Jump to content
thirty bees forum

Acer

Members
 View Profile  See their activity

  • Posts

    345

  • Joined

  • Last visited

  • Days Won

    6

 Content Type 

Posts posted by Acer

    Panda question

    in English

    Posted

    1 hour ago, musicmaster said:

    I am trying to install Panda on a migrated shop that worked ok under Prestashop.

    Remember to patch Panda before you install it and try a fresh install of TB first. If it's possible to do the migration after. 

    Panda question

    in English

    Posted

    Not knowing the exact details of what you are trying to do here makes this a bit difficult. 

    But maybe try a fresh TB install, patch Panda then install Panda first before you do the migration...?

    Panda question

    in English

    Posted · Edited by Theo

    @musicmaster I recently installed Panda on a 1.3 installation and didn't encounter any issues. Same installation is now running 1.4 bleeding edge and so far no issues.

    I suggest you try again and if it still doesn't work reach out to the ST themes forums for support as you should have support available after you purchased the theme. Also please post the solution here for anyone else that may encounter the same problem. 

    PS: from what I remember there was a patch folder for TB in the installation zip. Think you should copy it and try it. 

    Compatible themes

    in English

    Posted

    1 hour ago, zen said:

    ha OK sorry..

    I don't sell any PS 1.7 upgrade, never did never will !!

    Good man. And it's BS 1.7 bytw. 

    1 hour ago, zen said:

    I don't think it will lead anywhere if there is nobody in command, looking to improve the system, specially on front office

    I totally agree with you there. Though don't get me wrong I'm grateful that TB is still running and the work that Smile and Datakick have been doing, I'm sure that all of us appreciate it. Because honestly this project in this form could've been dead already. 

     @Smile

    Compatible themes

    in English

    Posted

    4 minutes ago, zen said:

    sorry, but i don't understand your point, let me says it again :

    "I installed the last version of PANDA on a PS 1.7, last version, and I was really disapointed by the demos provided for this v2 version, the V1 version for 1.6 and TB was already way too old and not maintened anymore.. but even the 2.0 version (that will never be available for TB) is so outdated that I don't think Panda is going to be a good choice for a theme, that is for PS 1.6, PS 1.7 and TB as well !! so now can you explain me what was your point about ?

    Hehehe I was just being cheeky. I was pointing out that you're running BS 1.7 on that site instead of TB 😜

    • Haha 1

    Compatible themes

    in English

    Posted

    10 hours ago, zen said:

    Problem is that Panda is not supported anymore for TB and Presta 1.6.. all new demos and upgrades are for presta 1.7 only now.. and still it starts to look very old compared to new themes availables on envato for example.

    Panda still runs fine and is mature. It has support in terms of tech and bug support still. It is a solid foundation and has the flexibility to match any of those themes if you have a capable front-end developer to shape it as you wish. It doesn't really need to be updated, perhaps with a new preset layout/design to match the fancy new themes, but not necessary imo. Either way, from what I can gather, it's the best paid theme for TB right now. 

    Compatible themes

    in English

    Posted · Edited by Theo

    On 7/27/2022 at 8:16 PM, Euria said:

    ST-Themes Panda theme is at the moment the only option which is also being updated and supported. 

    Panda is an excellent theme. It's extremely versatile and has a bunch of really powerful modules packaged with it. There's no need for the latest bootstrap or whatever. The theme is modern and is mobile responsive ready. On top of that it comes with great support. I've built 3 TB sites with it, customised the shit out of it and remain happy. It's a great foundation for your online store. You can shape it as you see fit. 

    What more do you need? 

    product combination attribute dimensions

    in Modules

    Posted

    On 12/28/2018 at 2:35 AM, led24ee said:

    Hi. This one (https://addons.prestashop.com/en/sizes-units/24128-product-combination-attribute-dimensions.html) seems to be exactly what I need. Does anyone have experience with this module ?

    Hi there @led24ee

    So I'm interested in purchasing this module and wanted to know your experience with it? 

    Did you land up going with it or did you find some free alternative? 

    vulnerability on PrestaShop sites

    in English

    Posted · Edited by Theo

    Yeah I just found the code block as you mentioned before and did not go line specific. And ran the URL checker plus cleaner script as referenced in the articles you guys posted. 

    Thankfully my sites are clean. 

    Anyway, appreciate the posts. It's nice that there is still a TB community with fellow TBers 👍

    On 7/22/2022 at 10:02 PM, janoo said:

    ThirtyBees and PS 1.6 has this code slightly different from in PS 1.7:
    you can find it in "./config/smarty.config.inc.php" 

    if (Configuration::get('PS_SMARTY_CACHING_TYPE') == 'mysql') {
    include(_PS_CLASS_DIR_.'/SmartyCacheResourceMysql.php');
    $smarty->caching_type = 'mysql';
}

    but principle is as same as in original Prestashop files v 1.6.x and 1.7.x
    described in https://build.prestashop.com/news/major-security-vulnerability-on-prestashop-websites/

    I prefer to comment these lines, not remove at all, but it´s my decision only

    Thanks again.

    I'd also like to take the opportunity to thank Google Translate 😉 If it wasn't for you buddy, everything would be French for me or better, Czech. You help me make sense if it all 🙂

    • Like 1

    vulnerability on PrestaShop sites

    in English

    Posted

    On 7/25/2022 at 9:23 AM, WBNet-Wout said:

    The PrestaShop article however mentions that the attacker is able to enable using MySQL Smarty cache storage features remotely and that is why they recommend removing those lines, so that if the attacker enables it remotely it will not actually be enabled due to lacking the code for that. Unfortunately there does not seem to be any detail on how the attacker is able to enable it remotely.

    See above

    vulnerability on PrestaShop sites

    in English

    Posted

    1 minute ago, wakabayashi said:

    As Petr clearly pointed out: just deactivate the mysql cache. IMO you should anyway not use it... Are you using it?

    Unfortunately security is still my weakness in coding. I understand, that there is some sql injection possibility. Prestashop seems to believe, that it happens in caching. But the fix does irritate me. There is already pSQL() in use. They just replaced it with another encrypt method. 

    From what we gathered it seemed that the attackers could somehow override the Smarty cache setting regardless, which means it doesn't matter that we have it on the correct setting. Unless I'm completely mistaken?

    So what to do here? 

    Smarty update - testers needed

    in English

    Posted

    On 7/1/2022 at 10:18 AM, datakick said:

    That's great to hear. I have moved this to bleeding edge, will be part of 1.4.0 (to be released soon).

    Fingers crossed. 🙂

    Do we know how well this behaves on Warehouse and Panda themes incl. their bundled modules? 

    vulnerability on PrestaShop sites

    in English

    Posted

    2 hours ago, datakick said:

    I did a little more investigation.

    Thisbis a chained exploit. In order for this to be dangerous, you first have to have sql injection vulnerability present in your store.

    As far as we know, there is no such vulnerability in core. But there may be, of course. And any native or third party modules can have sql injection vulnerability in their code as well.

    If your store is vulnerable to sql injection it is already huge issue. Attacker can update, delete, and possibly read any data in your database. They can change passwords, delete orders, or whatnot.

    But if you have enabled mysql smarty cache, this problem is elevated to the stars. Attacker can insert data inside smarty cache table, and smarty library will evaluate this data as php code. Which means that attacker can run arbitrary php code in your store. That's fuc*ing scary 

    The fix will be quite simle. We will sign any data stored inside this table with secret that is know to php only, not stored in db. Attacker don't know the secret, so they will not be able to insert correctly signed data into the database.

    Until the fix is designed, pleas go to Performance settings and ensure you are using filesystem smarty cache implementation. Do not edit core files as suggested above, please.

     

    Thanks @datakick for the update. Please keep us posted and let us know when a patch / update has been released. 

    Multiple feature values - Looking for testers

    in English

    Posted

    10 minutes ago, datakick said:

    That's correct. If you migrate from 1.2, just make sure the db is migrated properly, see the first post in this thread.

    Then, you can enable multiple values for individual features, and that's all.

    Cool, thank you. So when you say enable multiple values for individual features I assume there's no switch or toggle for that? And that it happens automatically? 

×
×
  • Create New...