Upgrade to Magento 1.5.0.1

After reading plenty of desperate forum posts on the upgrade from 1.4.2 to 1.5.0, I was reluctant to upgrade Magento.

I went to Magento Downloader and entered in "magento-core/Mage_All_Latest" in the extension key.

First, Magento Downloader wanted to update itself. Fine.

Second, I checked for updates in Channel: Magento Community Edition, ticked off all the modules to upgrade and then waited an age for everything to finish. I logged out and logged back in, cleared the cache and to my astonishment the upgrade itself went flawlessly.

At this point, the current version of the Extended CCSave extension will no longer work. It needs a simple little work around. After performing the 1.5 update, clear all the caches, and then go to System -> Permissions -> Users. From there click on each user, don't change anything, but click on save. For some reason, saving the configuration gets things working again.


P.S. I've removed some older blog posts that apply to hopelessly out of date Magento code.

Update to Extended_Ccsave Extension for Magento 1.4.2

I updated a few things:

1. integration into Permissions Roles
2. control functionality through options in System Configuration

Its not completely tested (consider it beta quality), but it works well on a couple of Magento installations.

Source Code:

extended_ccsave_0_1_3.zip

Screenshots:

View of the orders grid with purge mass action


Purge button at the top of an order


Secure (SSL) view of payment information


Configuration Options:

• Save / Don't save the card ID (if you just want to clean out Saved CC info and not save the card id)
• Enable the Purge Saved CC button & mass action
• Choose which Saved CC payment information you want to delete from an order

Permissions:

• allow view of the card id
• allow purge of Saved CC information

Known issues:

• after copy to app/code/local, if you visit some portion of MagentoConnect, the configuration files get clobbered
  
• there's some issue with the data helper object, but it doesn't cause any errors
  

In the pipeline:

• more testing
• use MagentoConnect to package extension

Extended_Ccsave Extension for Magento 1.4.2

It took a very long time, but here is an update to the Ccsave code.

This allows Magento to save the cid from an order, and later on purge cc info from the sales record (multiple orders supported). Unlike earlier ideas, the entire thing can go into the local code pool (app\code\local) as an extension. This should make maintenance and upgrades less of a nightmare. Although there may be problems with other extensions which also modify sales order functionality.

Its not completely tested (consider it beta quality), but it works well on my development machine. (Update: fixed a typo in one of the class names)

extended_ccsave_0_1_0.zip

Some things that are missing:
- integration into the access control lists
- more testing
- put the thing into MagentoConnect one of these days

A little salt, please?

It looks like the cc_number_enc and cc_cid_enc fields in sales_flat_quote_payment table are encrypted without using any salt. This means that the same plaintext encrypts to the same cryptext, and unfortunately cc_cid is usually only 3 digits long. This makes the encrypted data somewhat vulnerable to a known plaintext attack. This was commented on in the Magento forums as well, when discussing why the cc id is not available by default. ("This method does however provide encryption but is possible to break using a code book algorithm").

Obviously, it would be best to just not store the cc_cid_enc field in the first place, which is the default secure setting for the application. In the chance that a merchant's website is hacked and their database is compromised, they are accepting a hell of a lot of unwanted liability in storing the card id since they are not PCI compliant.