive value.
• 6608: Google Checkout: fatal error when configuring Google Checkout on mysql strict mode
• 6609: Provisioning: does not work in mysql strict mode
• 6611: Shipping labels dialog, when using IE6, clicking the remove package link takes you to index of /mm5
• 6612: Shipping labels dialog, you’re unable to move an item to a new package in IE6.
• 6613: Shipping labels dialog, can not print shipping labels from IE9
• 6617: Product inventory, unknown fatal error when increasing stock to 9999999999 on mysql strict.
• 6619: Upsxml: the shipping method U.S.P.S. first-class mail® is not automatically excluded.
• 6620: Shipping method rules, restrict to zip codes, text overrun in webkit browsers
• 6623: ui.js: GatherInputElements doesn't define its iterator variables as local
• 6625: shippinglabeldialog.js: EnableDisable function instantiates variable i that is not used
• 6627: Shipping label print dialog browser compatibility.
• 6628: boxaddeditdialog.js: function Save_Callback uses uninitialized iterator j
• 6629: features/shp/shp_ad.mv: Screen_ShippingRules function has incorrect closing bold tag
• 6630: Installing PayFlow Pro with a provisioning file doesn’t work in mysql strict mode.
• 6631: Provisioning: Affiliate_add doesn’t work in mysql strict mode.
• 6635: dbapi_mysql: DB_OPENVIEW_Range generates invalid queries when offset is specified without count
• 6636: cmp-cssui-breadcrumbs.mv: function Breadcrumbs_Generate_From_Cattree contains unnecessary condition
• 6637: and have no facility for controlling dmunitcode or wtunitcode
• 6640: cmp-cssui-prodlist.mv: URL building function is not encoding g.Screen
• 6641: cmp-cssui-prodlist.mv: URL building function is using encodeentities instead of encodeattribute
• 6642: cmp-mmui-prodlist.mv: Pagination links contain unencoded global variables
• 6643: cmp-mmui-prodlist.mv: Pagination links are using encodeentities instead of encodeattribute in some places
• 6644: cmp-cssuiprodlist.mv/cmp-mmui-prodlist.mv: local variable naming does not follow conventional standards
• 6645: util_public.mv: uses len() on variables instead of len_var()
• 6646: uspsxml.mv: ShippingModule_Basket_Apply function contains old references to an unused saturday delivery flag
• 6647: cmp-mv-stdcatfields.mv: Uses substring() and len() instead of substring_var() and len_var() in function Referer_Parser
• 6648: upsxml.mv: rounded output variables should be changed to encode at initialize - multiple locations
• 6649: upsxml.mv: g.UPSXML_InvoiceLineTotal is not encoded - line 1212
• 6650: upsxml.mv: l.request:invoicelinetotal as an output is not encoded
• 6651: cmp-cssui-breadcrumbs.mv: template code output mvt: entities should be encoded
• 6652: upsxml.mv: &mvt:global:Store:company; should be an encoded entity
• 6653: Timeout/large memory usage when a basket contains a large number of items
• 6654: Print label dialog, the display order of labels is reversed with mivaSQL
• 6655: No admin activity logging for shipping/packing rules
• 6656: baskinv.mv: storekey is unnecessary
• 6657: baskinv.mv: Multiple occurrences of l.settings being populated by different load functions
• 6658: shp_ad.mv: Unencoded variables (multiple) g.Store:dmunitcode
• 6659: boxaddeditdialog.mv: Unencoded variables (multiple) g.Store:dmunitcode
• 6660: Set Up Shipping wizard, the UPS shield is covered on the completion page of setting up UPS Ready® tools.(IE7 only)
• 6661: admin/order/details.js: var j in function Order_Detail.prototype.OrderItemList_Load_Callback is not declared
• 6662: shippingmethodprioritydialog.js: line end token ";" is not used in multiple locations
• 6663: util_public.mv: one replaced len is incorrect - line 2955
• 6664: frameworks/css_fw/components/product_list.htm: Prev buttons have incorrect offset
• 6665: cmp-cssui-breadcrumbs.mv: Category names in breadcrumbs are being entity encoded
• 6666: cmp-cssui-breadcrumbs.mv: &mvta: in Generate code is invalid: double encoding produces error
• 6667: cmp-mmui-prodlist.mv: fix logic path to return immediately if l.settings:page_disp_count EQ 0 OR l.settings:per_page EQ 0
• 6668: cmp-cssui-prodlist.mv: fix logic path to return immediately if l.settings:page_disp_count EQ 0 OR l.settings:per_page EQ 0
• 6669: cmp-cssui-prodlist.mv: if pagination is turned off, Generate_Code creates 0 values for Items Per Page
• 6670: cmp-mmui-prodlist.mv: if pagination is turned off, Generate_Code creates 0 values for Items Per Page
• 6672: Upsxml: label generation, the shipper ‘AttentionName’ field uses specified ‘ship from’ name, instead of the store owner.
• 6673: Generate shipping label, time out error when running test 1641
• 6674: Handling charge always appears on OSEL page when handling charge set to be included in shipping rate
• 6675: google: Google checkout, handling charge is always applied to orders.
• 6676: cbamazon: checkout by Amazon, handling charge is always applied to orders.
• 6677: Runtime error with Legacy Order Processing and UPS shipping module
• 6678: Upsxml: unable to calculate shipping from manage orders screen in mivasql

Payment Module Changes

The Authorize.Net module now displays customer and order information when processing refunds.

Shipping Module Changes

UPS Registration Changes

• Test mode credentials do not work in Production mode (this is the original behavior). Credentials created in Test mode will not function after switching to Production mode, even when the module is in Test mode. New behavior:
  • The UPS Registration Wizard now issues a warning when you register in Test mode.
  • The UPS module itself issues a warning when switching from Test mode to Production mode.

NEW MODULE: FedEx Web Services

• Provides rates and labels for the following FedEx shipping methods:
• Domestic Ground
• Domestic Express (1Day®, 2Day®, etc.)
• Domestic Freight
• SmartPost® (domestic US only)
• International Ground
• International Priority
• International Freight
• Supports alcohol shipments
• Supports packages containing dry ice
• 'FedEx Close Service' link under "Utilities":
• Allows the merchant to generate required Ground manifests and perform SmartPost® end-of-day operations

NEW MODULE: Endicia Shipping Labels

• For a monthly fee (payable to Endicia), Endicia provides a service with the following features:
• Generates prepaid shipping labels for USPS shipping methods
• Supports domestic and international shipping
• 'Endicia Account Activity' link under "Utilities":
• Shows all label activity performed within the given store

Label VOID Feature

• When viewing shipping labels, the user now has the ability to VOID all of the labels for a shipment.
• VOID is supported by:
• UPS Ready® Tools
• FedEx Web Services
• Endicia Shipping Labels
• VOID invalidates the label. If the user was pre-charged for the label (via Endicia, for example), their account is credited for the amount of the VOIDed label(s).
• When shipping multiple packages within a single shipment, FedEx and Endicia generate labels one at a time and are subject to partial label generation. When this occurs, the user is informed that they must VOID any labels that were generated for the shipment prior to the error. Selecting the VOID option voids all the labels in the shipment. UPS generates all the labels at once and is not subject to partial label generation.

Other Changes

GUI Improvement

The left navigation frame in the Administrative Interface can now be resized in all browsers.

Clientside Functionalilty

The following changes were made to clientside.mvc to improve performance and reduce errors:

• URLs now include a per-version identifier tp avoid JavaScript caching issues that caused errors during the deployment of PR8 Update 4.
• URLs now specify a long cache interval (30 days) to reduce the frequency of hits.

Returns Functionality

• Cancelled and returned items can now be deleted from an order.
• Cancelled items are returned to inventory when they are originally marked as cancelled. Therefore, deleting a cancelled item does not restock it.
• Returned items are never returned to inventory (either when the return is received or when the item is deleted) because returned items usually require manual inspection before being returned to stock for sale.
• The Receive Returns dialog box now contains a link that allows a user to cancel a return.
• When a return is cancelled, the items it contains are reset to the "Shipped" state with their previous tracking information.

NEW MODULE: Token List

• Displays the StoreMorph tokens available on a page.
• Shows which templates use a given StoreMorph token (useful when searching for XSS issues identified by a PCI scan).
• When a token is in use on the page, the 'View Variable on Live Page' link displays the page with every use of the token highlighted.
• The 'View All Tokens' function displays the page. As the user mouses over an in-use token, a tool tip is displayed with the name of the token.
• When the page displays specific product or category information, the module provides an edit field where the user can specify which product information to display in 'View All Tokens' or 'View Variable on Live Page' mode.
• The module uses the current user's runtime session. This allows the user to view the tokens for complex runtime situations (e.g., availability/price groups, complicated basket contents, etc.) by simply setting up the scenario in the runtime interface.
• On the OPAY page, the module presents a drop-down list of payment methods. This allows the user to view the tokens and specific display of each payment method on the actual store page.
• When the page displays order information, the module provides an edit field where the user can specify which order data to display.

Bugs Fixed:

• 5892: When an Item is marked as Returned, there's no way to Delete it from the Order
• 6474: Need to be able to cancel an RMA
• 6568: Password change screen can be bypassed
• 6624: Authorize.net Refunds
• 6671: Packaging rules, boxes, edit box, no validation error when entering dimensions with more then two digits behind the decimal.
• 6680: Attribute template, fatal error when adding an attribute template to a product in mysql strict mode.
• 6683: Provisioning, statetax, unable to configure state based sales tax with provisioning in a store using mysql strict
• 6684: SQL error when searching for "|\" from the Manage Shipments screen
• 6685: Runtime customer login fields need to have autocomplete disabled (in addition to the form)
• 6686: Cmp-cssui-prodlist.mvc: Product List layout, when in expanded mode, inventory message always displays as long.
• 6689: cmp-cssui-prodlist.mv: Missing space after the colon for the display of custom field prompts and values
• 6692: cmp-cssui-breadcrumbs.mv: Breadcrumbs will show category AND product as the current item if prod code and cat code are the same
• 6693: Order tabs disappear when viewing orders in IE.
• 6694: cmp-cssui-cattree.mv: SkinsComponentModule_Export_Item doesn't send custom fields
• 6695: cmp-mmui-cattree.mv: SkinsComponentModule_Export_Item doesn't send custom fields
• 6701: Attribute Machine shows attribute cost in page source
• 6702: CSSUI category_listing product:link token always includes the category
• 6703: Generate shipping label, packaging dropdown overrun when using large box names.
• 6704: Manage shipments, the selected shipping methods are not being displayed for new shipping modules, (upsxml, mvfedexsoap)
• 6707: shp_ut.mv: ProductShippingRules_BuildProductIDArray fails if product id is not a positive number
• 6713: cmp-mv-imagemachine requires a hit to json.mvc to load an initially selected variant's images
• 6714: upsxml: Module should warn and force reregistration on production/test mode change
• 6715: Package dimension and weight fields with trailing spaces generate validation errors
• 6719: cmp-mmui-basket: Shipping/Handling/Sales Tax checkboxes are wiped out by pressing update on a different tab
• 6720: cmp-cssui-basket: Shipping/Handling/Sales Tax checkboxes are wiped out by pressing update on a different tab
• 6730: UPS Ready Tools has no Product Delete function
• 6731: templateorderemails: Module should display an error and not attempt to send an email when there is no From or To address
• 6735: Error/slow performance when runtime viewing a product with many inventory attributes in mivasql
• 6736: Requested function: ProductVariantPricing_Update
• 6737: Admin Content Frame is not resizeable in chrome webkit.
• 6739: Duplicate order options/partially created orders when a tax or fulfillment module fails with a fatal error
• 6740: cmp-cssui-custfields: Toggle details causes validation error when fields are added to only billing or only shipping
• 6742: Manage shipments, view shipping label, unable to view shipping labels if the store is configured to use CGI URLs
• 6746: Typo in upgrade error message
• 6748: AttributeMachine.js: swatches are being assigned with new
• 6752: Item Extension create/delete are not logged in the admin activity log
• 6754: Admin: Products: Search field cannot find products while Canonical Category Code or Alternate Display Page boxes are checked.
• 6758: Table sNN_BasketInfo is not dropped when deleting a store
• 6769: Admin/nav.mv: Screen_NotesNavigation - returns 404 Not Found errors for image links "maintainable_*.gif"
• 6770: Authorize.net: admin_cvv field fails to update in MySQL strict mode
• 6771: Affiliate Program: unable to create an affiliate via runtime in MySQL strict mode
• 6780: Paypalpro: fatal error when deselecting "Require CVV2 in Admin" in MySQL strict mode
• 6784: Shipping rules: missing validation error message when setting Priority larger than 10 digits
• 6785: Shipping rules: when using IE7 shipping rules dialog boxes extend all the way to the right.
• 6793: Manage shipments, shipping methods are not encoded correctly.
• 6794: prodexp: Module generates invalid Provisioning XML when products have no alternate display page configured
• 6795: Provisioning, Product_Update does not handle Canonical Category, and alternate display page correctly.
• 6800: BestSellerList_Load_Offset has no ORDER BY and does not properly handle its "max_rec" parameter
• 6801: AttributeTemplateList_Load_Offset does not use ORDER BY
• 6802: cmp-cssui-breadcrumbs.mv: If viewing page PROD and no product is specified, blank space will be between home >> and Product Display
• 6811: Domain Settings: No validation is performed on the store selection UI module
• 6823: cmp-cssui-breadcrumbs.mv: MvIF expression should be checking for NOT ISNULL l.item:code instead of just l.item:code in function ComponentModule_Initialize
• 6827: DrawButtons_NextPrevious: XSS on g.Message, g.ImportMessage, and g.FW_WarningMessage
• 6828: Draw_ProgressBar: Possible XSS on unvalidated cycle_count and cycle_total_count parameters
• 6829: cmp-cssui-cattree: Custom field provisioning does not validate child tag names
• 6830: cmp-mmui-cattree: Custom field provisioning does not validate child tag names
• 6833: cmp-cssui-prodlist: tag is not output when saving a framework
• 6842: Admin: Various module type-specific Screen and Action functions do not validate that parameter Module_Code is a module with the appropriate features
• 6843: Report JSON functions do not validate report module features when a valid report is specified
• 6846: Password change and license accept cannot be aborted
• 6851: Add Affiliate Wizard is not visible in the Left Navigation menu
• 6852: aawizard: XSS on g.Wizard_Affiliate_StateSelect and g.Message
• 6853: atwizard: XSS on g.Message and g.AttributeWizard_Attribute_Image
• 6854: cawizard: XSS on g.Message
• 6855: pawizard: XSS on g.Message
• 6856: submitsu: XSS on multiple fields
• 6859: Save Framework: XSS on g.Error_Field_Message
• 6860: Manage Orders: Manually edited text attributes sometimes get stored in opt_code instead of data or data_long
• 6863: Legacy callers of Page_Insert receive errors on MySQL in strict mode
• 6864: cmp-cssui-breadcrumbs.mv: If product code is 0, page PROD will display the current item as Product List in the breadcrumbs.
• 6871: cmp-cssui-prodlist: Framework export generates invalid provisioning code in some cases
• 6885: remove.mvc: autocomplete enabled for login/password
• 6886: Admin login form does not have autocomplete="off" on input fields
• 6888: setup: Multiple XSS
• 6889: setup: Username and password fields with autocomplete enabled
• 6890: setup does not specify a character set and is vulnerable to UTF-7 XSS
• 6891: remove.mvc does not specify a character set and is vulnerable to UTF-7 XSS
• 6902: remove: XSS after authentication

Payment Module Changes

The Authorize.Net module now includes a configurable setting for the x_duplicate_window API parameter. This parameter controls the timeout for which transactions with the same card number for the same dollar amount are rejected as duplicates.

PayPal Changes

NEW MODULE: PayPal Payments Advanced and/or Payflow Gateway

• Replaces the existing Payflow Pro and Payflow Link modules and provides integration with the following PayPal services:
• PayPal® Payments Advanced
• Payflow Link
• Payflow Pro
• The existing PayPal IPN and PayPal Website Payments Pro modules have been renamed to match the current PayPal naming convention for the services these modules provide.
• Innovative Gateway has been removed from the Set Up Payment wizard. Configuration of PayPal options has been simplified.

Checkout by Amazon Changes

New options have been added to Checkout by Amazon to pass inventory variant part information to Amazon. This is helpful for merchants who fulfill the majority of their orders through Amazon Seller Central. These options also represent a possible solution for merchants who need to pass attribute information to Amazon.

The Checkout by Amazon module now displays the "Checkout with Amazon" button when a basket contains a 0-weight product.

Other Changes

Security

All Shipping and Payment modules have been enhanced to improve security and prevent spoofing of an invalid or disabled shipping/payment method through forced browsing.

Shopping Interface secure cookie expiration can now be configured separately from the non-secure cookie expiration. In new installations, the secure cookies are now configured to be "session" cookies (they expire when the browser is closed). Some PCI scanners deliver an alert when these cookies do not expire. Stores upgrading to PR8 Update 6 will retain the behavior of the previous versions by default. These stores can be configured to implement the new behavior.

Administrative session cookies are now "session" cookies and will expire when the browser window is closed.

Store Management

Category tree and title images can now be imported and exported.

When the PaymentMethod or ShippingMethod parameter is empty or invalid, the OPAY page now redirects back to OSEL with a UI exception of "invalid_payment_method" or "invalid_shipping_method" rather than displaying a fatal error. This improves the stability of the software and also makes it possible to add a 'select one' option to the shipping and payment drop-down lists without the requirement for client-side validation (to prevent loading the OPAY page without a valid value for one of the fields).

The Product/Category META fields component now makes the meta values for categories and products available as StoreMorph tokens. If a category or product is present (loaded by cmp-mv-stdcatfields or cmp-mv-stdprodfields, respectively), the following additional tokens will be present in l.settings:category or l.settings:product:

• :metafield_count – The number of meta field values
• :metafields[] – An array containing all of the meta field values for this item
• :name
• :value
• :metafield:<name> – A lookup by meta field name that will contain the value of that meta field. Each instance of "-" is translated to "_" (as it is for custom fields).

When generating Inventory Variants, any inventory variant parts that are automatically created will receive a default price, cost and weight based on the values from the master product and the attributes used when creating the variant.

The Dreamweaver template Import/Export functionality has been re-added and renamed 'Template Import/Export'.

Miva Merchant Submit has been removed. Patch pre-install validation will warn any user who has Miva Merchant Submit configured.

Shipping Options

The 'Pack by Quantity' and 'Pack by Weight' box packing modules now support an option to exclude any box from the packing solution that is smaller than the dimensions of the largest product in a shipment.

Tracking numbers are now displayed as clickable links on the 'Management Shipments' and 'Order Detail' displays in the Administrative Interface.

NEW MODULE API FEATURE: cleanup_store

A new module API feature, cleanup_store, allows modules to register to be called whenever periodic cleanup tasks are performed.

NEW DATABASE FUNCTION: v58_OrderItemList_CreateShipment
NEW DATABASE FUNCTION: v58_OrderItemList_CreateReturn

New functions v58_OrderItemList_CreateShipment and v58_OrderItemList_CreateReturn allow shipments and returns to be created while providing the caller with information about the newly created shipment/return.

Bugs Fixed

• 5369: Checkout by Amazon now supports 0 weight products
• 5768: Add Store Wizard - after adding second store to a domain, it appears above existing store in admin left nav
• 5797: Admin: Logging in securely with incomplete configuration results in errors
• 6062: paypalpro: When authorizing from admin, the item list is sent as empty
• 6192: DrawTemplateTextArea overrides PopupColorSelector, breaking any non-template color buttons
• 6234: cmp-cssui-cattitle should support import/export through the Custom Fields API
• 6235: cmp-cssui-cattree should support import/export through the Custom Fields API
• 6236: cmp-mmui-cattitle should support import/export through the Custom Fields API
• 6237: cmp-mmui-cattree should support import/export through the Custom Fields API
• 6510: Merchant should prompt when turning off the inventory flag on an attribute or attribute template attribute
• 6592: cmp-cssui-prodlist: Pagination settings are confusing
• 6610: Empty/invalid g.PaymentMethod or g.ShippingMethod (when shipping is required) should throw UI exceptions instead of displaying Fatal Errors
• 6717: PRV_Tag_Number fails to validate against empty strings when scale is not set to -1
• 6722: Manage Shipments: Sort by Customer Name uses Billing data but shows Shipping.
• 6813: Inventory, Email Notification, inv_instock and inv_available are not updated before the low stock and out of stock emails are sent.
• 6861: cmp-cssui-prodlist.mv/cmp-mmui-prodlist.mv: items per page filter does not honor the setting if turned off and static link contains Per_Page
• 6862: cmp-cssui-prodlist.mv/cmp-mmui-prodlist.mv: items per page filter does not set Per_Page variable on initial load
• 6866: cmp-cssui-cattree/cmp-mmui-cattree: when category code is all zeros, the category is highlighted by default when there is no category selected.
• 6884: Provisioning: order_add, AttributeCode, price is not validated for empty tags
• 6908: UPSXML: unable to generate rates if shipping settings has state/province set to anything other than a capitalized state code.
• 6914: Products batch edit screen: edit here, values for canonical category and alternate display get erased if they are not display during update.
• 6921: upsdevkit: Buttons do not change to "Processing..." while processing
• 6924: productimport: Unmapped inventory columns do not receive proper defaults
• 6925: Cannot add/edit product variants when attribute template contains checkbox, text field, or text area
• 6926: authnet: Should have a configuration setting that controls the x_duplicate_window setting
• 6927: Resuming after a validation failure does not recreate the list of steps to be executed
• 6929: Store Settings, Misc. Colors, color select pop up does not load the default color.
• 6934: cmp-cssui-prodlist: Unable to change Product Links setting when in advanced mode
• 6936: Endicialabels.mv: Cannot change passphrase if temporary passphrase issued from endicia's side.
• 6942: Mvfedexsoap: unable to generate rates when a order total weight is under half a pound.
• 6947: endicialabels: Non-required "shipping" feature does not have all required methods and should be removed
• 6948: upslabels: Unused "shipping" feature should be removed
• 6952: Manage Orders: Recalculate Charges does not create new shipping charges
• 6954: add store wizard: fatal error when creating a store in mysql strict mode
• 6960: API function ShipmentBatch_Create_ShipmentList terminates with fatal error "Array index must be positive integer"
• 6962: cmp-cssui-cattree: Category Tree does not load correctly when parent category is not active or not available to the current customer
• 6963: Tokenlist: unable to select which order is viewed on the ORDS page in MMUI
• 6966: Attribute Inventory: Unable to add product to basket with an unselected and optional radio button
• 6967: Attribute Machine does not support "select one" or "no selection" radio button inputs
• 6968: productimport.mv: l.product being used instead of l.record in functions Import_Replace_Product and Create_Product_Inventory
• 6969: Invalid variants and dangling database entries are created with a optional inventory attributes
• 6970: Paypalpro: unable to checkout when spaces are used to separate credit card number.
• 6971: API Deficiency: Need versions of OrderItemList_CreateShipment and OrderItemList_CreateReturn that return the created shipment/return
• 6974: SVG Line Chart: Uncaught error: Not_supported_err: DOM exception 9 (Chrome only)
• 6976: cmp-mmui-attributes: Move hard-coded trailing : in prompts into the template code
• 6977: cmp-cssui-attributes: Move hard-coded trailing : in prompts into the template code
• 6979: Provisioning: page update "code" is inconsistently cases sensitive.
• 6984: Cbamazon: checkout throws an error when there is an ampersand in a product name
• 6988: Authorize.net: False MD5 Hash Mismatch when Comma is in Billing Address
• 6991: Miva Merchant Submit URL is not formatted correctly
• 6992: sNN_OrderShipments table does not include weight from attributes
• 7003: paypaladv: Fatal Error when installing in an mmui store
• 7005: Paypalpro: unable to authorize a CC payment from admin.
• 7006: Paypalpro: Customer data is not encoded when added to the xml call.
• 7008: JSON list load query functions generate invalid SQL statements when passed invalid search terms
• 7010: Tokenlist: when viewing tokenlist as an item in runtime you receive a runtime error.
• 7068: Merchant should set a default error code/message before calling module functions that commonly fail without calling Error()
• 7070: Warning/error message that disallows module removal while items exist is unclear when items are not assigned to any pages
• 7071: lib/dbeng/orders.mv: MvFOREACH has two ITERATORS and causes runtime error

New Features

NEW COMPONENT MODULE: Mini-Basket (cmp-mv-minibask)

Provides a persistent mini-basket in the shopping interface. This module is not installed by default and must be enabled manually.

NEW COMPONENT MODULE: Shipping Estimate (cmp-mv-shipestimate)

Allows a store to be configured to display shipping cost estimates for individual products or an entire basket. This module is not installed by default and must be enabled manually.

Customer Account Changes

• All customer account passwords are now encrypted by default.
• During import, if an unencrypted customer password is encountered it will automatically be encrypted.
• New configuration settings allow store managers to control the minimum length and complexity requirements for customer passwords.
• Customers may now log in using either their login or lost password email.
• Lost customer passwords are now handled by sending the customer a password reset link via email (rather than their password, as in previous versions). When the customer clicks on the reset link, a new password is automatically generated and displayed over a secure connection.
• The Lost Password Email is now sent as text/html rather than text/plain.
• The following customer related changes have been made to the default templates for newly created stores:
• All login screens prompt for email address instead of username.
• Password and email address changes are handled on new screens that require the customer to re-enter their existing password.
• The "Forgot Password" mechanism now uses a separate screen.
• The Customer Create screen has been simplified.
• The My Account screen now contains links to the Change Email Address and Change Password screens.
• These changes are not applied to existing stores. Existing stores will retain their previous screen layout and functionality. The changes can be applied manually or by applying the default framework to the store.

Administrative Changes

• To reduce UI clutter, all locations that previously displayed a grid of checkboxes to permit selection of custom fields now use a multiple select list.
• CSS has been simplified to use consistent sizing and fonts across UI elements and to create fewer external resource loads.
• To simplify the support process, a new mechanism has been introduced that allows support tickets to be created directly from the Administrative Interface. When a ticket is created in this manner, it automatically contains relevant technical information about the Miva Merchant installation.
• Manage Orders and Manage Shipments now break ties by Order Number when sorting by a field other than Order Number.

Import/Export Changes

• The attribute export module now exports the Inventory flag for attributes.
• The product export module now allows you to select which standard and inventory fields are exported.
• The product export module now allows exporting of product shipping rules and permitted shipping methods.
• The product import module now supports import of product shipping rules and permitted shipping methods.

Provisioning Changes

• A new oncomplete attribute may optionally be specified in the top-level <Provision> tag to control the behavior of the provisioning system after processing has completed. If oncomplete="delete", the provisioning file is deleted from the mivadata/ directory after processing. Any other value causes the file to be archived as in previous versions.

Example:

  <Provision oncomplete="delete">
     <Store code="test">
        <Product_Add>...</Product_Add>
     </Store>
  </Provision>

• The <Password> child of the domain-level <User_Add> and <User_Update> tags now accepts pre-encrypted passwords in SHA1, PBKDF1 or PBKDF2 format. This allows users to be created through provisioning without leaving a plaintext password in the provisioning XML. Passwords maybe encrypted using the mmenc tool, which is available from Miva Merchant upon request for hosting partners.

Setup Provisioning Changes

• The <UserPassword> tag now accepts and passes through pre-encrypted passwords so that default administrative users can be created without potentially leaking a plaintext password. Encrypted passwords are automatically detected and plaintext passwords are handled as in previous versions. Passwords can be encrypted using the mmenc tool, which is available from Miva Merchant upon request for hosting partners.
• The <Database_Password> and <PrivateKey_Database_Password> tags now accept an encryption attribute and pre-encrypted database passwords.

Example:

<Database_Password encryption="rsa">...RSA encrypted password...</Database_Password>

• If the encryption attribute is not specified or is any value other than "rsa", the password is assumed to be plaintext. Passwords can be encrypted in the RSA format using the mmenc tool, which is available from Miva Merchant upon request for hosting partners.
• A new <Configuration> sub-tag, <DeleteSetupXML>, accepts a boolean value and when true, causes a site-specific setup.xml file to be delted from the mivadata/ directory after the completion of the setup process. The default behavior is to leave the file in place after setup has completed.

Example:

 <Configuration>
   ... normal configuration tags ...
   <DeleteSetupXML>Yes</DeleteSetupXML>
 </Configuration>

Payment Module Changes

• The following deprecated payment modules have been removed for new installations and are no longer supported:
• Amazon Simple Pay
• Innovative Gateway Solutions
• Payflow Link (Legacy)
• Payflow Pro (Legacy)
• All payment API passwords are now stored encrypted, as required by PCI-DSS.
• Google Checkout module has been renamed Google Wallet to reflect the change in the service name.
• Google Wallet now permits configuration of the currency used for transactions instead of automatically determining the currency based on the store's configured country.
• Unused Seller Central Login/Password configuration fields have been removed from Checkout by Amazon.

Shipping Module Changes

The UPS Developer Kit Registration Wizard has been updated to use the latest UPS registration API, which enables the following features:

• Management and authentication of multiple shipper numbers within a single Miva Merchant store
• Streamlined enablement of negotiated rates
• The UPS Ready® Tools module now allows users who do not have a UPS shipper number to generate and print shipping labels using a credit card.

API Changes

The custrt feature now contains two additional functions for new runtime customer actions:

• Module_Customer_Runtime_ChangePassword( module var, customer var )
• Module_Customer_Runtime_ChangeEmailAddress( module var, customer var )

Modules implementing the not_orderitem feature now receive notifications when order items are deleted through function Module_Notify_OrderItem_Delete( module var, orderitem_count, original_orderitems var, orderitems var ).

Other Changes

The Image Management module now verifies and updates master image dimensions when checking for updated images.

Order Provisioning Improvements

• <OrderShipment_Add>:
• Shipment code may be automatically generated
• Shipment cost may be specified
• If a list of products is not specified, all items not already in a shipment will now be included in the newly created shipment
• Newly created shipments can be marked as shipped at creation
• Shipments may be created and items assigned to shipments within an <Order_Add> tag.
• New tags <Order_Add_Item> and <Order_Add_Product> allow items/products to be added to an existing order.

Administrative/Login Settings

• A new configuration setting "Failed Login Delay" provides a rate limiting mechanism to prevent brute force password guessing. This delay, which requires Miva Empresa 5.17 or newer, is applied whenever an Administrative or Customer login failure occurs.
• Administrative users can now be configured to expire at a specific date and time.
• A new flag has been added to force administrative users to change their password at next login.
• Administrative users must now re-enter their existing password when changing their password from the Edit User screen.

Encryption Changes

• When running on Miva Empresa 5.17 or newer, the strongest ciphers supported by the local OpenSSL installation will now be used by default. This list can also be fine tuned using the new "Preferred Ciphers" configuration setting.
• The new Create Encryption Key Wizard simplifies the creation of keys used for payment data encryption and automatically re-encrypts or archives payment data encrypted with obsolete keys, as required by PCI-DSS.
• It is now possible to change the passphrase of an existing encryption key.

Bugs Fixed

• 5409: SEO Settings: If .htaccess cannot be written, changing SEO settings results in fatal error
• 5755: Module: paypalpro: Accumulated rounding error/transaction errors when BasketCharge amount fields extend to 3 decimal digits
• 6489: Administrative Interface: All URL components should be attribute encoded, not entity
• 7168: Module: cmp-mv-minibask: cmp-mv-minibask: Specification
• 7236: Modules - Shipping: mvfedexsoap: JavaScript error when clicking on "generate new meter number" in webkit browsers
• 7309: Administrative Interface: Confirmation message when deleting baskets should be more specific
• 7382: Module: cmp-cssui-prodlist: Sort warning message says expensive sort options *reduce* page load time
• 7383: Module: cmp-mmui-prodlist: Sort warning message says expensive sort options *reduce* page load time
• 7384: Module: cmp-mmui-prodlayo: Convert grid-of-checkboxes for custom fields to a single multiple select input
• 7385: Module: cmp-mmui-prodlist: Convert grid-of-checkboxes for custom fields to a single multiple select input
• 7386: Module: cmp-mmui-basket: Convert grid-of-checkboxes for custom fields to a single multiple select input
• 7387: Module: cmp-mmui-invc-order: Convert grid-of-checkboxes for custom fields to a single multiple select input
• 7388: Module: cmp-cssui-invc-order: Convert grid-of-checkboxes for custom fields to a single multiple select input
• 7389: Module: cmp-cssui-basket: Convert grid-of-checkboxes for custom fields to a single multiple select input
• 7390: Module: cmp-cssui-prodlayo: Convert grid-of-checkboxes for custom fields to a single multiple select input
• 7391: Module: cmp-cssui-prodlist: Convert grid-of-checkboxes for custom fields to a single multiple select input
• 7392: Module: prodexp: Convert grid-of-checkboxes for custom fields to a single multiple select input
• 7393: Administrative Interface: Product Batch Edit Screen: Convert grid-of-checkboxes for custom fields to a single multiple select input
• 7394: Module: cmp-cssui-cattree: Convert grid-of-checkboxes for custom fields to a single multiple select input
• 7395: Module: cmp-mmui-cattree: Convert grid-of-checkboxes for custom fields to a single multiple select input
• 7396: Module: flatcat: Convert grid-of-checkboxes for custom fields to a single multiple select input
• 7397: Administrative Interface: Category Batch Edit Screen: Convert grid-of-checkboxes for custom fields to a single multiple select input
• 7398: Module: flatcus: Convert grid-of-checkboxes for custom fields to a single multiple select input
• 7399: Customers: Customer Batch Edit Screen: Convert grid-of-checkboxes for custom fields to a single multiple select input
• 7401: Module: mvfedexsoap: Module_Product_Field_Name returns an empty name for custom field code "nonstdcont"
• 7532: Module: chasepaytech: OrderID is not displayed in administrative interface
• 7533: Module: cmp-mv-attributemachine: "Missing Radio Selection Message" never gets displayed.
• 7541: Module: mvusps: "ship from" city and zip information is being sent for the "ship to" fields when generating labels
• 7542: Module: cmp-cssui-invc-order: Tokens are not created for selected product custom fields
• 7543: Module: categoryimport: Custom fields should be sorted by name
• 7544: Module: customerimport: Custom fields should be sorted by name
• 7545: Module: productimport: Custom fields should be sorted by name
• 7551: Core Runtime: Empty g.PaymentMethod and g.ShippingMethod are not properly handled on transition off of the OSEL page
• 7552: Module: tokenlist: Tokenlist is unable to display View All Tokens page when there is an unmatched > after a storemorph token
• 7555: Module: mvfedexsoap: account rates are always used at checkout.
• 7564: Framework Import/Export: After applying a framework there is a 1 hanging at the top of the screen.
• 7565: Attribute Templates: attribute template reference count gets incremented when editing an attribute template from the edit product page.
• 7595: Module: tokenlist: Function window.onresize throws an error if you resize before instantiating the tokenlist object
• 7645: Module: mvusps: unable to generate international rates for packages under 1 once
• 7706: Administrative Interface: Fatal Error in admin when editing customers if the user name contains a +.
• 7720: Administrative Interface: Fatal Error in admin when editing categories if the category code contains a +
• 7721: Administrative Interface: Fatal Error in admin when editing products if the product code contains a +
• 7723: Administrative Interface: Fatal error when adding a category if the store code has a +
• 7724: Administrative Interface: Fatal error when adding a product if the store code has a +
• 7725: Administrative Interface: Fatal error when clicking on the customers link if the store code has a +
• 7726: Administrative Interface: Fatal error when clicking on the reports link if the store code has a +
• 7727: Administrative Interface: Fatal error when clicking on the "links" button on the product edit page if the product code has a +
• 7728: Administrative Interface: Fatal error when clicking on the "links" button on the store edit page if the store code has a +
• 7729: Administrative Interface: Fatal error when clicking on the edit product button on the if the store code has a +
• 7730: Administrative Interface: Fatal error when clicking on the edit category button on the if the store code has a +
• 7731: Administrative Interface: Fatal error when clicking on the link button on the edit product page if the store code has a +
• 7732: Administrative Interface: Fatal error when clicking on the link button on the edit category page if the store code has a +
• 7733: Module: paypalpro: XSS: g.Store:code output unencoded in "Delete PayPal Tokens" link
• 7734: Administrative Interface: Fatal error when clicking on the “Import Data” link under utilities if the store code has a +
• 7735: Administrative Interface: Fatal error when clicking on the legacy import module links under Import Data if the store code has a +
• 7736: Administrative Interface: XSS in Launchpad on Store_Code
• 7737: Administrative Interface: Fatal error when using the "Export Attributes to XML File" module under Export Data if the store code has a +
• 7739: Administrative Interface: Fatal error when modifying Frameworks if the store code has a +
• 7740: Administrative Interface: Fatal error when using the "Export Customers to Flat File " module under Export Data if the store code has a +
• 7741: Administrative Interface: Fatal error when ordering Frameworks if the store code has a +
• 7742: Administrative Interface: Fatal error when using the "Export Categories to Flat File" module under Export Data if the store code has a +
• 7743: Administrative Interface: Fatal error when using the "Export Orders to Flat File" module under Export Data if the store code has a +
• 7744: Module: cmp-cssui-buttons: Fatal error when clicking on the Show Code buttons on the Buttons tab if the store code has a +
• 7745: Administrative Interface: Fatal error when using the "Export Products to Flat File" module under Export Data if the store code has a +
• 7746: Administrative Interface: Fatal error when launching any Wizards from the left navigation bar if the store code has a +
• 7747: Administrative Interface: Fatal error when configuring list display on the Countries screen if the store code has a +
• 7748: Administrative Interface: Fatal error when configuring list display on the Groups screen if the store code has a +
• 7749: Administrative Interface: Fatal error when configuring list display on the Group Users screen if the store code has a +
• 7750: Administrative Interface: Fatal error when configuring list display on the Group Imports screen if the store code has a +
• 7751: Administrative Interface: Fatal error when clicking on the "links" button on the category edit page if the category code has a +
• 7752: Module: cmp-cssui-cattree: Fatal error when recalling versions on the Category Tree Template tab of the Edit Store screen if the store code has a +
• 7753: Module: cmp-cssui-hdft: Fatal error when recalling versions on the Global Header & Footer tab of the Edit Store screen if the store code has a +
• 7754: Module: cmp-cssui-head: Fatal error when recalling versions on the HEAD Tag Content/CSS tab of the Edit Store screen if the store code has a +
• 7755: Module: cmp-cssui-html: Fatal error when recalling versions on the HTML Profile tab of the Edit Store screen if the store code has a +
• 7756: Module: cmp-cssui-navbar: Fatal error when recalling versions on the Navigation Bar tab of the Edit Store screen if the store code has a +
• 7757: Module: cmp-cssui-breadcrumbs: Fatal error when recalling versions on the Smart Breadcrumbs tab of the Edit Store screen if the store code has a +
• 7759: Administrative Interface: Fatal error when configuring list display on the States screen if the store code has a +
• 7760: Administrative Interface: XSS: g.Store:code in Affiliate_Navigation
• 7761: Administrative Interface: Fatal error when configuring list display on the Pages screen if the store code has a +
• 7763: Administrative Interface: Fatal error when configuring list display on the Items tab of the Pages screen if the store code has a +
• 7764: Administrative Interface: Fatal error when configuring list display on the Pages tab of the Edit Item screen
• 7765: Administrative Interface: Fatal error when recalling versions on the Page tab of the Edit Page screen if the store code has a +
• 7767: Administrative Interface: Fatal error when configuring list display on the Items tab of the Edit Page screen if the store code has a +
• 7768: Module: cmp-cssui-afae: Fatal error when recalling versions on the Affiliate Fields tab of the Edit Page screen if the store code has a +
• 7769: Module: cmp-cssui-prodlist: Fatal error when recalling versions on the Product List Layout tab of the Edit Page screen if the store code has a +
• 7770: Module: cmp-mv-imagemachine: Fatal error when recalling versions on the Product List Image Machine tab of the Edit Page screen if the store code has a +
• 7771: Module: cmp-mv-attributemachine: Fatal error when recalling versions on the Attribute Machine tab of the Edit Page screen if the store code has a +
• 7775: Module: cmp-cssui-basket: Fatal error when recalling versions on the Basket Contents tab of the Edit Page screen if the store code has a +
• 7776: Module: cmp-cssui-prodlist: Fatal error when recalling versions on the Category Product List Layout tab of the Edit Page screen if the store code has a +
• 7777: Module: cmp-mv-imagemachine: Fatal error when recalling versions on the Product Display Layout Image Machine tab of the Edit Page screen if the store code has a +
• 7778: Module: cmp-mv-content: Fatal error when recalling versions on the Content tab of the Edit Page screen if the store code has a +
• 7779: Module: cmp-cssui-custfields: Fatal error when recalling versions on the Customer Fields tab of the Edit Page screen if the store code has a +
• 7780: Module: cmp-cssui-hdft: Fatal error when recalling versions on the Header & Footer tab of the Edit Page screen if the store code has a +
• 7781: Module: cmp-mv-content: Fatal error when recalling versions on the Content (inline_css)tab of the Edit Page screen if the store code has a +
• 7783: Module: cmp-cssui-invc-order: Fatal error when recalling versions on the Order Contents tab of the Edit Page screen if the store code has a +
• 7785: Module: cmp-cssui-invc-custfields: Fatal error when recalling versions on the Customer Information tab of the Edit Page screen if the store code has a +
• 7786: Module: cmp-cssui-orderlist: Fatal error when recalling versions on the Order History List Layout tab of the Edit Page screen if the store code has a +
• 7787: Module: cmp-cssui-attributes: Fatal error when recalling versions on the Product Attribute Template tab of the Edit Page screen if the store code has a +
• 7788: Module: cmp-cssui-prodlayo: Fatal error when recalling versions on the Product Display Layout tab of the Edit Page screen if the store code has a +
• 7789: Module: cmp-mv-imagemachine: Fatal error when recalling versions on the Category Product List Image Machine tab of the Edit Page screen if the store code has a +
• 7790: Module: cmp-cssui-prodlist: Fatal error when recalling versions on the Related Product List Layout tab of the Edit Page screen if the store code has a +
• 7791: Module: cmp-mv-imagemachine: Fatal error when recalling versions on the Related Product List Image Machine tab of the Edit Page screen if the store code has a +
• 7792: Module: cmp-cssui-prodlist: Fatal error when recalling versions on the Search Results Layout tab of the Edit Page screen if the store code has a +
• 7793: Module: cmp-mv-imagemachine: Fatal error when recalling versions on the Search Results Image Machine tab of the Edit Page screen if the store code has a +
• 7829: Core Runtime: Fatal error when using the navigation bar in runtime if the store code contains a +
• 7832: Module: attrexp: fatal error when exporting attributes if the merchant5/sNN folder is missing
• 7833: Module: afilexprt: fatal error when exporting Affiliates to Flat File if the merchant5/sNN folder is missing
• 7834: Module: flatcus: fatal error when exporting Customers to Flat File if the merchant5/sNN folder is missing
• 7835: Module: flatcat: fatal error when exporting Categories to Flat File if the merchant5/sNN folder is missing
• 7837: Module: prodexp: empty product export if the merchant5/sNN folder is missing
• 7838: Administrative Interface: Fatal error when viewing shipping label if the store code has a +
• 7839: Core Runtime: Password recovery mechanism allows user enumeration
• 7840: Core Runtime: Customer account creation allows username enumeration
• 7841: Core Runtime: Customer login attempts are not rate limited
• 7842: Administrative Interface: Administrative login attempts are not rate limited
• 7871: Module: paypaladv: PayPalAdv_Call does not specify variable scope when constructing its field list
• 7872: Module: authnet: authnet.mv: Fails to specify variable scope when constructing its field list
• 7875: Module: google: Google Checkout has been renamed to Google Wallet
• 8091: Administrative Interface: Numeric validation routines that permit negative numbers consider "-" valid
• 8105: Module: paypaladv: The legacy paynet module sent COMMENT1 and COMMENT2 fields which are not sent by the new module
• 8110: Administrative Interface: When Adding an admin user, password fields do not retain values after switching tabs
• 8111: Administrative Interface: Admin users who only have the Create Additional Users privilege can not edit user name field
• 8117: Administrative Interface: Image machine can create resized images with larger image dimensions than the original image.
• 8123: Provisioning: User_Add generates errors in MySQL strict when the StartInSimpleMode subtag is not present
• 8131: Module: paypaladv: To work properly with Synchro, PaymentModule_Report_Description must return the credit card type, not "PayPal Payments Advanced and/or Payflow Gateway"
• 8132: Utility Library: StandardFields_Validate function does not check to see if the secondary address email is populated
• 8451: Module: paypaladv: when paypals fraud filter tags an order the payment data fields do not display correctly in manage orders
• 8452: Module: paypaladv: when PayPal fraud filter rejects/declines an order, the order is still created in Miva Merchant.
• 8559: Provisioning: Creating a shipment through provision allows multiple shipments with same code
• 8568: Module: authnet: Duplicate window duration field is not validated.
• 8669: Module: paypalpro: fatal error when unchecking "use customers shipping address" in mysql strict mode.
• 8670: Module: paypalpro: fatal error when unchecking "Send Order Details" in mysql strict mode
• 8672: Module: paypaladv: placing an order with CC in the paypal hosted checkout causes a runtime error
• 8682: Module: templateorderemails: Sparse array functions do not validate externally provided values before using them as array indexes
• 8683: Core JSON: Runtime_ProductImageList_Load_Product_Variant does not properly handle the MultipleOnly flag
• 8684: Core JSON: Runtime_ProductImageList_Load_Product_Variant does not verify the sanity of requested image dimensions
• 8688: Module: google: "Google Wallet" left navigation link is not properly aligned
• 8689: Module: google: "TM" in "Google Wallet" title on utility screen does not display correctly in UTF-8
• 8903: Module: cbamazon: "Single Inventory Variant Behavior" should be renamed.
• 8937: Administrative Interface: Modal window does not resize properly when changing browser window size
• 8940: Affiliates: Fatal error when updating affiliate code for an affiliate with a non-expired basket referencing the affiliate
• 8962: Module: flatcat: custom fields data stops exporting after a reset to avoid timeout.
• 9147: Module: templateorderemails: Sorting emails by Enabled descending causes the title to wrap within the table cell (IE only).
• 9283: Module: google: google order records are not properly entered when using mysql strict mode
• 9334: Administrative Interface: Links pages do not attribute encode link text.
• 9344: Module: endicialabels: Endicia labels does not properly report mysql errors during label generation.
• 9352: Module: templatebatchreports: Printable invoice, errors when store code contains a +
• 9353: Setup Script: When configuring the database with setup.xml, the plaintext database password is left on the server
• 9356: SEO Settings: Multiple concurrent updates of the domain settings screen can corrupt or empty the .htaccess file
• 9431: Setup Script: When specifying the default user name through setup.xml, pre-encrypted passwords should be permitted
• 9437: Module: paypalpro: endpoint URLs are not correct in paypal pro
• 9440: Module: cmp-mv-http-headers: http headers get wiped during a page template code compilation error.
• 9441: Provisioning: Add an option to delete [pre-]provide.xml instead of copying it to -processed
• 9442: Provisioning: pre-provide.xml files larger than 10240 bytes create an infinite loop of nested framesets
• 9496: Provisioning: when using the sNN_ProductVariants table is not updated correctly.
• 9498: Administrative Interface: Very long product code/name values cause text overflow during Manage Orders
• 9546: Module: upsxml: Update UPS shield logo image
• 9583: Module: upsdevkit: Table UPSXMLOptions is not updated upon finishing the wizard to update the "Ship From" fields

Shipping Changes

UPS CHANGES

• Due to changes in the way the UPS API supports test-mode registrations, the UPS Developer Kit Registration Wizard no longer supports registration in test mode. It now performs registration in production mode regardless of the configuration of the UPS(R) Online Tools module.

SHIPPING LABEL CHANGES

• The UPS(R) Online Tools module now supports generation of shipping labels for use with Zebra (and Zebra compatible) thermal label printers.
  • This behavior is controlled by a new option, Use Zebra Thermal Printing. When enabled, shipping labels will be generated in ZPL format.
  • Only 4x6 inch labels are currently supported.
• The Endicia Shipping Labels module now supports generation of shipping labels for use with Zebra (and Zebra compatible) thermal label printers.
  • This behavior is controlled by a new option, Use Zebra Thermal Printing When Possible. When enabled, supported shipping labels will be generated in ZPL format.
  • Only 4x6 inch labels are currently supported.
  • Endicia does not support generation of all labels in ZPL format.
  • When a label type that does not support ZPL is required, the module will automatically fall back to the configured Non-ZPL Label Image Type. Label types that are known not to support ZPL include:
    • Certified Mail
    • International labels with more than 5 items declared on the customs forms
• The FedEx Web Services module now supports generation of shipping labels for use with Zebra (and Zebra compatible) thermal label printers.
  • This behavior is controlled by a new option, Use Zebra Thermal Printing. When enabled, shipping labels will be generated in ZPL format.
  • Only 4x6 inch labels are currently supported.
• The Shipping Label Display screen now supports printing of ZPL-format labels to a ZPL-compatible thermal label printer.
  • Java and a working Java browser plugin are required for thermal label printing.
  • The thermal label printer must be configured in the user's operating system.
  • When a ZPL label is displayed, a drop-down list will appear next to the print button allowing the user to select the printer to be used.
  • The last printer used is remembered as the default for the next time the Shipping Label Display screen is displayed.
• The Shipping Label Display screen has been improved to support preview of ZPL-format labels by rendering them as PNG images.
  • Label preview requires that the webserver have version 2.0.34 or newer of the GD library with fontconfig support enabled.
  • Proper display of labels is dependent on the Nimbus Sans L and Nimbus Mono L fonts, which are available for free in the urw-fonts package on most platforms.
  • Proper preview is supported for all aspects of the labels generated by the UPS(R) Online Tools, Endicia Shipping Labels and FedEx Web Services modules with the exception of the maxicode barcodes on UPS shipping labels.
  • The preview functionality is completely separate from support for thermal label printing. Even if a site is unable to preview ZPL labels, users will still be able to print them.

Other Changes

• Validation on the Forgot Password page has been improved in runtime. If a user presses the "Submit" button without entering a login or email address, they will now receive a validation message indicating that there was no input rather than a message stating that information to reset their password was emailed.
• Newly created stores (and stores which reapply the default frameworks) now use a secure URL for the Forgot Password page by default.

Bugs Fixed

6562: Administrative Interface: Shipping labels should have a filename specified in their Content-Disposition header
6794: Module: prodexp: Module generates invalid Provisioning XML when products have no alternate display page configured
9672: Module: upsdevkit: Registration in test mode no longer produces credentials that allow for rates or label generation testing
9721: Provisioning: <User_Add> is unable to create an expiring user if there is only one admin in the store.
9722: Provisioning: <User_Update> does not check admin status when updating users expiration date.
9723: Administrative Interface: Forced password displays the same text as 90day password expiration.
9724: CSSUI Templates: Forgot Password links should use secure_sessionurl
9732: Module: mvfedexsoap: international rates are displayed as null or zero.
9733: Module: mvfedexsoap: When editing shipping rates for international orders, fedex causes a JavaScript error.
9735: Administrative Interface: Legacy Order Processing title "edit order:#" is duplicated when viewing an encrypted order.
9736: Administrative Interface: Legacy Order Processing, clicking on tabs within edit order takes you to the servers index page.
9737: MMUI Templates: Forgot Password links should use secure_sessionurl
9738: MMUI css_fw: Forgot Password links should use secure_sessionurl
9739: MMUI default_fw: Forgot Password links should use secure_sessionurl
9740: CSSUI cssui_default_fw: Forgot Password links should use secure_sessionurl
9741: Module: upsdevkit: soap fault triggered when users try to register with zip+4 address
9749: Module: prodexp: Export Products to Flat File fails to export data for the standard fields after a globaltimeout refresh
9750: Module: mvfedexsoap: Set Up Shipping wizard shows blank screen if module is not installed
9769: Module: prodexp: Export products to flat file, using the tab radio button sets a tab character in the other box.
9771: Customers: Inconsistent Highlighting when No Confirmation of New Email or Password in Runtime
9808: Administrative Interface: Some modules are unable to be deactivated on the edit modules screen.
9810: Module: prodexp: Export Products to Flat File: Some settings are being reset to defaults after exporting
9812: Administrative Interface: user edit: Number of failed logins uses t_fails instead of c_fails
9813: Administrative Interface: Number of failed log in attempts does not get properly cleared after a successful login
9814: Core Runtime: Forgot password link does not validate that there is any value in the field
9818: Administrative Interface: Login screen SEO text should link only "Miva Merchant"
9819: Module: cmp-cssui-hdft: Default global footer SEO text should link only "Miva Merchant"
9820: Module: cmp-mv-hdft: Default global footer SEO text should link only "Miva Merchant"
9821: CSSUI cssui_default_fw: Default global footer SEO text should link only "Miva Merchant"
9822: MMUI css_fw: Default global footer SEO text should link only "Miva Merchant"
9823: MMUI default_fw: Default global footer SEO text should link only "Miva Merchant"
9828: CSSUI cssui_default_fw: cssui_default_fw framework does not include updated font fixes in its cssui.css file
9914: Module: upsxml: Shipping label does not specify filename
9915: Administrative Interface: json/shipments.mv: JSON_OrderShipmentLabel_Output: During label output, if there is no trackingnumber, a ".ext" will be output instead of fallback filename
9916: Module: mvfedexsoap: Fallback label rendering does not use a Content-Disposition
9917: Module: endicialabels: Label rendering with label_type module does not use a Content-Disposition
9919: Module: endicialabels: Recredit amount field does not get properly trimmed.
9921: Provisioning: <User_Update> returns "User with the name '' already exists" error if the user name is not matched perfectly (case sensitive)
9951: Module: prodexp: "Use Low Stock Default" and "Use Out Of Stock Default" inventory fields do not actually correspond to an export column
9952: Module: prodexp: There is no way to individually control the export of the Adjust Stock By column
9953: Module: prodexp: Inventory fields should be presented for selection in the same order in which they are written to the export file
9960: Module: prodexp: Exporting products to xml provisioning, most shipping rules do not get exported when using eng 5.12 or older

New Features

NEW MODULE: Shop As Customer

• Allows Administrative users to view the runtime interface as a Customer. The Administrative user may 'share' an existing shopping session or create a separate session.

NEW MODULE: Google Analytics

• Allows easy one-click integration of Google Analytics into Miva Merchant stores.

Variant Import Module

• The previously released Variant Import module is now part of the standard distribution. This module allows Product, Attribute, Option, Product Variant and Product Kit information to be imported from a single delimited text file.

SEO Settings

• New SEO settings allow the root of short links to be configured separately from the domain name. This permits short links to be used in unconventional configurations.

Cookie Settings

• New cookie settings allow control of when and how the non-secure Basket cookie is set. Additionally, all cookie settings have been moved to their own tab of the Domain Settings screen to avoid confusion.

Custom Field Selection

• In response to numerous customer requests, the selection mechanism for Custom Fields has been modified to use two separate select lists with "Select" and "Deselect" buttons.

Packaging Rules

• New configuration options on the Packaging Rules screen allow greater control over how Inventory Variants are packaged and what, if any, resolution mechanism is used when the Basket weight and the weight of the Variant part(s) differ.

Authenticated/Encrypted SMTP Support (with 5.18 or newer engine)

• Email configuration settings have been moved to their own tab of the Domain Settings screen.
• SMTP authentication using PLAIN, LOGIN, DIGEST-MD5 or CRAM-MD5 is now supported.
• Both implicit (SSL) and explicit (STARTTLS) transport-layer encryption can now be enabled.

Shipping Changes

Shipping Rules

• Percentage or fixed amount rate adjustments can now be configured on a per-shipping method basis from the Shipping Method Rules tab of the Shipping Rules screen. These adjustments can be used to apply a handling charge to each method.

Shipping Rates

• USPS Online Rate Calculation (Domestic and International) improvements:
  • The list of shipping methods has been updated to reflect all of the current methods provided by the US Postal Service.
  • A new option allows Online rates to be displayed to shoppers.
  • Label generation can now be disabled to prevent confusion when using Endicia.
  • The previous module-wide handling charge has been migrated to the new Shipping Method Rate Adjustment mechanism so that handling charges can be configured on a per-method basis.

ZPL Labels

• ZPL Label Preview now properly renders Maxicode and DataMatrix barcodes.
• ZPL Label Preview will now fall back to an SVG renderer if the GD library is not available or does not support the functions/fonts required to render a label.

Admin Changes

• The number of current logged-in Administrative Users and the high-water mark are now displayed in Admin.

Other Changes

Custom Fields Module

• The three existing Administrative Interface Configuration tabs have been merged into a single "Custom Fields" tab which allows sorting and filtering based on Custom Field type, as well as other attributes.
• Custom Fields are now assigned one of the following types. The type of a Custom Field determines how it is displayed in the Administrative User Interface.
  • Text Field: Displayed as a single-line text input field
  • Text Area: Displayed as a multiple-line text input field
  • Radio Button + Drop-Down List: Allows selection from a pre-configured list of values
  • Checkbox: Displayed as a checkbox
  • Image Upload: Allows Administrative users with the appropriate privileges to upload images to the server. The Custom Field value becomes the URI of the uploaded image.
• To make managing stores with large numbers of Custom Fields easier, Custom Fields can now be grouped together. Each group receives its own tab on the Edit Product/Category/Customer screens.
• A new StoreMorph item "customfields" supports multiple functions for reading and writing Custom Fields.
• Basket and Order Custom Fields are now provided. Basket fields can only be manipulated programmatically via the customfields StoreMorph item. When an order is placed, any Basket Custom Fields matching a configured Order Custom Field are carried over into that order.

Template Based Emails

• The existing Template Based Order Emails module has been renamed "Template Based Emails".
• A new email trigger, "Send When Customer Created", permits email(s) to be sent when a new Customer account is created. A new default email, "Customer Created", is present for this purpose but disabled by default.
  • Emails with the "Send When Customer Created" trigger can now be manually (re)sent from the Edit Customer screen.
• Emails can now be configured to be sent Base64 encoded or as traditional multipart MIME. The 5.18 or newer engine is recommended to avoid line-length issues when sending multipart MIME format emails.
• The Enable/Disable mechanism has been changed to Sending: "Automatic" or Sending: "Manual" to avoid confusion.
• The Reply-To: header can now be configured on an email by email basis.
• With the 5.18 or newer engine, long format email addresses including a first and last name are now supported in the From, To, CC and Reply-To fields.

Bugs Fixed

5689: Misc: Short Links and CSSUI not compatible with shared SSL cert
5735: Module: google: Google Checkout does not support provisioning
5825: Inventory Subsystem: Auto generate variants, generating variants with long product names returns error the "mysql_execute: Data too long for column 'name' at row 1"
6428: Module: templateorderemails: Template Based Order Emails triggering spam filters
9616: Module: upsxml: UPS Doesn’t return rates for international shipments when you have the default delivery conformation field set to anything other than none.
9717: Administrative Interface: Manage Orders: authorize dialog has extra padding above the cancel and continue buttons in IE
9985: Module: shipexport: Module does not export the name of the shipment recipient
9988: Module: endicialabels: Parcel Post needs to be renamed to Standard Post
9989: Module: endicialabels: First-Class Mail International Parcel service is being renamed to First-Class Package International Service
10007: Module: google: Google wallet does not honor shipping method priorities.
10008: Module: cmp-mv-minibask: New line at beginning of template code causes framework import to use advanced mode
10022: Module: endicialabels: Tracking links are not clickable in either admin or runtime
10023: Framework Import/Export: Sorting options do not get properly saved when creating a framework.
10024: Administrative Interface: Fatal error when saving an image type of <- > as the default image on a product list layout page.
10027: Module: cmp-cssui-custfields: State Select dropdown breaks in CSSUI during runtime when only one option exists
10030: Administrative Interface: Maintenance Mode needs to be updated to support IPv6
10034: Module: cmp-cssui-head: cmp-cssui-head: When applying a framework, existing CSS file records are not removed
10035: Module: cmp-mv-head: cmp-mv-head: When applying a framework, existing CSS file records are not removed
10036: Module: cmp-mv-head: cmp-mv-head does not convert %STORE_ID% tokens in CSS file URLs
10041: Core Runtime: It is not possible to operate a store completely over HTTPS without including session parameters in URLs
10042: Attribute Templates: Attribute templates should be sorted by name in the attribute type drop-down list
10070: Patches: Adjust ecommerce footer link more loosely
10080: Module: paypaladv: Payment method displays as 0 for the method column in legacy order processing.
10101: Module: mvusps: Shipping method Parcel Post has been renamed to Standard Post
10102: Module: mvusps: Shipping method First-Class Mail® International Parcel has been renamed to First-Class Package International Service
10103: Setup Script: Non-existent modules in <ModuleList> cause a fatal error during installation
10104: Administrative Interface: Maintenance mode settings changes should be separately logged to the administrative activity log
10107: Module: templateorderemails: It is not possible to specify a From: or To: address that includes a long name
10143: ZPL Preview: ZPL preview does not correctly display endicia labels.
10168: Administrative Interface: ZPL print, does not work with the ZP500 driver from FedEx
10180: ZPL Preview: ZPL preview does not implement the BX (Data Matrix) command
10182: Utility Library: util_soap.mv SOAP_Call_LowLevel is comparing the returned namespace domain against a null and returns an error
10183: Module: templateorderemails: base64 encoded message data has LF+CR line endings, rather than CR+LF
10185: Module: upsxml: "Product Requires Additional Handling" does not trigger the UPS "Additional Handling" fee
10186: Module: shipexport: Module does not export the number of products in the shipment
10210: Utility Library: Image_Dimensions is too slow when used for batch processing, such as in Image Management
10219: Module: imagemanagement: Image_Dimensions is called multiple times on the same image / Images result set can contain the same image multiple times
10242: Module: upsxml: "Product Requires Additional Handling" does not trigger the UPS "Additional Handling" fee on the labels
10247: Provisioning: Domain settings provisioning uses incorrect variable name for Mail Method field
10257: Utility Library: Send_Email_Attachment cannot handle a from/to/cc address that contains a long name
10259: Module: upsxml: ShippingModule_Report_Value function does not take the "data" parameter
10260: Module: endicialabels: Postage Balance will never be displayed
10263: Module: mvusps: Rates API should have the option to offer online rates
10267: Administrative Interface: Convert custom field selection into two multiselects with add/remove buttons
10282: Patches: pr8-update-7 patch does not create the sNN_Customers_3 index
10284: Customers: Adding/Updating customer fields with invalid data produces undescriptive error messages
10311: Module: mvfedexsoap: generating a shipping label does not properly add the tracking type to the tracking number.
10328: Core JSON: Several JSON files are not included in the limited source kit
10336: Module: tokenlist: Token list is not compatible with prod_templates5.mvc
10341: Customers: Identification tab has wrong valign on prompts
10348: Administrative Interface: Marking any shipment as shipped updates the ship_date for all shipments in that order.
10352: Setup Script: Database configuration screen lists incorrect database engine types
10385: Module: mvusps: There should be a way to disable label generation from the settings screen
10506: Administrative Interface: Add the ability to filter Manage Orders by company
10511: Module: paypal: PayPal Payments Standard Peso Currency MXN is not an option
10545: Shipping/Packaging Rules: Packaged item weight can be negative when the total weight of parts is greater than the master product
10565: Module: packbyquantity: Add/Edit Box dialog does not align properly
10566: Module: packbyweight: Add/Edit Box dialog does not align properly
10567: Module: variantimport: Import does not support checkbox, text area or text field when creating a part product or product kit
10572: Module: cmp-mv-minibask: SkinsComponentModule_Export_Item: ImageType value is entity encode and will fail updating if image type has special character
10658: Core Runtime: Inventory Variant Add/Edit variant upon enter being pressed does not close the modal window
10663: Module: templatebatchreports: Template Based Batch Reports needs to be converted to use consolidated admin CSS styles
10676: Administrative Interface: Inventory Variants can have a specific value that is negative
10678: Administrative Interface: Creating a store via provisioning installs all of the import and report modules without updating the refcounts.
10679: Administrative Interface: The shipimport module has a refcount of 0 after store creation.
10681: Module: variantimport: Upon Product Kit Creation, ProductKit_Generate_Variants is not called
10690: Shipping/Packaging Rules: ShippingMethod_EncodeEntities functions do not handle "&trade;" properly
10693: Module: cswizard: Using the create a new store wizard leaves the import and report modules with a refcount of 0
10694: Module: upsxml: Missing MvFedExSoap methods from exclusion list
10700: Module: templateorderemails: Text field prompts are top aligned on Order and Customer email tabs
10701: Module: shipexport: "Export Field Names as Header" is to the left AND to the right of the checkbox
10710: Module: productimport: Shipping rules settings get removed during product update import when not specified.
10711: Module: productimport: Product shipping rules can not be updated when updating products via import.
10780: Module: variantimport: modules/import/variantimport.mv: AttributeOption_ConvertToBoolean is extremely inefficient
10818: Module: mvfedexsoap: The commodities table in international label generation in firefox (linux) pushes the content outside the dialog
10830: Module: flatord: batches not in chronological order on the "batch to export" drop down menu
10834: Module: variantimport: When creating a product kit and an attribute at the same time causes the attribute to be added to the product kit
10835: Module: variantimport: When creating a product, part product, attribute and option on the same line, the option is never created
10836: Module: variantimport: Variant Import category_codes header is never used or implemented
10849: Module: variantimport: Variant Import does not validate the attribute type to be one of the 6 accepted values
10880: Module: templateorderemails: Email checkboxes do not reset after manually triggering an email
10888: Administrative Interface: JavaScript error when viewing order tabs when certain permissions are set
10889: Administrative Interface: "Send" button text changes to "Save" on error in the Manage Orders Order Emails tab
10905: Administrative Interface: FormData file uploads are blocked by mod_security with the error "Multipart parsing error (init): Multipart: Boundary not found in C-T."
10909: Module: templateorderemails: Manually sending the customer created email returns a fatal error if the mail settings are configured incorrectly.