FishCart: an online catalog management / shopping system Copyright (C) 1997-2005 FishNet, Inc. ========================================================================= 10/21/08: Added a contribution only template selection to the vendor table. (nmb) 10/17/08: Do not include the hidden "approvetc" if flag_tclink is set. (nmb) Added a zone option to show an optional contribution box at the foot of the final checkout page. (nmb) 08/28/08: RELEASE 3.2 (nmb) Added new and clearance product navigation display control flags in the web profile. (nmb) Added output buffering to showcart.php and orderform.php to smooth the output display. (nmb) 08/15/08: Reverse a few changes for the secure installation directory, not needed. (nmb) 08/07/08: Add warning about no country active in admin pages. (nmb) Add a new db.cust parameter for the secure installation directory. (nmb) 09/07/07: Alter giftcert_ndx.php to process orders with complete >= 1. (nmb) Modified process_xml.php to use values from functions.php. (nmb) 08/15/07: Changed PayPal library file include paths to not depend on the PHP 'include_path' settings. (nmb) Changed value of 'USERID' to 'FCUSERID', 'USERPW' to 'FCUSERPASSWORD' to avoid a couple of curl option conflicts in the PayPal library code files. (nmb) 08/11/07: Display minimum order quantity in the Add box, if defined. (nmb) 08/10/07: Added 'px' to the div width and height tags in fc_leftnav. (nmb) 08/09/07: Commented the getparam() calls at the top of preview.php, they cause problems if included. (nmb) 01/30/07: Added a parameter to xss_meta() to not strip possible metacharacters when accessed from the maintenance pages, which should be password protected. (nmb) 01/24/07: Changed ereg_replace() in xss_meta() to preg_replace(), preg_replace is faster by about a third. (nmb) 01/23/07: 3.2 RC2 released. (nmb) Fixed the long regex in xss_meta() to properly remove square brackets [ and ]. The POSIX regex rules are a bit particular for these two characters. The misplacement of these characters terminated the regex prematurely and caused it not to work. RC2 fixes these bugs. (nmb) 01/22/07: 3.2 RC1 released. (nmb) Fix a code bug triggered by both nlst and olst being set on in the URL parameters, this in response to a wrongfully reported SQL injection bug on bugtraq. Neither nlst or olst are directly used in an SQL statement, and thus the reported SQL injection error could not happen as described; the bug as reported only resulted in an SQL error, not an SQL injection error. If nlst is set, olst is forced off to prevent a conflict in table names in the SQL eventually generated. (nmb) 01/09/07: Moved a major block of code in showcart.php to process products added to the order before any cart display logic is called. This was necessary to syncronize the display in preview.php with the rest of the showcart page. (nmb) 01/08/07: Added zone flag for immediate sale / authorization only transaction type for the CC gateways. (nmb) Committed Paypal Website Payments Pro API integration. See the top of the common/paypalclearing.php file for further details. (nmb) 12/20/06: Minor customer cookie name syntax fix in modcart.php and orderproc.php. (nmb) Initial commit of associate maintenance pages, with a few corresponding changes to the SQL files. Also added a few modifications to fc_functions library to facilitate retrieving associate information via a library call. (nmb) 11/29/06: Added the first cut of the ECHO Online clearing gateway. (nmb) Updated install.pl to convert permissions to decimal; perl is dropping the leading 0, causing it to lose the octal notation. Updated sql_setup.sql to use admin.php rather than public.php. In a split user situation admin.php is the one that will have the necessary permissions to create tables, etc. 6/29/06: Added $cmt1 - $cmt5 default display in the final order if these variables are defined. These are useful for collecting extra or unique information on a per-store basis. (nmb) 5/25/06: Added email notification to public.php and admin.php to allow an admin or developer to receive an email if a database problem occurs. This is outcommented by default. Might be useful for developers to keep an eye on whatever might go wrong. It will send an email containing the query, error and errornumber if available. (bvo) 5/24/06: Fixed missing require admin.php in uploadmaint.php (bvo) 5/23/06: Fixed class name conflict in auxlinkmod.php and auxtextmod.php. (nmb) 5/15/06: Fixed "catlinks" bold entry in css, added "keywordtext" entry, modified fc_leftnav.php to style the keyword search text with it. (nmb) elist_tmplupd.php, do not remove CRLF from template header, body or footer to preserve formatting. (nmb) 5/08/06: Applied a few PGSQL fixes, thanks to Yahya Mohammad. (nmb) 5/05/06: Fixed a minor bug in vendinfo.php that had history nested inside vendor display control; they are now parallel within the wrapper table. (nmb) 2/21/06: New functionality added to generate DHTML/Javascript based category navigation. If turned on in the Zone Profile (off by default) a hierarchical sliding menu structure will be generated as a physical file each time a qualified action is performed. This includes adding a category, re-ordering categories etc. The action is done during the regular form submissions. The file generated is then included within fc_leftnav.php. You can adjust the height width and starting Y position via the Web Profile, this will allow you to place the menu correctly within your template. (bjh) 2/14/06: Updates to pull management of promotional email list subscription into the new My Account area. Now a customer can signup for an account and subscribe to the promotional email list. Or they can still leave the checkbox checked at the bottom of the orderform (if left on in the Zone profile). The email list is a on the fly generated list of subscribed customers selected via various parameters in the General FishCart Control->Dynamic Email Lists area. You can create as many "Dynamic Email List" templates as desired in the General FishCart Control->Add/Modify FishCart Templates area. You can then use those templates to send to your targeted list of customers. (bjh) 1/26/06: Added a zone flag to enable encryption for all customer data, not just financial data. (nmb) 1/23/06: Added \r\n filtering to the xss_meta parameter cleaning function to preclude HTTP response splitting attacks. (nmb) 1/19/06: Added PCase() routine to js_orderform.js, sets upper and lower case for most proper English/American names. Modified orderform.php to optionally autocorrect all lower case spelling if enabled in the zone (disabled by default.) In prior actual use this routine has worked well. (nmb) 1/12/06: Initial addition of the My Account area to FishCart. This area can be turned on/off within the Zone maintenance area, default is on. In the My Account area users can sign-up for an account, manage billing/shipping address, review order history and manage their subscription to the built in FishCart promotional email system. Users can also Sign In/Out, manage their password, modify email address and retrieve their password if they've forgotten it. If a user is logged in with an existing account their information will be pre-populated into orderform saving time. Comments on this feature are welcome, enjoy. bjh 12/21/05: Initial addition of Gift Certificate functionality. Also caught all sql files up with new column widths needed due to longer string lengths generated by encrypting customer data. bjh 12/20/05: Initial addition of function calls to fc_encrypt and fc_decrypt throughout all scripts which contact the custtable and ohead tables. The sql_mysql.sql file is setup to work with the new string lengths, the others will follow shortly. bjh 12/12/05: Added a top navigation file to allow for user defined links to go across the top of a template. One could actually include this file across the top, bottom or both of any given site template. To make links show up there go to General FishCart Control->Add/Modify Dynamic Links, set the location as Top Navigation. bjh 12/8/05: Preliminary addition of a Rich Text Editor into various maintenance pages. The original code for this editor was written by Kevin Roth: http://www.kevinroth.com/rte/demo.htm It has been tested on Firefox 1.0.7 and 1.5, IE 6.0 and appears to work very well. (bjh) 10/27/05: Added a Mass Product Option Copy set of maintenance pages. You can select 1 base product, and copy all of its options to any other existing product within the zone your currently editing. Optionally you can check the "Delete existing product options for all selected SKU's?" box and it will do just that and insert the copy of the base sku options only. bjh 10/25/05: Updates to the product option routines. Now it is possible to collect user input on a per product option basis. For example, your site is selling charms and they can be engraved with up to so many characters on one or more lines. You can now setup a product with a Option Group set to the Text Input type, set the maximum number of characters for each option and FishCart will do the rest. (bjh) 8/5/05: Added image uploader to webadd/mod categoryadd/mod productadd/mod. Files no longer needed can be automatically removed if the appropriate flag is set in zone maint. It is possible to change the default per category or product by checking a checkbox. Also added that the images used can be shown in category* product* and web* this is also controlled with a newly added flag. The images directory is split up into images/cat images/product and images/other (bvo) 7/24/05: Added a zone flag to disable keyword searches. (nmb) 7/22/05: Added a smarty templating zone flag, and modified all public files. This change allows you to turn on/off smarty FishCart templating. If on the currently compiled "Store Template" is pulled from the ${instid}templatetable eval'd and pushed out to the browser. If off, or no compiled template is found fc_header.php and fc_footer.php are included into all public files. Currently the default setup is that smarty templating is off at install, you must turn it on in the zone profile area of the maintenance pages if you want to use it. We also added the ability to upload a header and footer file straight into the template maintenance header and footer fields. This eliminates the need to cut and paste from your source file(s). Four new columns were added to all sql files in the templatetable, fc_header_comp, fc_header_comp_tmp, fc_footer_comp, fc_footer_comp_tmp. These are all maintained via the functions located within fc_smarty_functions.php. (bjh) 7/12/2005 Added code to show the quantity price profile on the product display if a quantity pricing profile is active on a product. (nmb) 7/8/2005 Added quantity product pricing profiles. This allows quantity sensitive pricing profiles to be set up. Products can then use the per product price or choose a predefined profile. (nmb) 7/7/2005 Added the payfloprolink.php file to support Payflow Pro payment clearing. Added necessary flag and a checkbox in the zone profile to choose Payflow Pro. bjh 6/23/2005 Added shopping.com and yahoo.com product feed generators in the maint/ directory. These files are starting points, modify to meet your own needs. bjh 6/22/2005 Added minumum product order quantities. nmb 5/27/2005 Removed credit card display from maintenance order detail pages. nmb 5/13/2005 New sql_setup.php sql file parsing logic to better scan the file. nmb 3/28/05 Added the capability to encrypt CC numbers with the PHP mcrypt module. The key is placed in db.cust, then substituted into functions.php. If a key is defined and the mcrypt functions are available, the CC will be automatically encrypted. nmb 3/24/05 Added the froogle_feed.php script to the maintenance directory. This script will allow you to upload your stores products directly to Froogle. The script is setup to deliver a standard product setup with price and picture to them per their documentation. You will need to determine if any extra columns are necessary in the final outputed file, as well as signup with Froogle. You can do that at http://froogle.google.com look for the "Information for Merchants" area. You will also need to uncomment the marked block of code in maint/productmod.php that is marked "uncomment to use Froogle add feed routines". bjh 3/08/05 Upgraded Smarty to the latest 2.6.7 stable version. We will catch all install scripts, and the GUI installer up to speed soon. The Smarty delimiters had to be changed from { and } to <{ and }> to facilitate allowing actual PHP scripting from within the FishCart Templates area. Whenever Smarty saw an opening or closing curly bracket it tried to use it..which is not always the desired behaviour. All sql files have been updated to reflect the new delimiters, along with the definition in the smarty/Smarty.class.php file. bjh 3/07/05 Added Smarty template control to the public FishCart pages. Two new files, fc_header.php and fc_footer.php control your cart template. These files are written when you "Publish" your template from the General FishCart Control->Add/Modify FishCart Templates maintenance area. A replica of the stock index.php file has been created and modified to serve as a means of previewing a template change before publishing. This file is called fc_preview.php and can be viewed by clicking on "Preview Template" from within the Modify FishCart template maintenance area. The preview functionality uses two other files, fc_header_tmp.php and fc_footer_tmp.php to show the proposed new look and feel of your cart before publishing. bjh 3/01/05 Added a Help Desk area, including 1 new file called info.php. This file is used to display items added into the 'Dynamic Text' area of FishCart's maintenance pages. This can be used to help maintain pages which would otherwise have to be static HTML, out of the database. This has been tested and is known to work on multi zone FishCarts. bjh 2/28/05 Added multi-prods across functionality. This is controlled overall in the Web Profile area, and can be set on a per category level as well. If set to 1 product across, FishCart will default to the original product display. Otherwise it will show products left to right up to 5 across. Search obeys the products across value set in the Web Profile area. bjh 12/02/04 Added new functionality to the Order Detail Results area of Maintenance. Now you can lookup orders by OrderID, Customer Email address, Date and/or time range within selected date. Also added orderdetailrecs.php and htaccess.dist to the Maintenance directory. htaccess.dist is a skeletal example file for password protecting a directory. (bjh) 11/19/04 Added first cut of gift processing, thanks to Spencer Yost for the initial contribution. (nmb) 11/18/04 Modified functions.php, proddisp.php, orderproc.php, all sql files, and the coupon maint pages to allow two new types of coupons. This upgrade allows coupon profiles to optionally be tied to a single sku, or a category. Category coupons can be applied to any category, all categories below it will be affected by the coupon as well. All coupon rules still apply. The one new rule is that if you choose to map the coupon to a SKU, you cannot also map the same coupon to a category and vice versa. )bjh) 10/28/04 Modified fc_smarty_functions to set the character set to the current language in operation. Changed the Smarty templates to add the html head and meta character set tag. (nmb) Touchup on the aux link and aux text tables, added language ID. (nmb) 10/27/04 Added '$lang_char_set' to each lang_*.php file to carry the character set for that language; added a meta tag to print the character set in the HTML HEAD section; converted remaining public files to use the new object system to retrieve language settings. (nmb) 10/26/04 Noticed a problem in a split cart install, where the secure directory DOCUMENT_ROOT path was incorrectly set. This did not sit well with the Smarty Customer Order confirmation. The main problem was that Smarty could no longer include a php script from within a template. This was fixed by removing the Smarty php include and accomplishing that task from within emailconfirm_tmpl.php, in other words letting php handle it rather than Smarty. This has fixed the problem. (bjh) 10/20/04 Over the past couple of weeks we have been adding CSVParse into the default install of FishCart. We have also caught CSVParse up to current source, as well as adding in features. New features to date include the ability to re-order the field list sequence, sub-navigation throughout all pages to ease navigation. We've also recently started adding in new keyword search capabilities, with plans to add an advanced search feature. (bjh) 10/20/04 Fixed a few syntax errors in sql_mssql.sql. (nmb) 10/07/04 Added Payflow Link online clearing module; instructions for configuring the Payflow Link Manager web site are included in the payflowlink.php module source. (nmb) 09/30/04 Added csvparse to the default installation under /maint. (nmb) 09/28/04 Added eregs to ccverify.php to strip '-' and ' ' from the CC number before verification. (nmb) 08/26/04 Added a catalog only zone flag. (nmb) 06/01/04 Initial add of supplier table and maintenance pages. This addition will make it possible to attach a supplier code to any product. The first use for this is in the Dynamic Email Lists maintenance pages in the search feature. You can now search against your past sales for any particular supplier. For example, you want to know who bought from Widgets Inc. Selecting that company and hitting search will return all customer names and email addresses. You can create/add/modify a supplier via the maintenance area. bjh 06/01/04 Added a test.tpl template and a file called smartytest.php into source. This will allow the user to verify that Smarty is up and running. If it is, you will receive the standard Smarty Debug Console with a couple of variables assigned. Otherwise you will receive a blank white screen. Access it by going to your installed storefront Example: http://domain.tld/store/smartytest.php The file is named smartytest.php. bjh 05/04/04 Added ability to export any given generated customer list from the Dynamic Email List area to a tab-delimited file. This has basically the same functionality as the Customer Information Download area of the maintenance pages. Also, on 4/30/04 added the customers Recent History to all cart display pages along with controls in the Web Profile maintenance area. 04/16/04 Added two step email list subscription routine to orderproc. Upon first order completion, if promotional email flag is set the customer will receive the email list confirmation email. Once the customer follows the instructions and confirms their subscription their promo email flag will be set to new customer status. If they return and process another order, their promo email flag will be set to regular/repeat customer status. This is for organzational purposes, and to allow the vendor to send targeted emails to new customers that have either signed up to be on the email list, or have only completed one order. Also added meta keyword and meta description capability throughout index and display. Single product display uses product keywords and product short description to create tags. By default if no tags are set, the language keywords and language description will be used. Maintenance pages have been updated to reflect changes as well. All included templates have also been updated as well as stock source. Broad level improvements: * Customer Information Download: Delimited file which you can customize by choosing any number of available pieces of customer information. * Email list subscription: two step email confirmation process * Smarty templating system for customer emails: provides HTML order confirmations and dynamic email list management functionality via the maintenance area. Also the complete add/modify/delete system for creating templates has been implemented, along with a quick reference quide with all available units of information. * Meta tag keyword and description control: Default sets input into the language profile area. Category keywords,description and single product level keywords and short description all used and swapped out dynamically based on what the user is looking at. 04/14/04 Added collection of Merchant information for cc clearing to the zone profile area of the maintenance pages. The merchant name, id, password and mode of the gateway are now stored in the zone table and used in the various gateway scripts. Also updated db.cust to include cambist.php and paymentclearing.php in the upload process. bjh 03/18/04 Added 'prodperbox' and 'prodshipdaysmax' columns to product table for more specific shipping information. Added packaging group code to aid in combining multiple items into group packages. (nmb) 02/26/04 Modified sql_mysql_users.sql to grant access rights correctly for locking tables on MySQL v4. (bvo) Modified orderproc.php lock tables for MySQL 4 compatibility. (bvo) 02/23/04 Moved ESD dlmax and dlmaxdays from hardcoded values to the product table. (nmb) 02/16/04 Fixed the insert_id function in oracle. Commented out the unneeded shipszid columns in all sql files. (bjh) 01/26/04 Added the strtolower function to billing and shipping email (with shipping trim statements). Also in the shipping trim statements, $shipping_address1 and $shipping_address2 were incorrectly listed as $shipping_addr1 and 2. This dates back to at least 2.05b8. (das) 01/23/04 Initial files checked in to control all templates using Smarty's engine. (bjh) 01/22/04 Added carrier column to shipping profile (nmb) 01/18/04 Commented out fulltext searching in mysql until we better understand its limitations/quirks. (nmb) 01/15/04 Added mysql fulltext indexing and searches on the product columns searched by keyword. (nmb) 01/12/04 Released 3.1 (finally.... nmb :) 01/10/04 Modified rnd() function to return "round($n,2)" to avoid integer overflow. (nmb) 12/24/03 Modified langupd.php so that any cat in any next language set to "Front Page Promotions" will be used in the same way as in the first language installed. This means that the "Front Page Promotions" will not be visible as normal cat anymore. Instead it's contents will only be shown on the Front Page. This makes it more consistent. (bvo) 12/08/03 Added new webflag to enable the usage of nl2br. This flag modifies any new line in prodsdescr and proddescr to a
. (bvo) 12/04/03 Further modifications to the country language tables to split the country table into two, countrytable and countrylang, to better normalize the structures and consolidate country name translations into one table. (nmb) 12/03/03 Added languages/iso_country_list.csv to aid in maintaining the country codes. (nmb) 11/20/03 Released beta 9b to fix a minor syntax bug in the data insert section of the new country code table. (nmb) Added country table grant in mysql users grant file. (nmb) 11/19/03 Added dynamically generated country lists and corresponding maintenance pages; db.cust was changed, as were the install* perl scripts and sql files. (nmb) Released 3.1b9. Released 3.1b9a to fix a silly syntax error in the new country code table definition. (nmb) 11/12/03 Various fixes in payment.php. (nmb) 11/11/03 Released beta 8, with comment fixes to sql_mysql.sql. Fixed all places where getimagesize() is called not to null the image spec if the file is not found. 11/10/03 Removed zone flag to control line item shipping; split shiplineitem.php into shiplineitem.php and shiplineall.php for the two different methods; modified shipping profile maintenance pages to use the new script. 11/07/03 Added zone flag to control random or sequential assignment of the last 7 digits of the cart id; sequential assignment could permit information leakage regarding site traffic levels and products on order until the order is completed. Customer information is not subject to leakage since a separate customer profile cookie is used. Added zone flag to control line item shipping between its two modes; see the source of shiplineitem.php for details. Fixed maint/ship{add,mod}.php to properly select the shipping script. 10/28/03 Added Norwegian, thanks to Frode Vasstein. (nmb) 10/20/03 Fixed syntax error in paymentclearing.php. (nmb) 10/17/03 Added MSSQL support via the sql_mssql.sql, public_mssql.php and admin_mssql.php files. db.cust file modified also. Partially added Oracle support in the conditional DATABASEENG qualified sections. (nmb) 09/29/03 Added product option group name table, along with necessary maintenance code, db.cust and install*.pl mods. 09/17/03 Added prodname to the list of keyword search comparisons in display.php. (bjh) 09/16/03 Added line at top of functions.php to force quoting off. (nmb) 09/15/03 Changed installed zone flags to change the default to keep orders after completion. (nmb) Announced 3.1b1. 09/12/03 Cleaned up the logic to add zones and languages on the fly. (nmb) Inserted the olzone column in the orderline table to keep track of products by zone. (nmb) 09/11/03 Removed use of maximum languages and maximum zone checks. (nmb) 09/10/03 Added two methods of Terms and Conditions acceptance; one is a link at the foot of orderform.php, the other is an inline page just prior to orderform.php (nmb) Added maint/invupdate.php to upload/update inventory from a two column tab delimited file, SKU in column 1, inventory quantity in column 2. The use inventory flag is set for each product found, and a list of products in the file but not found in the FishCart database is reported. (nmb) 09/09/03 Changed productmod.php to display blank fields if the prodlang entry for the chosen language does not exist. (nmb) 09/08/03 Added to the language profile the ability to select a category to be the front page category for that language. (nmb) Added prodlflag1 to prodlang table. Also added 2 new flags flag_hasoption and flag_hasrel. If a product doesn't have options or related products assigned we will need less queries to show the cart. (bvo) Added a query to prodrelupd.php to see if the product ID for both base product and related product are in the product table. (bvo) 09/04/03 Added new $domaintld prompt in db.cust, install*.pl to have a single field that can replace the current DOMAIN.TLD substitutions. (nmb) Added checkbox to orderform.php to allow customer address information to be retained or not on the user's computer. (nmb) 09/03/03 Added @onetimearray to db.cust; changed install*.pl to install this and @langarray once, renaming to *.recommended if the file already exists. (nmb) 09/02/03 Added font family, weight and size to style definitions for the button rollover effect. Without, the buttons just inherit the last definition for a and a:hover which is contained in .navtext A:*. (das) 09/02/03 Added poptzid=$zid and poptlid=$lid to the queries fco running in index.php and display.php to show the options. Without $zid and $lid all options are shown no matter which zone and language is selected. (bvo) Added poptzid=$zid and poptlid=$lid to the query in prodoptmod which shows a link to modify product options (bvo) 08/31/03 integer cast $custid in showgeo line 137 (das) 08/30/03 Added subzseq column for eventual subzone ordering. (nmb) Added subzoneseq.php and subzoneseqmod.php to /maint. (nmb) Added catseq column to category table; added category sequence maintenance pages. (nmb) 08/29/03 Added subzparent column to subzone table; updated subzone maintenance pages to maintain it; added code to showcart and showgeo to use it. (nmb) Added oheadcustip column to ohead to track purchaser's ip address; modified orderproc to use it. (nmb) Added zoneflag to allow a choice to logging access to the cart. (bvo) Modified subzone* to use the vendor information from the table instead of from the web (bvo) 08/28/03 Added customer shipping address and customer credit card info to order header record to preserve the information for batch order processes; added gift order flag for expansion. (nmb) Modified cron script to null out CC numbers in ohead as done in customer table. (nmb) Added 'langwelcome', 'langterms' column to language table. (nmb) Modify index.php to display langwelcome, vendinfo.php to display langterms. (nmb) Added 'catcols' column to category table. (nmb) 08/21/03 Added dynamic left nav bar to index, display, showcart. Added web flag to control display of preview panel. (bjh) 08/19/03 Removed the 'webcontrib' column and related code, as it is redundant with the zone flag for inline contribution. (nmb) Commented the donation box in proddisp.php, instead use only the inline donation form at checkout. (nmb) 08/15/03 Restored usage of prodtpic, prodname and prodsdescr to both index.php and display.php. Both prodpic and proddescr are used in a special way to allow a visitor to see only one product with more detailled information. Any combination of prodpic with or without proddescr and proddescr with or without prodpic will result in a special link in index.php and display.php (bvo) 08/15/03 Added credit card clearing for Payment Clearing, URL https://secure.paymentclearing.com/. No idea what organization is is behind this, as the URLs in unsecure form do not respond. It seems to be a system that others private label. 08/12/03 Added cpnmaximum to coupon table; consolidated all coupon processing into coupon_discount in functions.php. (nmb) 08/11/03 Modified zone to not ask about using subcategories; updated category maintenance tables to be able to maintain subcats as well. 07/30/03 Moved inventory qty update routine in orderproc.php below CC gateway calls and out of contrib_only section. (das) 07/28/03 Removed CUSTID from db.cust, all install* perl scripts; changed to INSTALLID; defined $instid in functions.php, removed all CUSTID references from .php files, dynamically substituted from funtions.php. 07/28/03 Changed $CookieCUSTIDCustid = getcookie('CookieCUSTIDCustid'); to $CookieCUSTIDCustID = getcookie('CookieCUSTIDCustID'); in the variable loading sections of various public files 07/27/03 Added a file called preview.php. The purpose of it will be to display a small preview of your cart contents direclty under the new items and view cart buttons on the index.php page. This file can be safely included on the display page if necessary, however it is only in index.php for now. It can easily be commented out or removed from index, as it is a completely stand alone file. bjh 07/27/03 Changed $ccexp_years to $ccexp_year and added $ccexp_month in the variable loading section of orderproc.php (ds) 07/21/03 Fixed short php tags in productadd.php. 07/14/03 Removed asp style tags from showgeo.php (nmb) 07/08/03 Updated upload*, vend*, web*, zone* for register_globals conversion. Updated splitcc.php for register_globals conversion. 07/03/03 Added the maintenance section to control per item credit card charging. bjh 07/03/03 Fixed the perl syntax of install_win32.pl. 07/02/03 Changed several prompts in several of the language files to include a space before the COMPANY name. 07/02/03 Renamed promptmod.html to promptmod.php, fixed in db.cust. 07/01/03 Minor changes to languages.php to work with prompt mod scripts. 06/26/03 Various changes per Chris Neale, tech@elogicom.com. 06/25/03 Added a Return-Path header at line 111 in common/emailconfirm.php Most cases is unnecessary, but if mail server is not setup correctly, not having a valid Return-Path can cause the confirmation email to be bounced. 06/10/03 Removed old unneeded empty if routine from public index.php at line 318. 06/05/03: Modified following files in maint directory to allow use with register_globals and magic_quotes off: index.php, ccverify.php, prodcatndx.php, productndx.php 05/29/03: Opened up cvs access to selected developers, cvs updates logged to the developer list.. 05/26/03: Removed 'not null' constraint from pwoid in user password table. 05/23/03: Added German thanks to Rev. Dr. Jimmy Michael Coleman. 05/20/03: Changed install* and *.php files to not include a '/' before the installed cart directory; requires a leading '/' before the 'directory' in db.cust. This allows installation into document root without double slashes. Thanks to Dan Smith. 05/14/03: register_globals and magic* changes completed for public files. 05/02/03: Renamed totals.php to functions.php. Absorbed round.php into functions.php 05/01/03: Start of register_globals rework on index.php, display.php, showcart.php and modcart.php. 04/30/03: Fixed an extraneous space in the lang_fra.php file. 04/29/03: Fixed two subcat bugs, one in subcatndx.php, one in subcatupd.php. 04/25/03: Fixed SQL limit syntax in categoryupd.php, kudos to Michael Glaesemann. 04/22/03: Added online invoice payment page; modified sql files to add 'payinv' column to orderhead, orderproc.php and the email generation files. 03/26/03: Added FishNet CC clearing gateway. Fixed a couple of bugs in promptmod.html and promptupd.php. Released 3.06. 03/13/03: Removed FONTTAG/FONTCLOSE; no longer required style.css takes precedence. 03/12/03: Postgres SQL file updates, thanks to Don Seiler. 03/11/03: Yet another syntax fix in languages.php. 03/07/03: Updated the lang_nld.php file, thanks to B. van Ouwerkerk. 03/06/03: Made a few changes to install_win32.pl at the suggestion of Andrew Braund. 03/04/03: Added Castillian Spanish language, thanks to Marcos A. Alba. Fixed a few residual bugs in the initial release. 02/25/03: First release of 3.0. The major change is an abstraction of shipping profiles from subzones; these are now associated at runtime. A few tables have been added to allow FishCart to display links in the cart without having to understand what the link is about. This can assist in adding links to FishCart without having to modify source code. 01/27/03: Added promo email subscription database flag, 'promoemail' prompt to the language files. 01/15/03: Cleaned up a few errors in shipupd.php, thanks to B. van Ouwerkerk. Changed FC_SQL insert_id() method to use $this->Link_ID rather than $this->Query_ID. 01/13/03: Added code for 2 digit 0 padded month in authorizenet.php. Added Polish language file. 01/07/03: Added magic_gpc and magic_quotes documentation in INSTALL. 01/06/03: Added periodic service description to the product language table. Fixed the VAT service applicability flag. 01/04/03: Added shipping middle initial to emailconfirm.php. 01/03/03: Released 2.19. Many minor changes released, and authorize.net file updated, thanks to Camden Spiller. 12/11/02: Removed all short ... block in public01/display.php to move it just above the tag. 02/22/02: Added subtotal to the product display, language prompts. Added initial ESD work, including esdeliver.php, esdsend.php, and esd_external.php. 02/21/02: Added two new maintenance pages productaddm.php and productupd.php to allow adding a product to more than one zone at once. Added the files to db.cust. 02/20/02: Added Dutch to the cart languages. Added db.cust items 'langiso' and 'langname' to be able to set the default installed language. Modified the install*.pl scripts to use these parameters. Released 2.11. Added fixes from Rodolfo Garcia for mysql 3.22, which needs 'not null' on indexed columns. Released 2.11a. 02/19/02: Minor cleanup on the croncart.php file. 02/18/02: Moved mysql unlock tables above the order processing, just after the update to set complete=1. Modified javascript credit card number check to remove spaces. Released 2.10. Added additional 'not null' qualifiers to the mysql product table. Released 2.10a. 02/15/02: Released 2.09. 02/14/02: Added the zone level debug flag for the public pages; sets error_reporting(15) if set; expanded DEBUGGING. 02/09/02: Integrated the price report module by Wayne Ethier and Glenn Antoine. Very nice addition; thanks guys! Integrated the picture height/width rebuilder by Wayne Ethier. Thanks much, Wayne! Released 2.08. 02/08/02: Updated copyright date information. Released 2.07. 02/07/02: Abstracted the URL and directory information into the public.php and admin.php files to allow easy relocation of a cart. (post 2.06 and 2.06a) Released 2.06 and 2.06a for the cvsparse updates. Added Chris Carroll's new csvparse version to the distribution. Thanks Chris, good addition. 02/05/02: Removed 'http://' from in front of a few URLs; this part is added during installation. Made a few changes to the fc_functions libraries to bring them up to the latest order line record format. Released 2.05. 01/18/02: Added the CVV column to the customer record. Added the check number, checking account and bank routing columns to the order header record. 01/17/02: Added the javascript mod10 cc number verification script. Fixed an obscure bug in the geography change link that was giving fits changing subzones. 01/04/02: Removed the 'unique' qualifier on the 'poptsku' index in the product options table. 01/01/02: Happy New Year... :) Fixed prodinvqty in the sql_*.sql files to be 'not null'. 12/19/01: Removed unneeded/redundant SQL files from ./sql directory. Began work on ESD, Electronic Software Delivery. Added ESDTABLE. Added 'olesd' to ORDERLINE. Added 'pwesd' to PASSWORDTABLE. Added 'prodactcod' to PRODTABLE. Added 'prodserpfx' to PRODTABLE. Added 'prodsernum' to PRODTABLE. Added 'prodserhrs' to PRODTABLE. Added 'prodsermax' to PRODTABLE. Added 'prodserfil' to PRODTABLE. Added 'prodversion' to PRODTABLE. Added 'flag_useesd' to product flags. Added 'flag_genesd' to product flags. Added locking order header record in orderproc.php, the purpose to prevent double clicks on the order submit button from causing a race condition that could result in both submits working on the orderfile at the same time. mysql requires all tables to be locked... yuk. Consolidated initial CC type, number and date validation into one function, cc_check(), in cc.php. 12/18/01: Correct orderproc.php to select the current shipping profile rather than the default. 12/14/01: Tighted up a few get/post/cookie passed arguments to cartid.php. 12/13/01: Removed 3/7 North American dial plan formatting of the billing and shipping telephone numbers; non 0-9 characters are removed. Also formatted as strings instead of digits so that leading zeroes are retained. Changed categoryupd.php to properly delete categories now. With the addition of nested subcats, it is necessary to delete using catpath rather than catval. 12/11/01: Reinstated subcat selection in zone{add,mod}.php. 12/10/01: Added INSTALL.MYSQL.QUICK by B. van Ouwerkerk . 12/06/01: Changed upload.php to use move_uploaded_file() by default. 12/04/01: Added 'unique' index qualifier to the product SKU fields in the product, product language, product option, new and old product tables. 10/18/01: 2.04 released with two fixes below. Added common/proddisppgp.php to work with emailorder_pgp.php. emailorder_pgp.php will by necessity use the mail or sendmail programs to pipe mail through. Modified proddispfixed.php to accumulate into a string '$body' rather than print to an open file handle; this will allow use of the PHP mail() function rather than directly calling a local program. 2.03 released. Fixed the curl url in authorizenet.php. 10/08/01: Fixed spelling of WEIGHTTHRESH in sql_mysql.sql. 10/04/01: Fixed 'commit work' error in contribute_order.php; should be $fc->commit(); 09/25/01: Added shipthreshweight.php to cvs. Added various changes to SQL files, maintenance files, common and public01 files as needed to add the weight based shipping contributed by Ramon Morros . This was an excellent addition. 09/24/01: Changed prodweight column from type integer to decimal(12,4). 09/18/01: Fixed javascript checking in the orderform and minor formatting errors in the emailconfirm and offline pages. Fixed credit card collection for email order. 2.01 released. 09/07/01: Fixed all file extensions and calls to be *.php instead of *.php3. 08/30/01: Fixed emailorder.php to take out spaces and - before taking the last 6 digits. 08/29/01: Added cybercash files and edited flag, zone, and orderproc.php files to add CyberCash capability. 08/24/01: Added much tighter CC number validation to common/cc.php. 08/22/01: Added additional range check to cc.php to check initial digit for value of 3 to 6 inclusive for Amex, Visa, Mastercard and Discover. Added additional prompts to the lang_*.php files to complete making orderproc.php language independent. 08/17/01: Released 2.0. 07/23/01: Added (int) cast to curshipid about line 486 of showcart.php 07/04/01: Added install_cygwin.pl for NT installations that have the very worthwhile cygwin package installed. http://sources.redhat.com/cygwin/ Added catalog user password control system. The db.cust files was modified to add the pw* files, and the basic SQL files were modified to add a new password table. The maint/pw* files are new for the password table maintenance. As part of the password system, modified the following public files to conditionally include pw.php: index.php display.php showcart.php contribute.php Installing the password system on existing catalogs is not recommended, as a number files will require hand updating to add the changes. 06/30/01: Added install_cygwin.pl for installing fcsql on a win32 machine with the cygwin suite installed. Added the maintenance pw* files to add the ability to permit different levels of administration logins. 06/27/01: Fixed install_win32.pl to reference the fishcartsql.db file with as ..\\fishcartsql.db. Fixed a bug when adding a product option; added the poptsku qualifier to the select get the product option flags from the option group if it exists. (prodoptupd.php) 06/20/01: Fixed a logic mixup between product option sku replacement and sku pattern substitution in display.php and showcart.php. 06/07/01: Change maint/croncart.php to delete all stored CC numbers where the last order was placed over 10 days ago. This way if CC numbers are kept it will at least limit the exposure. 05/24/01: Expanded the comments in the ./db/db.cust file to be more helpful and give more specific examples. 05/14/01: Changed ~/maint/croncart.php to delete only uncompleted over two days old, rather than all orders. 05/11/01: Added 'select for update' on the order header record, with rollback as appropriate if not processed to completion, to orderproc.php. In databases that process transactions, this can prevent possible race conditions if the user double clicks the final order submit button. 05/10/01: Added custid collision detection loop in orderproc.php when adding a new customer profile. 04/26/01: Placed 3 no cache headers in all public cart pages; in particular IE can give cache fits. 04/18/01: Added the DBDUSER/DBDPASS grant in sql_mysql_users.sql. 03/31/01: Minor tweaks to croncart.php to more accurately process exact day periods from midnight to midnight. 03/26/01: Added PRODREL table to mysql user permissions. Fixed maint/croncart.php to report order and contrib totals. 03/21/01: Rearranged logic in orderproc.php to check payment info after the order totals are recalculated. 03/07/01: Added the system DSN, username and password to the db.cust file, install scripts. Updated fc_functions.asp and fc_post.asp for fcsql v2 operation. Fixed the logic in proddisp.php to not show the conribution box in showcart.php if inline contribution is enabled. 02/17/01: Beta 9 released. 02/14/01: Changed orderproc.php to update the order header record column 'tstamp' with the current time. Added FAQ information on cURL requirements for authorize.net. 02/09/01: Added authorizenet.php module courtesy of Glenda Snodgrass. Added zone flag to control authorize.net clearing. 02/07/01: First commit on related product maintenance page additions. 02/01/01: Added French language template courtesy of Ronald Labonté. Added the related products table to the sql files. Added related product table substitutions to install* files. Added the 'prodrel' table name to db.cust. Initial work on the related product maintenance pages, prodrel???. 01/25/01: Added logic to the top of the maintenance front page to ensure that there is a shipping profile per subzone. Added ISBN to the product maintenance pages; it has a column in the database but had no way to be updated. 01/14/01: Made a small fix to totals.php, prod_price function to set $flag1 global. A number of other small fixes have been made to the cart. Released beta 8g. 01/02/01: Fixed the install* scripts to properly install the language scripts on the first run. 12/21/00: Corrected a logic error in javascript in index.php, changed || to && in the category/keyword form onSubmit. Added 'distinct' and keyres column ordering to the maintenance page keyqueryrslt.php when querying key search results. Fixed a couple of bugs in showcart.php relating to the 'return to product pages automatically after adding a product' function; this is controlled by a flag in the zone profile. Corrected an absolute/relative option price bug in showcart.php. The OLPRICE in the order detail records was always being calculated and stored as relative; absolute pricing was not working. 12/11/00: Added colors.html to the maintenance pages, linked it from the web and category maintenance pages. 12/07/00: Added javascript to orderform.php, contribute.php, to check data values before submitting for final processing to orderproc.php. Released beta 8f. 12/06/00: Added the new 'ordertoday.php' file to the db.cust file maintenance file name array. Added the real time "Order Summary Today" page to the maintenance section to report orders to date for the current day. Requires orders to be kept in the cart after processing; they cannot be deleted by orderproc.php or it won't work. The maintenance page only shows this option if orders are kept after processing. Updated orderproc.php to check that only orders with complete less than 1 in the order header record will be processed. This will prevent the same order from being resubmitted. 12/04/00: Released beta 8e. Adde trim() to the shipping information in orderproc.php to remove pure white space so the null check will properly substitute billing info into shipping info. Set the width of billing and shipping city and zip code fields to the same width in orderform.php. 12/02/00: Fixed a trailing comma error in the coupon table of the sql_pgsql.sql file. Added a few order summary statistics to ./maint/croncart.php. Changed order head record values for 'complete'. cartid.php sets the initial value to -1, showcart sets to 0 when a product is added to the cart, and orderproc.php sets to 1 when the order is placed. These values will help determine how many orders are started and abandoned, as well as how many are completed. 12/01/00: Added additional prompts to lang_*.php for emailconfirm.php; modified emailconfirm.php to use them. Modified the install* scripts to create the './languages' directory under 'secroot' as well as 'docroot'; this is necessary for carts with split docroot and secroot installations. Released beta 8d. 11/28/00: Released beta 8c. 11/27/00: Fixed the keyword only joins in display.php; these were incorrectly joining with the category table. Rearranged the showcart.php page to show the cart contents heading banner only once. 11/27/00: Added some extra code to ./maint/index.php to make sure $langid has a value if the new zone table field zondeflid is not yet initialized. Fixed a problem with hanging commas in two SQL statements in showcart.php. Released beta 8b. 11/22/00: Fixed a couple of syntax bugs in sql_mysql.sql. Committed the work begun yesterday to track order totals properly in the order header and line records. Released beta 8a. 11/21/00: Added various order total columns to the order header record for easier totaling. Table alter commands are in ./sql/sql_*_ohead.sql. -- product subtotal prior to discount pstotal decimal(12,2); -- coupon discount discount decimal(6,2); -- shipping amount shamt decimal(6,2); -- non shipping sales tax total nstax decimal(6,2); -- non shipping sales tax total tstax decimal(6,2); -- order subtotal, prior to contribution ostotal decimal(12,2); 11/21/00: Released 2.0 beta 8. 11/20/00: Added activation/deactivation timestamp to products. Added 'prodstart' and 'prodstop' columns to product table, as well as to maintenance pages. Added zone flag 'flag_zoneproddate' to be able to choose whether or not product start/stop dates are used per zone. Added column 'cpnredeem' to the coupon table to track total redemptions of each coupon. 11/15/00: Added initial cut of coupon database. New files are ./common/coupon.php, ./sql/sql_{mysql,pgsql,solid}.sql. Updated the install* files to customize the coupon files. Updated the db.cust file to copy the coupon files. Added the 'couponid' column to the order header record. Added 'couponid' and 'coupondisc' entries into lang_*.php tables. 11/15/00: Released beta 7c. Added code to implement the 'option required' logic in display.php and showcart.php. Added the 'optreqtext', 'Option Required', and 'optviolation', 'Required Option Not Chosen', fields in the language templates. 11/14/00: Moved the $dn capability (# of products displayed per page) to the web and category database. Added 'catprodpage' and 'webprodpage' columns to the category and web SQL tables; changed the maintenance pages to allow this to be updated from the maintenance pages. Changed display.php to set $dn from the tables. Changed documentation references from 'maintenance.php' to 'index.php' for references to the maintenance main page. 11/13/00: Added simple order summary, order detail, and keyword summary query pages at the bottom of the left hand column of /maint/index.php. Miscellaneous bugs fixed. 10/27/00: Began adding multilanguage internationalization. (nmb) Added the ADDING_LANGUAGES file to ~/docs. Added the ~/languages directory for language template files. Added the ~/languages/languages.php include file, as well as English and Italian files. Modified ~/db/db.cust to add 'langarray' for language files. Modified the install*.pl files for the new 'langarray' in ~/db/db.cust. The install*.pl files only install the language array on the first pass, when the 'langdir' directory is created. This permits local customization of the language that will not be lost if the cart is reinstalled, or unless the 'lang' or 'seclang' directives are given to install*.pl. Added new column to zone table for default language, 'zonedeflid' in the ~/sql/sql_{mysql,pgsql,solid}.sql zone tables. Added new column to language table, 'langiso', for ISO code in the ~/sql/sql_{mysql,pgsql,solid}.sql zone tables. Removed the default language column, langid, from the master table. Modified ~/common/cartid.php to take default language from zone. Modified ~/maint/master*.php files to remove langid column. Modified ~/maint/zone*.php to add the zonedeflid column. Modified ~/maint/lang*.php to add the langiso column. Various tiny cleanups to the logic of several files along the way refine existing functionality. 10/25/00: Beta 6 released after some work on product options, as well as cleanup on the nested subcategory work. Many thanks to Simon Weller for the nested category work. 5/11/00: Rebuilt category system to support effectively unlimited subcategory levels. (Simon W) 5/2/00: Added the associate table and related changes. 4/28/00: Added email notification of cvs changes to the developers. 4/25/00: Cleaned up the domain/tld/url installation options in db.cust. 4/20/00: Split CC number delivery now set up for all SQL engines. Made split CC number delivery a zone flag. 4/19/00: Added ~/docs/INSTALL.MYSQL, courtesy of Patrick E. McKnight . 4/13/00: Added product options to mysql / pgsql. 3/13/00: Added OS/2 install_os2.pl courtesy of Martin Frankford. 12/24/99: Ongoing product option work. 11/02/99: Added Simon Weller's CSV parse routines in the /csvparse directory. These are provided as examples of one way to load the database from delimited files. Added a couple of FAQ updates. 10/29/99: Added zone to order line record. May not be used in all cases but may help facilitate orders with products from different zones. Added a default flag column to the language table. Various buglet cleanups. 10/25/99: A couple of bugs fixed in the muliple shipping profile system. Category and Web profile 0 price alternate text lengthened to 80 for mysql databases. 10/23/99: Added audio and video clips to display.php. Various minor cleanups from the subcat rework in display.php. 10/22/99: Renamed DB_Sql class to DBbase_Sql in admin_*.inc and public_*.php to avoid name conflicts with PHPlib. Subcategory display cleanup in display.php. 10/20/99: Changed cookie path parameter to work independently of the directory the cart is installed in. Affects cartid.php, orderproc.php. 10/13/99: Additional logic to better handle multiple shipping profiles. 9/21/99: Added a FAQ; doesn't have much in it, but it's a start. Added multiple active shipping profiles; changes made to showcart.php, modcart.php, threshpercalc.php, and orderform.php. Changed Last-Modified: header to Expires:. 9/20/99: Added invqty check to products_by_category in fc_functions.php. 9/19/99: Added switch to zone profile to delete / not delete orders from the SQL database after completion. 9/16/99: Remove HTML tags from short product description before displaying. Synchronized fc_functions.php and cartid.inc for AID handling, other order tracking details. Added the AID to the fc_functions.* library open_fc(). Added cmt{1,2,3,4,5} to the order head record; these may be useful for passing various information back in the order. 9/15/99: Changed the credit card expiration to go out $ccexp_years from the current year. $ccexp_years is defined near the top of orderform.php and passed to orderproc.php. It is currently set for 9 years in the future; credit card expire years must be no later than that year. 9/13/99: Changed the header and footer promo items in index.php to use the web{hd,ft}graph images if they are defined; these are only used if the web{hd,ft}sku columns are not empty. If the web{hd,ft}graph images are not defined they will use the product banner graphic (prodbanr, located in the product/language table). 9/11/99: Rearranged the product display area into two columns instead of three. 9/3/99: Added a check to orderform.php to only show the CC info if the order total is non zero. Changed orderproc.php for the same thing. 8/30/99: Added webflags1 to the Web table. If upgrading an existing cart, run sql_{mysql,solid}_1.48.sql through either 'mysql' or 'solsql' to add the column to the Web table. You must then update the /maint pages as well as display.php in the public cart pages. 8/29/99: Function library released, in the ~/fc_functions directory. display.php: commented out the query code to retrieve the quantity on order for each product displayed. Also customized the prompt to Add or Change based on whether or not $qty is non zero; this will handle things if the order status query is uncommented. 8/27/99: Added the FONTTAG / FONTCLOSE install time markers. These are substituted with the fonttag / fontclose parameters in db.cust. Added the fonttag / fontclose lines in db.cust. Changed credit card expiration month/year to pulldown menus. 8/23/99: Renamed public.inc to public.php to keep from exposing the limited access username and password. Added the zone flag to allow keeping credit card information in the database. DO NOT DO THIS UNLESS YOU UNDERSTAND VERY CLEARLY THE SECURITY IMPLICATIONS OF KEEPING CLEAR TEXT CC NUMBERS IN AN ONLINE DATABASE. orderproc.php no longer deletes completed orders from the ORDERHEAD and ORDERLINE tables by default. This should be done by a cron based job; see croncart.php for an example. Added the 'purchid' and 'complete' columns to ORDERHEAD. purchid ties the order record back to the customer record. Added the 'custcctype', 'custbsal', 'custbmname', 'custssal', 'custsmname', 'bzip4' and 'szip4' columns to CUSTTABLE. Run sql_{mysql,solid}_1.46.sql through either mysql or solsql to update existing tables if you plan to retrofit any future FishCart onto an existing installation. NOTE: If upgrading a previously installed cart, it is necessary to run the proper sql_*_1.46.sql file against your installed carts before installing these pages. NOTE: If updating an existing cart with a customized orderproc.php, this file should be manually updated with these new custtable columns or orders may not work. Be sure to either reinstall the 'cart' option to install.pl, or manually patch the file to update the column inserts and updates. 8/17/99: Added subcategories. 8/7/99: Removed ASP tags, converted to echo string format. Done to accomodate hosting services that don't understand ASP tags. Added default installation entries in the sql_{mysql,solid}.sql templates. New carts now install a working set of database templates. 7/13/99: Renamed all operational .html with PHP3 code to .php. 6/6/99: Added vflag1 to vendor table, zflag1 to zone table. Added basic flag maintenance to control CC collection. 6/4/99: Added $flag_notax flag to selectively not tax individual products. 5/31/99: Added contribute.html as a standalone contribution only page. 5/18/99: Changed require() and include() path to start with './'. 'install' now takes a -d database parameter to set up the admin.inc and public.inc files from admin_*.inc and public_*.inc. Also creates database.pl to capture the database name. 5/17/99: Changed shippercent in the SHIPTABLE to decimal instead of integer. Corrected the table names in sql_mysql.sql. 5/10/99: Added 'vendconfirm' to vendortable for order confirmation script. This will allow for more flexible multilanguage configuration. Added javascript in orderform.html and PHP code in orderform.php to check the state of the onoff radio button. 5/6/99: Added threshpercalc.php for combined threshold/percentage shipping. Changed