Patch 9 has been applied to our CRE Loaded packages.

Changes include:

• Credit Card : language defines missing for some B2B payment modules - added missing language defines
• Parsing of cc error messages from cc_validation.php - cc_validation.php was changed , additional error checking added to payment files that use 5 item check.
• Admin Setting of Sort Order Correction - Several modules were not correctly honoring the sort order set in the admin. The logic has been corrected to honor this order.
• Incorrect Email From - Revert change that was incorrectly done, revert revision 3995
• Incorrect Email From - Revert change that was incorrectly done, Removed files that were comited for this revision only and have no other changes.
• Amount field open to hacking - the gv_send files no not have type casting on the amount field which leaves them open to possible hacking attempts. Fields are now type cast to float.
• Installing new language Failed - There were several cases of incorrect type casting and missing escape routines. These would have resulted in a failure to correctly insert the new records.
• Incorrect instructions for location of debug file - Fixed this define, also checked for missing defines in there language files.
• Credit Card : with CCV payment module v6.2 language defines missing - cc_cvc, cc_old were missing language defines for the email to store owner.
• Amex validation error for cards that start with 3700 - the Amex validation check only checked cards starting with 3400 not 3700, the Amercan express was checking both. Moved the correct validation code to Amex.
• includes/modules/xsell_products_buynow.php error 1064 xsell query - Althought a fix was was developed it was not added code base. Moves TABLE_PRODUCTS_XSELL to after joins for better compatibility between version of mysql.
• Security Exposures - Various files have been modified to close up what could be possible security exposures.
• French Language Translations - Updated French language files with new translation have been supplied.
• Incorrect Currency corrupts the pricing - If a bad currency is passed to the cart, it is possible to force all product prices to zero
• Forgotten Password Enhancement - the logic has been changed to not ask for the user first name.
• Add Reply-to: to out going email - added Reply-to: to all out going email headers it is take from the email from information. After further review, this is not needed if a from; address is present. It may be added back later with a on off switch.
• Incorrect Email From - corrected to useEMAIL_FROM instead of STORE_OWNER_EMAIL_ADDRESS additional files found during audit
• Add Reply-to: to out going email - added Reply-to: to all out going email headers it is take from the email from information.
• Incorrect Email From - corrected to useEMAIL_FROM instead of STORE_OWNER_EMAIL_ADDRESS