This edition of the Core Weekly report highlights changes in PrestaShop’s core codebase from Monday 18th to Sunday 24th of July 2022.

General messages

Dear developers,

The maintainers team was very busy these last few days because of the major security vulnerability discovered last week. If you haven’t read this article yet, please do it now.

Following the discovery of the vulnerability, PrestaShop version 1.7.8.7 was delivered. It contains a fix that strengthens MySQL Smarty cache storage against code injection attacks.

While the security work on 1.7.8.7 happened, the 8.0.0 Beta release got much closer to delivery, thanks to everyone from the PrestaShop community! Only a few remaining items are left before we can publish and host a Beta testing period.

Releases

• PrestaShop: 1.7.8.7
• Autoupgrade module: v4.14.2
• Ps_banner module: v2.1.2

A quick update about PrestaShop’s GitHub issues and pull requests:

• 29 new issues have been created in the project repositories;
• 18 issues have been closed, including 7 fixed issues on the core;
• 74 pull requests have been opened in the project repositories;
• 60 pull requests have been closed, including 50 merged pull requests.

Code changes in the ‘develop’ branch

Core

• #29092: Remove commented code. Thank you @PrestaEdit
• #28865: PrestashopCollection needs a shop restriction. Thank you @lmeyer1

Back office

• #28660: Fix exception during profil edition if invalid field given with avatar. Thank you @MeKeyCool
• #27608: Make Shop Parameters > Customer Settings > Customers form multistore compatible. Thank you @micka-fdz
• #27304: Add packed product type. Thank you @Amoifr

Front office

• #28947: Fix missing translations on meta pages. Thank you @micka-fdz
• #28814: Call initContent of the parent at the beginning. Thank you @PrestaEdit
• #28784: Allow to translate placeholder. Thank you @okom3pom

Code changes in the ‘8.0.x’ branch

Core

• #29064: Move email alerts module default translations, by @atomiix

Back office

• #29069: Fix install theme without hooks. Thank you @FabienPapet
• #29067: Fix permissions for read-only user. Thank you @FabienPapet
• #29025: Fix module link in adminsearch. Thank you @okom3pom
• #29022: Display an error while the file format does not match the allowed formats. Thank you @PrestaEdit
• #29020: Use LegacyModule instance instead of ModuleAdaptater. Thank you @PrestaEdit
• #29019: BO - Brands & Suppliers - the red alert “Image format not recognized” is missing the webp. Thank you @okom3pom

Code changes in the ‘1.7.8.x’ branch

Core

• #28780: Add cache to AddressFactory::addressExists(), by @eternoendless

Front office

• #29055: Fix anchor links in product list, by @jolelievre

Code changes in modules, themes & tools

PrestaShop contributors website

• #84: Bump terser from 4.8.0 to 4.8.1. Built by @dependabot[bot]

Nightly board

• #87: Bump terser from 4.6.3 to 4.8.1. Built by @dependabot[bot]

Prestashop UI Kit

• #191: Bump terser from 4.8.0 to 4.8.1. Built by @dependabot[bot]

Links list module

• #152: Link list IS compatible with multi-store, by @kpodemski
• #151: Bump terser from 4.8.0 to 4.8.1 in /views. Built by @dependabot[bot]

Email Alerts module

• #116: Fix typo in error message. Thank you @abramofranchetti

Classic theme

• #46: Fix anchor links in product list, by @jolelievre

Changes in developer documentation sources

• #1423: fix: update XAMPP broken link 1.7.x. Thank you @ga-devfront
• #1422: fix: update XAMPP broken link. Thank you @ga-devfront
• #1420: Change .js by .ts for links. Thank you @okom3pom
• #1419: Fix 404 link. Thank you @okom3pom
• #1418: Fix 404 link and typo. Thank you @okom3pom
• #1417: Fix new hooks link. Thank you @okom3pom
• #1416: Backport of PR1409. Thank you @leemyongpakvn
• #1415: Add blockwishlist to native module. Thank you @okom3pom
• #1414: Add Blockwishlist and remove Welcome. Thank you @okom3pom
• #1413: Update jQuery version. Thank you @PrestaEdit
• #1412: Update jQuery version since 1.7.7.8. Thank you @PrestaEdit
• #1409: Wrap bash command in bash block. Thank you @leemyongpakvn

Faceted search module

• #688: Bump terser from 5.9.0 to 5.14.2. Built by @dependabot[bot]
• #687: Bump @babel/cli from 7.18.6 to 7.18.9. Built by @dependabot[bot]
• #686: Bump @babel/eslint-parser from 7.18.2 to 7.18.9. Built by @dependabot[bot]
• #683: Bump @babel/node from 7.18.6 to 7.18.9. Built by @dependabot[bot]
• #682: Bump @babel/core from 7.18.6 to 7.18.9. Built by @dependabot[bot]
• #681: Bump moment from 2.29.2 to 2.29.4. Built by @dependabot[bot]
• #680: Bump eslint from 8.19.0 to 8.20.0. Built by @dependabot[bot]

Customer reassurance block module

• #425: Bump eslint from 8.19.0 to 8.20.0. Built by @dependabot[bot]
• #424: Bump vue from 2.7.4 to 2.7.7. Built by @dependabot[bot]

The PrestaShop open source project

• #111: Update slack channels list, by @matks

Hummingbird theme

• #352: Improve error pages design. Thank you @mparvazi

Wishlist block module

• #181: Fix heart empty when updating product quantity, by @atomiix

Banner module

• #48: Release 2.1.2, by @NeOMakinG

Auto Upgrade module

• #466: Remove Tab for Referrers Page, by @Progi1984

Thank you to the contributors whose pull requests were merged since the last Core Weekly Report: @dependabot[bot], @kpodemski, @abramofranchetti, @jolelievre, @ga-devfront, @okom3pom, @leemyongpakvn, @PrestaEdit, @matks, @mparvazi, @FabienPapet, @atomiix, @NeOMakinG, @micka-fdz, @lmeyer1, @eternoendless, @MeKeyCool, @Progi1984, @Amoifr!

Thank you to the contributors whose PRs haven’t been merged yet! And of course, a big thank you to all those who contribute with issues and comments on GitHub!

If you want to contribute to PrestaShop with code, please read these pages first:

• Contributing code to PrestaShop
• Coding standards

…and if you do not know how to fix an issue but wish to report it, please read this: How to use GitHub to report an issue. Thank you!

Happy contributin’ everyone!

PrestaShop version 1.7.8.7 is now available. This release fixes one important security issue, read this article for more information.

The maintainer team has been made aware that malicious actors are exploiting a combination of known and unknown security vulnerabilities to inject malicious code in PrestaShop websites, allowing them to execute arbitrary instructions, and potentially steal customer’s payment information. You can read our dedicated article to find out what’s happening, how the attack works and what to do to keep your shop safe.

While investigating this attack, we found a previously unknown vulnerability chain that has been fixed in this release. At the moment, however, we cannot be sure that it’s the only way for them to perform the attack.

We suggest upgrading your shop quickly in order to benefit from this fix. Please remember to backup before you upgrade.

Reminder: the latest version of the 1-Click Upgrade is v4.14.2 and has been just released, don’t forget to upgrade it.

About the security fix

This security fix strengthens the MySQL Smarty cache storage against code injection attacks. Read the security advisory here.

Note: this legacy feature will be removed from future PrestaShop versions and is maintained for backward compatibility reasons. It is recommended not to enable it due to reduced performance.

We would like to take the opportunity to stress once more the importance of keeping your system updated to keep your shop safe from attacks. This means regularly updating both your PrestaShop software and its modules, as well as your server environment.

Acknowledgements

Contributors to PrestaShop version 1.7.8.7:

• Dominik Shaim who first reached out to the security team and helped investigate the vulnerability
• Maintainers Daniel Hlavacek and Krystian Podemski who helped investigate the vulnerability
• Maintainer and security lead Thomas Baccelli who helped investigate the vulnerability and build the fix
• QA analysts and engineers who tested this release and the upgrade process: Florine Hea, Sarah Cavrot, Khouloud Belguith, Hana Rebai, Marwa Chelly, Hibatallah Aouadni, Boubker Bribri and Aurelien Rita.

Thank you!

Download PrestaShop 1.7.8.7 now!

Since version 1.7.8.7 is a “patch” update to version 1.7.8.6, upgrading from any 1.7.8 version will be easy: features will work better, and modules & themes which worked fine on 1.7.8.x will work just as well with 1.7.8.7.

The post Add Useful Info to the Laravel About Command appeared first on Laravel News.

Join the Laravel Newsletter to get Laravel articles like this directly in your inbox.

Attackers have found a way to use a security vulnerability to carry out arbitrary code execution in servers running PrestaShop websites. For details, please read the entire article.

What’s happening

The maintainer team has been made aware that malicious actors are exploiting a combination of known and unknown security vulnerabilities to inject malicious code in PrestaShop websites, allowing them to execute arbitrary instructions, and potentially steal customer’s payment information.

While investigating this attack, we found a previously unknown vulnerability chain that we are fixing. At the moment, however, we cannot be sure that it’s the only way for them to perform the attack. To the best of our understanding, this issue seems to concern shops based on versions 1.6.0.10 or greater, subject to SQL injection vulnerabilities. Versions 1.7.8.2 and greater are not vulnerable unless they are running a module or custom code which itself includes an SQL injection vulnerability. Note that versions 2.0.0~2.1.0 of the Wishlist (blockwishlist) module are vulnerable.

How the attack works

The attack requires the shop to be vulnerable to SQL injection exploits. To the best of our knowledge, the latest version of PrestaShop and its modules are free from these vulnerabilities. We believe attackers are targeting shops using outdated software or modules, vulnerable third-party modules, or a yet-to-be-discovered vulnerability.

According to our conversations with shop owners and developers, the recurring modus operandi looks like this:

1. The attacker submits a POST request to the endpoint vulnerable to SQL injection.
2. After approximately one second, the attacker submits a GET request to the homepage, with no parameters. This results in a PHP file called blm.php being created at the root of the shop’s directory.
3. The attacker now submits a GET request to the new file that was created, blm.php, allowing them to execute arbitrary instructions.

After the attackers successfully gained control of a shop, they injected a fake payment form on the front-office checkout page. In this scenario, shop customers might enter their credit card information on the fake form, and unknowingly send it to the attackers.

While this seems to be the common pattern, attackers might be using a different one, by placing a different file name, modifying other parts of the software, planting malicious code elsewhere, or even erasing their tracks once the attack has been successful.

What to do to keep your shop safe

First of all, make sure that your shop and all your modules are updated to their latest version. This should prevent your shop from being exposed to known and actively exploited SQL injection vulnerabilities.

According to our current understanding of the exploit, attackers might be using MySQL Smarty cache storage features as part of the attack vector. This feature is rarely used and is disabled by default, but it can be enabled remotely by the attacker. Until a patch has been published, we recommend physically disabling this feature in PrestaShop’s code in order to break the attack chain.

To do so, locate the file config/smarty.config.inc.php on your PrestaShop install, and remove lines 43-46 (PrestaShop 1.7) or 40-43 (PrestaShop 1.6):

How to tell if you have been affected

Consider looking at your server’s access log for the attack pattern explained above. This is an example shared by a community member:

(Note: the vulnerable module’s path has been modified for security reasons)

Be aware that not finding this pattern on your logs doesn’t necessarily mean that your shop has not been affected by the attack: the complexity of the exploit means that there are several ways of performing it, and attackers might also try and hide their tracks.

Consider contacting a specialist to perform a full audit of your site and make sure that no file has been modified nor any malicious code has been added.

Additional information

A patch version is currently being tested, and should be released soon.

We would like to take the opportunity to stress out once more the importance of keeping your system updated to prevent such attacks. This means regularly updating both your PrestaShop software and its modules, as well as your server environment.