Miva Merchant Empresa/Mia/Script Compiler v5.18 Release Notes - Powered by Kayako https://support.miva.com/supportsuite/index.php? Help Desk Software

Knowledgebase

90Downloads 100Hosting FAQ 62Miva Empresa VM 304Miva Merchant FAQ 6Miva Merchant Marketplace 15Miva Merchant Scripting FAQ 38Miva Merchant Synchro FAQ 53Payment Gateways 206Release Notes 20Third Party Applications 58Tips and Tricks

Knowledgebase: Release Notes

Miva Merchant Empresa/Mia/Script Compiler v5.18 Release Notes Posted by Wayne Smith, Last modified by Wayne Smith on 24 March 2014 08:16 AM
Miva Merchant Empresa/Mia/Script Compiler v5.18 Release Notes ------------------------------------------------------------- Bugs Fixed ---------- 10177: Builtins: string: gettoken() fails to retrieve tokens after an ASCII NULL when NULLs are contained in the "string" parameter 10281: Builtins: system: miva_array_next/previous return incorrect values when asked for the next/previous element of a non-existent array element 10323: Builtins: system: miva_variable_value returns fatal error when variable name contains "[]" 10415: Builtins: system: miva_array_search does not provide any information when an invalid filter expression is provided 10065: Builtins: template: mvt:if with empty expr results in a stack underflow at runtime 10414: Compiler: Nested MvFOREACH that reuses an index from a previous version results in incorrect looping 10503: Compiler: Nested MvFOR that reuses an index from a previous version results in incorrect looping 10151: Diagnostic Application: Directories are not properly identified during the Script Directory Contents test if diag6.mvc is in a subdirectory 10327: Miva Mia: s.remote_host does not behave like other variables 9701: MivaSQL: MvOPEN errors cause the internal connection context to be leaked 9708: MivaSQL: Invalid read of size 1 when DATABASE is an empty string 9694: MySQL Connector: Frequent crashes at address 0x0001fbf3 in MVDMYSQL.DLL when connecting to a MySQL server 9700: MySQL Connector: MvOPEN errors cause the internal connection context to be leaked 10351: MySQL Connector: Connection string does not properly handle IPv6 addresses 10222: Profiling Tool: Segmentation fault when processing log with mismatched call/return 6414: Virtual Machine: MvSMTP reports server errors missing the first character 9704: Virtual Machine: External database API does not provide a mechanism to clean up mvDatabase data after MvOPEN or MvCLOSE errors 9729: Virtual Machine: Empresa should support IPv6 9993: Virtual Machine: dBase MvOPEN with empty DATABASE attribute reads past end of buffer by 1 byte 10005: Virtual Machine: Non-fatal MvDO_Errors sometimes cause a fatal "illegal instruction" error 10006: Virtual Machine: MvEXIT is not properly handled when an MvDOne file MvDOs into itself 10120: Virtual Machine: When accessing a URL with an IPV6 address, s.documenturl does not include square brackets. 10187: Virtual Machine: http opcodes do not properly validate PUT and POST method restriction when the FILES attribute is present 10271: Virtual Machine: MvDO (inline or tag) of a file/directory that exists but is not a valid compiled MivaScript file leads to a crash 10288: Virtual Machine: Special system variables are not properly protected against all array and reference operations 10325: Virtual Machine: Special system variables incorrectly report IsNULL and IsTrue 10326: Virtual Machine: MvEXPORT_Error is not cleared after a successful operation 10344: Virtual Machine: CGI VM: Cannot run any scripts using a ~user URL when absolute paths are allowed for the script directory New Features ------------ - IPv6 is now supported for all network operations. Within MySQL connection strings and URLs, IPv6 addresses must be enclosed in square brackets. Note: IPv6 addresses are not supported in MySQL connection strings on Windows. - The MvSMTP tag now supports transport encryption, alternate port numbers and authentication. The new functionality is accessed via new attributes to the MvSMTP tag. Below is an example of MvSMTP with all supported attributes: <MvSMTP FROM = "from@email.com" TO = "to@email.com" CC = "cc@email.com" SUBJECT = "Subject" FLAGS = "comma,separated,list" MAILHOST = "mail.host.com" PORT = "25" USERNAME = "username" PASSWORD = "password"> The FLAGS attribute contains a comma separated list of one or more of the following flags: tls Specifies that implicit TLS/SSL should be used for transport encryption starttls Specifies that the SMTP STARTTLS command should be used for transport encryption noheaders Prevents the default headers (Date, From, To, CC, X-Mailer and Subject) from being included in the message body. MvSMTP users that supply this flag must manually generate those headers. If PORT is not specified, 25 is used by default. Otherwise the connection is made on the specified port. If USERNAME and PASSWORD are specified, SMTP authentication will be used. MvSMTP supports the following authentication schemes. The scheme used will be the first scheme from this list which is supported by the mail server. DIGEST-MD5 CRAM-MD5 PLAIN LOGIN When the new attributes are used, if the -C flag is not specified with a version of 5.17 or older, the compiler will tag the resulting .mvc file as incompatible with engine versions older than 5.18. If -C 5.17 (or older) is specified, the compiler will output code that allows the MvSMTP block to be executed by older engines with the new attributes ignored. The engine version determination is made at runtime. Therefore, the new attributes will have effect when running on 5.18 or newer, and the MvSMTP tag will behave as if those attributes were not specified when running on 5.17 and older. - Debug logging of network traffic caused by MvSMTP is now possible by including MvCONFIG_LOG_MvSMTP (2097152) in the configured log level. - Debug logging may now be restricted by cookie. New configuration directive MvCONFIG_LOG_COOKIE (environment based configuration) or "logcookie" (3.x configuration) controls this setting. When a value is configured, only requests from browsers with a "mivalogcookie" cookie containing the specified value will be logged. - diag6.mvc has been expanded to include tools for setting and clearing the mivalogcookie cookie and decoding logged network traffic. The new tool is named diagtool.mvc. - POST content types other than application/x-www-form-urlencoded and multipart/form-data are now supported. This allows XML and other non-form based data to be POSTed directly to a MivaScript application. To prevent DOS attacks, the maximum length of unknown content types may be controlled by the MvCONFIG_MAX_UNKNOWN_CONTENT_LENGTH (environment based configuration) or "maxunknowncontentlength" (3.x configuration) directive, which limits the maximum number of bytes of content that may be submitted. The default value is 1MB. A value of 0 allows an unlimited amount of content (still subject to the POST timeout) and a value of -1 disables acceptance of unknown content altogether. The POST content is not parsed in any way and is made available to the script in system variable "s.content_data". - New tag <MvASSEMBLY> allows MivaScript assembly code to be interleaved with tradititional MivaScript. Example: <MvEVAL EXPR = "Before assembly"> <MvASSEMBLY> ... assembly code here ... </MvASSEMBLY> <MvEVAL EXPR = "After assembly"> The content of the MvASSEMBLY tag is passed unmodified to the MivaScript assembler. - New compiler options allow the default STANDARDOUTPUTLEVEL to be overridden for functions that do not have an explicit STANDARDOUTPUTLEVEL attribute: -f Enable whitespace compression by default for functions -F Disable text and html output by default for functions StoreMorph Changes ------------------ - All builtin functions registered in the underlying VM may now be called within expressions. - New tag mvt:assign allows variables to be created or modified directly within templates: <mvt:assign name="variable_name" value="value_expr" /> The name attribute is always a literal string containing a variable name. Normal MivaScript scoping rules apply. The value attribute is always an expression. To assign a static string value to a variable, single quotes must be included: <mvt:assign name="g.variable" value="'Hello, world!'" /> Local variables may be created outside of l.settings, but they will only be present within the scope of the current compiled template and will not propagate to sub or parent templates. - New tag mvt:while allows non-array loops to be constructed: <mvt:while expr="g.variable LT 100"> <mvt:assign name="g.variable" value="g.variable + 1" /> </mvt:while> - New tag mvt:miva allows templates to control whitespace compression and disable all non-explicit output: <mvt:miva output="on\|off" compresswhitespace="on\|off" /> If output is disabled, only StoreMorph tokens and explicit <mvt:eval> tags will generate output. - New tag mvt:eval allows expressions to be directly output: <mvt:eval expr="value_expr" /> The expr attribute behaves as the value attribute of mvt:assign, in that it is always an expression. New Builtin Functions --------------------- - crypto_hmac_md5( buffer var, key, format, result var ) Performs an HMAC-MD5 on "buffer" using key "key", storing the result in "result". "format" is one of "hex" or "binary". Returns 1 on success, 0 on error. This function is available even if OpenSSL is not configured. - miva_array_clear( array var, start, count ) Removes "count" elements from "array", starting at position "start". The elements are removed from the array, but the array is not collapsed. Returns the number of elements remaining in the array. - miva_array_delete( array var, start, count ) Removes "count" elements from "array", starting at position "start". The array is collapsed after the elements are removed. Returns the number of elements remaining in the array. - miva_array_merge( source var, sstart, scount, dest var, dpos ) - miva_array_merge_ref( source var, sstart, scount, dest var, dpos ) Copies "scount" elements from "source" into "dest", starting with "sstart" and inserting the elements at "dpos". Existing elements in "dest" past "dpos" are pushed forward by "scount" elements. miva_array_merge_ref inserts references to the source elements into the destination array. miva_array_merge copies the elements. If "dpos" is -1, the elements are appended to the end of "dest". Returns the number of elements in the "dest" array after the merge. - miva_array_copy( source var, sstart, scount, dest var, dpos ) - miva_array_copy_ref( source var, sstart, scount, dest var, dpos ) Copies "scount" elements from "source" into "dest", starting with "sstart" and placing the elements at "dpos". Existing elements in "dest" are overwritten. miva_array_copy_ref inserts references to the source elements into the destination array. miva_array_copy copies the elements. If "dpos" is -1, the elements are appended to the end of "dest". Returns the number of elements in the "dest" array after the copy. - miva_array_insert( array var, element, pos ) - miva_array_insert_var( array var, element var, pos ) - miva_array_insert_ref( array var, element var, pos ) Inserts single element "element" into "array" at position "pos". miva_array_insert_ref inserts a reference to "element" into "array". The other variations copy "element". If "pos" is -1, the element is inserted at the end of "array". Returns the number of elements in "array" after the insertion. - miva_array_pop( array var ) Removes and returns the last element of "array". - miva_array_pop_ref( array var, element var ) Makes "element" a reference to the last element of "array", then removes it from the array. Returns the number of elements remaining in "array". - miva_array_shift( array var ) Removes and returns the first element of "array". - miva_array_shift_ref( array var, element var ) Makes "element" a reference to the first element of "array", then removes it from the array. Returns the number of elements remaining in "array". - miva_array_find( needle, haystack var, offset ) Performs an exhaustive search for "needle" in array "haystack", starting at "offset". Comparison is equivalent to the EQ operator. Returns the index of "needle" in "haystack" or 0 if the element was not found. - miva_array_search( array var, offset, element var, filter_expr ) Performs an exhaustive search in array "array", starting at "offset". Comparison is made by evaluating "filter_expr" for each element. "filter_expr" is an expression similar to the EXPR attribute to MvFILTER. The expression is executed in the same state as the caller of miva_array_search. All local variables within that context are available, and function calls are permitted. Returns the index of the first element in "array" for which filter_expr evaluated as true, or 0 if no elements met this condition. - miva_array_binarysearch( key, array var, callback, data var ) Performs a binary search for "key" in "array". "array" must have been previously sorted. "callback" is the name of a callback function with the following parameters: CallbackFunc( key var, element var, data var ) The callback function should return the following: -1 key is less than element 0 key is equal to element 1 key is greater than element Parameter "data" to miva_array_binarysearch is passed unmodified to each execution of the callback function. Returns the index of "key" in "array" or 0 if no match was found. API Changes ----------- - MV_EL_DATABASE_VERSION has been incremented to 6 and new function db_cleanup has been added to the database library API. void ( db_cleanup )( mvDatabase db ) This function is called to allow a library to free any memory associated with a mvDatabase handle. This allows memory allocated in db_open to be freed when db_open returns non-success. - const MV_EL_Function mvProgram_Lookup_ExternalFunction( mvProgram program, const char function, int function_len ) Searches the list of registered builtin functions for "function" returning the associated MV_EL_Function record or NULL. - int mvProgram_FatalError( mvProgram program, const char error, int error_length ) Triggers a Fatal Error which will terminate script execution. - mvVariable mvVariable_Allocate_Copy( mvVariable variable ) Allocates and returns a new variable which is a copy of "variable". - mvVariable mvVariable_NextIdentity( mvVariable variable ) If "variable" is a reference, returns its immediate reference value. - mvVariable mvVariable_RealIdentity( mvVariable variable ) Follows a reference chain starting with "variable" and returns the final non-reference end of the chain. - void mvVariableHash_ReplaceVariable( mvVariableHash hash, mvVariable variable ) Inserts "variable" into "hash", replacing any existing variable with the same name. - void mvVariable_Make_Reference( mvVariable variable, mvVariable value ) Makes "variable" a reference to "value". - int mvProgram_Compare( mvProgram program, mvVariable left, mvVariable right ) Compares two variables using semantics equivalent to the EQ operator and returns one of the following: -1 left is less than right 0 left is equal to right 1 left is greater than right - void mvVariable_Array_Copy( mvVariable source, int spos, int scount, mvVariable dest, int dpos, int copy ) Copies "scount" elements from "source" into "dest", starting with "sstart" and placing the elements at "dpos". Existing elements in "dest" are overwritten. If "dpos" is -1, the elements are appended to the end of "dest". If "copy" is true, copies of the source elements are placed into "dest". Otherwise, references are made to the original elements. - void mvVariable_Array_Merge( mvVariable source, int spos, int scount, mvVariable dest, int dpos, int copy ) Copies "scount" elements from "source" into "dest", starting with "sstart" and inserting the elements at "dpos". Existing elements in "dest" past "dpos" are pushed forward by "scount" elements. If "dpos" is -1, the elements are appended to the end of "dest". If "copy" is true, copies of the source elements are placed into "dest". Otherwise, references are made to the original elements. - void mvVariable_Delete_Array_Elements( int start, int count, int collapse, mvVariable agg ) Removes "count" elements from "array", starting at position "start". If "collapse" is true, the array is collapsed after the elements are removed. - void mvVariable_Insert_Array_Element( int index, mvVariable value, mvVariable agg ) Inserts "value" into array "agg" at position "index". Existing elements at "index" and beyond are moved forward one position. - mvDynamicExpression mvProgram_Compile_Dynamic_Expression( mvProgram program, const char expr, int expr_length, char error, int error_length ) Compiles expression "expr", returning a handle that may be passed to one of the execution functions below. If a compilation error occurs and non-NULL values are passed for "error" and "error_length", a textual description of the compilation error is provided. Dynamic expression handles are tied to the mvProgram in which they were compiled and may not be executed with any other mvProgram. Returns a dynamic expression handle or NULL on error. - int mvProgram_Execute_Dynamic_Expression_Boolean( mvProgram program, mvDynamicExpression expr, mvVariableHash localvar_hash, int result ) Executes dynamic expression "expr", storing a boolean result in "result". If "localvar_hash" is NULL, the expression is executed with access to the local variables of the calling context. Otherwise, "localvar_hash" is a VariableHash containing the local variables that will be made available to the expression. Returns 1 on success or 0 on error. Most error returns will result in the VM terminating execution when control is returned to the VM. - int mvProgram_Execute_Dynamic_Expression( mvProgram program, mvDynamicExpression expr, mvVariableHash localvar_hash, mvVariable result ) Executes dynamic expression "expr", storing the result in "result". If "localvar_hash" is NULL, the expression is executed with access to the local variables of the calling context. Otherwise, "localvar_hash" is a VariableHash containing the local variables that will be made available to the expression. Returns 1 on success or 0 on error. Most error returns will result in the VM terminating execution when control is returned to the VM. Miva Merchant Empresa/Mia/Script Compiler v5.17 Release Notes ------------------------------------------------------------- Bugs Fixed ---------- 8677: Builtins: crypto: crypto_rand_bytes( -1 ) causes a crash 8694: Builtins: crypto: When OpenSSL is not available, calling the same crypto function twice causes a segmentation fault 8732: Builtins: crypto: Functions that depend on RSA_up_ref double free RSA pointers on OpenSSL pre 0.9.7 6820: Builtins: math: acos() is internally mapped to cos() and returns incorrect values 6426: Compiler: Unscoped variables with -p all causes incorrect code generation and does not generate warnings in MvCAPTURE, MvREFERENCE, MvFOR and MvFOREACH 6935: Compiler: Compiler generates invalid assembly code for MvREFERENCEARRAY without NAME or VARIABLE attribute 7795: Compiler: MvFOREACH should give unique names to its anonymous variables 8592: Compiler: Global MvFOR/MvFOREACH in an MvDO target loops until timeout 8673: Compiler: Compiler crashes if you attempt to compile a directory 9212: Compiler: Compiler generates invalid assembly code for -.88 9285: Compiler: Grammatical error: Too many open parenthesis should be Too many open parentheses 8707: Configuration: 3.x: Using two equals (==) in mivavm.conf generates an unhelpful error message at runtime 9071: MivaSQL: "Not enough values" error when an INSERT with sub-select does not insert all columns 9291: MySQL Connector: Queries that execute for longer than 15 seconds result in "Lost connection to MySQL server during query" errors 4623: Virtual Machine: Expressions in MvDO parsed differently than other expressions 6406: Virtual Machine: Configuration variables cannot be passed as non-reference parameters or assigned to other variables 6797: Virtual Machine: MivaApplication::EncodeAttribute does not encode low-ASCII non-printable characters 8121: Virtual Machine: s.miva_config does not contain a log_filter variable 9041: Virtual Machine: CGI mivavm should explicitly validate that configured paths are absolute rather than relative 9186: Virtual Machine: dup instruction causes segfault when SP = 0 9213: Virtual Machine: Negative constants as parameters to a function call in a dynamic expression generate errors when any previous parameter has operators 9355: Virtual Machine: VariableHash::Scope does not properly handle short or empty variable names 9453: Virtual Machine: Buffer overflow in MivaApplication::MakeSessionID when OpenSSL is not available 9313: Virtual Machine Installation: vm-README.txt contains incorrect instructions for suexec/env.so configuration Platform Support Changes ------------------------ - FreeBSD 6.2 is no longer supported. Starting with this release, FreeBSD binaries are built on FreeBSD 8.3, and support FreeBSD 7.4-9.0. The compat6x package is no longer required on any of these platforms. - amd64 builds for FreeBSD 7.4-9.0 are now provided. API Changes ----------- - New API function mvProgram_Sleep( mvProgram program, int msecs ) delays the running application for msecs milliseconds or until the global timeout expires, whichever is shorter. New Builtin Functions --------------------- - miva_sleep( msecs ) Delays the running application for msecs milliseconds or until the global timeout expires, whichever is shorter. - miva_hex_encode( data ) - miva_hex_decode( data ) Convert "data" to or from hexidecimal notation, returning the resulting encoded or decoded data. - crypto_cipher_block_size( ciphername ) - crypto_cipher_key_length( ciphername ) - crypto_cipher_iv_length( ciphername ) These functions allow you to programatically determine the attributes of the cipher specified by "ciphername". "ciphername" is an OpenSSL cipher identifier, such as "aes-128-cbc" or "rc2-ofb". All of the preceding functions return the numeric size, in bytes, or -1 if an invalid "ciphername" is specified. - crypto_cipher_mode( ciphername ) Returns the block mode of operation of the cipher specified by "ciphername." The output is one of the following strings: stream Stream ciphers, such as RC4 ecb Electronic Code Book cbc Cipher Block Chaining cfb Cipher Feedback ofb Output Feedback unknown An invalid ciphername was specified - crypto_evp_encrypt( ciphername, key, iv, plaintext, encrypted var ) Encrypts "plaintext" using the block cipher specified by "ciphername", placing the encrypted data into "encrypted". Parameters: ciphername The OpenSSL identifier of the cipher, such as "bf-cbc" or "des-ede3-cbc". key The encryption key. Must be exactly the number of bytes required by the cipher, as returned by crypto_cipher_key_length. iv An initialization vector, if required by the cipher. Must be exactly the number of bytes required by the cipher, as returned by crypto_cipher_iv_length. plaintext The text to be encrypted encrypted [output] Receives the cipher text Return value: 1 on success, 0 on failure - crypto_evp_decrypt( ciphername, key, iv, encrypted, plaintext var ) Decrypts "plaintext" using the block cipher specified by "ciphername", placing the decrypted data into "plaintext". Parameters: ciphername The OpenSSL identifier of the cipher, such as "bf-cbc" or "des-ede3-cbc". key The key used for encryption. iv The initialization vector used for encryption. returned by crypto_cipher_iv_length. encrypted The ciphertext to be decrypted plaintext [output] Receives the plaintext Return value: 1 on success, 0 on failure - crypto_digest_block_size( digestname ) - crypto_digest_size( digestname ) These functions allow you to programatically determine the attributes of the digest algorithm specified by "digestname". "digestname" is an OpenSSL digest identifier, such as "sha256" or "md5". Each of the preceding functions return the numeric size, in bytes, or -1 if an invalid "digestname" is specified. - crypto_evp_digest( digestname, buffer var, digest var ) Calculates the digest of "buffer" using digest algorithm "digestname", placing the calculated digest in "digest". The digest output is always in raw binary format, use miva_hex_encode() or crypto_base64_encode() if other output formats are desired. Returns 1 on success or 0 if an invalid or unsupported "digestname" is specified. - crypto_evp_hmac( digestname, key, buffer var, digest var ) Calculates the HMAC of "buffer" using digest algorithm "digestname" and key "key", placing the HMAC in "digest". The HMAC output is always in raw binary format, use miva_hex_encode() or crypto_base64_encode() if other output formats are desired. Returns 1 on success or 0 if an invalid or unsupported "digestname" is specified. - crypto_xor( buffer var, dest var ) Efficiently performs a byte-by-byte XOR of buffer and dest, storing the resulting data in "dest". If "buffer" is longer than "dest", any extra bytes are ignored. - crypto_pbkdf1( digestname, password, salt, iterations, dklen, dk var ) Derives a key of "dklen" bytes using PBKDF1 from PKCS #5. Parameters: digestname The digest algorithm to use. Must be one of "md2", "md5" or "sha1". password The password from which a key is to be derived. salt Exactly 8 bytes of random data that are used as a salt. iterations The number of iterations to perform. dklen The desired output length of the derived key. May not be longer than the output digest size of the specified digest algorithm. dk [output] Receives the derived key. The output is in raw binary. Returns 1 on success or 0 on error. - crypto_pbkdf2( digestname, password, salt, iterations, dklen, dk var ) Derives a key of "dklen" bytes using PBKDF2 from PKCS #5. Parameters: digestname The digest algorithm to use. May be any of the digests supported by the installed OpenSSL version. password The password from which a key is to be derived. salt Random data of any length that is used to salt the derivation. RFC 2898 recommends a minimum salt length of 8 bytes. iterations The number of iterations to perform. RFC 2898 recommends at least 1000 iterations. dklen The desired output length of the derived key. May be any positive value. dk [output] Receives the derived key. The output is in raw binary. Returns 1 on success or 0 on error. - rsa_generate_keypair_mem_cipher( pubkey var, privkey var, bits, e, passphrase, ciphername ) - rsa_save_privatekey_mem_cipher( privkey var, rsa var, passphrase, ciphername ) These functions behave identically to their legacy counterparts rsa_generate_keypair_mem and rsa_save_privatekey_mem_cipher, except that they allow the caller to specify the cipher used to encrypt the private key (the legacy functions always use des-ede3-cbc). "ciphername" is an OpenSSL cipher identifier that specifies the cipher to be used. Note that OpenSSL only permits a subset of its supported ciphers to be used for RSA key encryption. For example, only CBC mode ciphers are permitted. New Features ------------ - On UNIX, the 3.x compatible configuration library now reports verbose syntax errors with line numbers when a parsing error occurs in either the configuration or authorization files. - Debug logging filter values may now be preceded by "!" to indicate a logging exclusion. If only exclusion filters are present, then all lines not matching the exclusion are logged. For example, "!example.mv:100-200" would log all lines except those between line number 100 and 200 of example.mv. If used in combination with one or more traditional include filters, then exclusions only apply where they overlap with one of the inclusions. - Increment (++) and decrement (--) operators are now supported inside MivaScript expressions. Both pre and post increment/decrement are allowed. Example: <MvEVAL EXPR = "{ l.var++ }"> <MvASSIGN NAME = "l.array" INDEX = "{ ++l.pos }" VALUE = "{ l.var }"> Note: When used within a dynamic expression (MvDO EXPR, MvFILTER EXPRESSION, etc..), the generated MivaScript file will be incompatible with Empresa versions prior to 5.17. When compilation includes a compatibility flag, for example "-C 5.16", a compiler warning will be generated when an increment or decrement operator is detected inside a dynamic expression. Miva Merchant Empresa/Mia/Script Compiler v5.16 Release Notes ------------------------------------------------------------- Bugs Fixed ---------- 6950: DigiNotar certificate was compromised and should be removed from the certs/ directory 6958: BLOB data over 4096 bytes is truncated when a subsequent query forces mysql_stmt_store_results 6981: diag6 does not include licensemgr.thelicensemanager.com in its license tests 6987: Reference variables created by poprg do not propagate to parent global variable hashes 6990: MivaSQL: Duplicate records in output result set when a range query uses an index 7047: Non-numeric trailing characters are no longer ignored by the int() function 7072: Compiler does not detect/throw an error for duplicate simple text attributes in a tag 7197: mvc: EINTR returns from wait() are not properly handled New Features ------------ - A new compiler tool "mvcov" provides code coverage measurement by analyzing an engine debug log containing trace data. The output format is similar to the GNU tool gcov. Full usage instructions may be obtained by running "mvcov --help". - A new compiler tool "mvprof" measures and graphs the amount of time spent in various functions by analyzing an engine debug log containing function call and return data. The output format is similar to the GNU tool gprof. Full usage instructions may be obtained by running "mvprof --help". Certificate Updates ------------------- - The following certificate has been removed: C060ED44CBD881BD0EF86C0BA287DDCF8167478C.pem DigiNotar Root CA Miva Merchant Empresa/Mia/Script Compiler v5.15 Release Notes ------------------------------------------------------------- Bugs Fixed ---------- 6857: mysql: mysql_stmt_store_results errors when opening and closing multiple views simultaneously Miva Merchant Empresa/Mia/Script Compiler v5.14 Release Notes ------------------------------------------------------------- Bugs Fixed ---------- 6411: 5.07 and newer assemblers generate MvLOCALIZED code that crashes 5.06 or older engines 6441: sha256 with openssl < 0.9.8 6449: Win32: file_read and [fs]time() create non-existent files 6454: 3.x Configuration causes segmentation fault when one or more required tag attributes are missing 6455: Floating point to string conversions occasionally include a NULL byte in the string 6456: MvSMTP: Write Error: Connection closed by remote host (windows server only) 6469: ISAPIApplication has no s.process_id 6482: ISNULL of a reference to a structure is always 1 6498: Free of uninitialized memory in Dictionary::Read when TaggedFile has no TF_DICT_ID section 6505: MvFOR without /MvFOR not caught by compiler 6519: Embedded bracket } causes compiler error [g.file].fn('}') 6546: Passing a database variable to a function by reference leads to a crash 6576: MvCALL does not verify server identity 6679: xml_parse when an xml_parse_section is present returns the section's content in root 6712: External function calls in MvDO expressions behave strangely when they reference functions that are not used in the MvDO'd file 6734: Hash-table collision based DOS with POSTed form data 6762: miva_array_deserialize outputs an array with a single empty element when passed an empty string 6799: Strings that contain ASCII NULL but begin with numbers are considered numbers MySQL Connector Changes ----------------------- - Only a single connection to the database server is used per VM instance, regardless of whether a script opens multiple views simultaneously or executes an MvQUERY when a view is open. - The connector now supports caching of prepared statements for better performance. The cache is disabled by default and may be enabled using the "statement_cache_size" db command. Example: <MvDBCOMMAND NAME = "Merchant" COMMAND = "statement_cache_size" PARAMETER = "5"> The value of PARAMETER controls the number of prepared statements that are cached. The N most recently used prepared statements are retained. - A new DBCOMMAND "autostorelimitqueries" causes the connector to automatically call mysql_stmt_store_results() whenever it sees the LIMIT keyword in an SQL statement used to open a view. Other Changes ------------- - Additional bits in MvCONFIG_FLAGS_SECURITY (securityoptions in the 3.x configuration) allow an administrator to control SSL certificate validation. MvCONFIG_SEC_SSL_NOVERIFY_CHAIN 0x00001000 4096 Disables chain of trust verification MvCONFIG_SEC_SSL_NOVERIFY_HOSTNAME 0x00002000 8192 Disables certificate commonName/subjectAltName checking when a connection is made using a hostname MvCONFIG_SEC_SSL_VERIFY_IP 0x00004000 16384 Enables IP Address based subjectAltName checking when a connection is made using an IP address - A new configuration setting MvCONFIG_TIMEOUT_POST (posttimeout in the 3.x configuration) allows an administrator to configure the maximum number of seconds that are permitted to receive and parse POST input from a client. The default value is 30 seconds, and this timeout does not apply to file uploads that have been accepted by a script. - A new configuration setting MvCONFIG_MAX_POST_VARS (maxpostvars in the 3.x configuration) controls the maximum number of variables that may be present in a single POST request. The default value is 2000. - On Windows systems a new Options dialog is present to control the new configuration settings. The Use Cookies setting has also been moved to this dialog. Certificate Updates ------------------- - The following new certificates have been added: 7C4656C3061F7F4C0D67B319A855F60EBC11FC44.pem Go Daddy Secure Certification Authority 188590E94878478E33B6194E59FBBB28FF0888D5.pem VeriSign Class 3 Secure Server CA D559A586669B08F46A30A133F8A9ED3D038E2EA8.pem VeriSign International Server CA - Class 3 Miva Merchant Empresa/Mia/Script Compiler v5.13 Release Notes ------------------------------------------------------------- Bugs Fixed ---------- 5880: All ExternalDatabaseVariables ISNULL until they have been read 5926: 64-bit engine libraries are dynamically linked against system libraries 5987: miva_array_sort() Crashes Mia 5988: miva_array_sort() does not properly handle timeouts in the callback 6002: Logging mechanism should have a way to log application timed out errors 6003: Only the first open view for a database is closed on VM exit 6042: "Application timed outApplication timed out" when a file upload takes longer than globaltimeout seconds 6102: MySQL connector does not close connections when an MvOPENVIEW encounters an error 6135: diag6.mvc does not read the libgd system library configuration from them mivavm.conf 6136: When a SYSTEMLIB is configured it does not make an entry in s.miva_config like COMMERCE and DATABASE libraries do 6170: MvFOR: Cannot use a FIRST of "0" 6197: MivaSQL: LIKE operator does not properly handle wildcard comparisons at the end of a string 6199: Win32: MvLOCKFILE fails with "Access Denied" or "The handle is invalid." 6200: Win32: MvLOCKFILE fails to use MvCONFIG_DELAY_FILE and consumes 100% of the CPU when waiting for a lock 6201: 1-byte buffer overrun in MivaApplication::DecodeEntities 6202: Buffer overrun of static buffer when processing MvCONFIG_CAPTURE_FILE 6203: Buffer overrun of static buffer when replaying a capture file 6227: MivaSQL: UPDATE or DELETE statements with OR expressions fail to delete/update all matching records 6232: MvFOREACH, miva_array_max(), miva_array_min(), miva_array_elements(), miva_array_next() and miva_array_previous() crash when used on s.miva_config:(database\|commerce\|systemlib)_list 6353: MvCALL makes multiple writes for the HTTP request, adding overhead and multiplying the effective timeout 6354: MvCALL: GET with parameters and ACTION in the form "http://hostname:port" does not work New Functions ------------- - srandom( seed ) - Allows a script to reseed the random number generator used by random() Other Changes ------------- - Registered system libraries are now available through s.miva_config:systemlib_list and s.miva_config:systemlib_lookup - diag6.mvc now displays a list of registered system libraries - The request capture/replay mechanism (MvCONFIG_CAPTURE_FILE, MvCONFIG_CAPTURE_TRIGGER_FILE, etc...) has been removed - The build process for the Linux x64 distribution has been altered to ensure compatibility with more x64 Linux distributions - Application Timed Out errors may now be logged using the debug logging mechanism, by including MvCONFIG_LOG_APPLICATION_TIMEOUT (134217728) in the configured log level. - MvCALL now supports a CERTPASS attribute, which allows PEM-format certificates and/or private keys to be stored encrypted on disk. If specified, the value of CERTPASS is used to decrypt the certificate and/or private key in the file specified by CERTFILE. - Debug logging output may now be filtered by setting MvCONFIG_LOG_FILTER for the environment based configuration or logfilter=<filter> for the 3.x configuration. The filter is in the format sourcefile[:[start_line][-[end_line]],... If a filter is provided, only messages from the specified files and line number ranges will be logged. - Restrictions on the length of string data and number of array elements have been removed from debug logging output - MvCALL input and output may now be logged using the debug logging mechanism by including MvCONFIG_LOG_MvCALL (1048576) in the configured log level. All data sent and received during an MvCALL is logged in base64 format to preserve the delimited nature of the log file. When filtering MvCALL logging, only the line containing the start MvCALL tag is considered. Certificate Updates ------------------- - All distribution certificate files now include a textual description - The following new certificates have been added: B8236B002F1D16865301556C11A437CAEBFFC3BB.pem AffirmTrust Premium ECC 925A8F8D2C6D04E0665F596AFF22D863E8256F3F.pem Starfield Services Root Certificate Authority - G2 D018B62DC518907247DF50925BB09ACF4A5CB3AD.pem UTN-USERFirst-Hardware: login.yahoo.com 80962AE4D6C5B442894E95A13E4A699E07D694CF.pem UTN-USERFirst-Hardware: login.yahoo.com B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E.pem Starfield Root Certificate Authority - G2 47BEABC922EAE80E78783462A79F45C254FDE68B.pem Go Daddy Root Certificate Authority - G2 CEA586B2CE593EC7D939898337C57814708AB2BE.pem UTN-USERFirst-Hardware: login.live.com 293621028B20ED02F566C532D1D6ED909F45002F.pem AffirmTrust Networking F9B5B632455F9CBEEC575F80DCE96E2CC7B278B7.pem AffirmTrust Commercial 6431723036FD26DEA502792FA595922493030F97.pem UTN-USERFirst-Hardware: mail.google.com C039A3269EE4B8E82D00C53FA797B5A19E836F47.pem GeoTrust Global CA: RapidSSL CA 471C949A8143DB5AD5CDF1C972864A2504FA23C9.pem UTN-USERFirst-Hardware: login.skype.com 63FEAE960BAA91E343CE2BD8B71798C76BDB77D0.pem UTN-USERFIRST-Hardware: login.yahoo.com 63FEAE960BAA91E343CE2BD8B71798C76BDB77D0.pem UTN-USERFirst-Hardware: addons.mozilla.org 07E032E020B72C3F192F0628A2593A19A70F069E.pem Certum Trusted Network CA 1916A2AF346D399F50313C393200F14140456616.pem UTN-USERFirst-Hardware: www.google.com D8A6332CE0036FB185F6634F7D6A066526322827.pem AffirmTrust Premium 61793FCBFA4F9008309BBA5FF12D2CB29CD4151A.pem UTN-USERFirst-Hardware: global trustee - The following expired certificates have been removed: 67EB337B684CEB0EC2B0760AB488278CDD9597DD.pem DST RootCA X2 F88015D3F98479E1DA553D24FD42BA3F43886AEF.pem C&W HKT SecureNet CA SGC Root 720FC15DDC27D456D098FABF3CDD78D31EF5A8DA.pem TC TrustCenter Class 1 CA 687EC17E0602E3CD3F7DFBD7E28D57A0199A3F44.pem SecureNet CA SGC Root 5BCDCDCC66F6DCE4441FE37D5CC3134C46F47038.pem beTRUSTed Root CA B72FFF92D2CE43DE0A8D4C548C503726A81E2B93.pem DST RootCA X1 24BA6D6C8A5B5837A48DB5FAE919EA675C94D217.pem IPS SERVIDORES 6423137E5C53D64AA66485ED3654F5AB055A8B8A.pem Equifax Secure Global eBusiness CA-1 4463C531D7CCC1006794612BB656D3BF8257846F.pem RSA Secure Server Certification Authority 9BACF3B664EAC5A17BED08437C72E4ACDA12F7E7.pem C&W HKT SecureNet CA Class A 90DEDE9E4C4E9F6FD88617579DD391BC65A68964.pem GTE CyberTrust Root 47AFB915CDA26D82467B97FA42914468726138DD.pem C&W HKT SecureNet CA Class B A60F34C8626C81F68BF77DA9F667588A903F7D36.pem VeriSign Time Stamping Authority CA 7CA04FD8064C1CAA32A37AA94375038E8DF8DDC0.pem SecureNet CA Root E0925E18C7765E22DABD9427529DA6AF4E066428.pem Hongkong Post Root CA 7AC5FFF8DCBC5583176877073BF751735E9BD358.pem SecureNet CA Class B A399F76F0CBF4C9DA55E4AC24E8960984B2905B6.pem TC TrustCenter Time Stamping CA 9FC796E8F8524F863AE1496D381242105F1B78F5.pem TC TrustCenter Class 3 CA 8B1A1106B8E26B232980FD652E6181376441FD11.pem Certificado Empresarial Clase-A 4EF2E6670AC9B5091FE06BE0E5483EAAD6BA32D9.pem Belgacom E-Trust Primary CA D29F6C98BEFC6D986521543EE8BE56CEBC288CF3.pem TC TrustCenter Class 4 CA BC7B3C6FEF26B9F7AB10D7A1F6B67C5ED2A12D3D.pem Post.Trust Root CA 5E997CA5945AAB75FFD14804A974BF2AE1DFE7E1.pem SecureNet CA Class A 7A74410FB0CD5C972A364B71BF031D88A6510E9E.pem ABA.ECOM Root CA 4BA7B9DDD68788E12FF852E1A024204BF286A8F6.pem C&W HKT SecureNet CA Root 838E30F77FDD14AA385ED145009C0E2236494FAA.pem TC TrustCenter Class 2 CA Miva Merchant Empresa/Mia/Script Compiler v5.12 Release Notes ------------------------------------------------------------- Bugs Fixed ---------- 5916: rsa_load_privatekey() and rsa_load_privatekey_mem() do not properly handle passphrases with embedded ASCII NULs Miva Merchant Empresa/Mia/Script Compiler v5.11 Release Notes ------------------------------------------------------------- Bugs Fixed ---------- 5891: certs directory is not compatible with OpenSSL 1.0 5901: rsa_sign(), rsa_verify(), bf_encrypt() and bf_decrypt() statically allocate OpenSSL opaque structures 5902: libgd_initialize_context() errors are not properly reported Other Changes ------------- - This release introduces support for x86_64 RedHat Enterprise and CentOS 5.x systems - The packaged "certs" directory now contains two separate sets of certificates. One hashed for compatibility with OpenSSL 0.9.x, and another for OpenSSL 1.0. - On Windows systems, the installer sets the default "certs" path to point to the OpenSSL 1.0 compatible directory. We strongly recommend that all Windows users upgrade to OpenSSL 1.0 Miva Merchant Empresa/Mia/Script Compiler v5.10 Release Notes ------------------------------------------------------------- Bugs Fixed ---------- 5804: http_host incorrect if domain is setup to use custom port number 5810: MivaSQL: Sub-queries in LEFT OUTER JOINS are not executed if part of the join can be indexed 5811: Functions called via MvDO do not immediately have a valid sourcefile directive 5812: Function calls inside a tag's expression do not reset lineno on return 5817: Parameter type mismatches in MvDO expressions are not properly handled 5818: MvDO function calls are logged with incorrect sourcefile and lineno 5822: Crash in MultipartFormParser 5826: Buffer overrun of static buffer in bi_tokenize() 5857: MvCALLSTOP outputs an additional (unreachable) dbclose instruction 5858: MvMEMBER or MvDIMENSION outside MvASSIGNARRAY or MvREFERENCEARRAY causes a crash 5860: MultipartFormParser requires the initial boundary to be complete in the first buffer 5862: MultipartFormParser cannot handle any but the most basic Content-Type HTTP header 5865: MultipartFormParser calls ValidateFileUpload repeatedly after the file has been rejected 5866: MultipartFormParser will not correctly upload a zero length file. 5872: s.stm_zone always reports daylight savings timezone on Linux 5874: Variable::Convert_Integer() converts floating point string values to integer 0 5875: Miva_ProcessFileUpload() is expected to return exactly -1 to skip a file, which differs from 3.x 5876: If Miva_ValidateFileUpload() does not exist, multipart/form-data parsing aborts whenever a file is present 5877: If Miva_ProcessFileUpload() returns a value, it stays on the internal stack forever New Builtin Functions --------------------- substring_var( string var, position, length ) This function is identical to substring() but its first parameter is passed by reference, improving performance when dealing with large strings. len_var( string var ) This function is identical to len() but its parameter is passed by reference, improving performance when dealing with large strings. indexof( needle, haystack var, offset ) indexofi( needle, haystack var, offset ) These functions search for needle in haystack, starting at "offset". If found, the functions return the starting offset of needle in haystack. If not found, the functions return 0. indexof() performs a case-sensitive search, and indexofi() performs a case-insensitive search. The offset parameter and returned string offset are 1-based. file_read_bytes( path, location, offset, length, data ) This function reads a portion of the file specified by "path" and "location" into "data". path The name or filepath of the file to open relative to the directory specified by "location" location One of "script" or "data" offset The zero-based offset at which to begin reading length The number of bytes to read. If < 0, the entire file after "offset" is read. data The variable in which to store the file data The function returns the number of bytes read, which may be less than "length" if an attempt was made to read past the end of the file, or -1 on error. Other Changes ------------- - Minor performance improvement for the sourcefile instruction - Corrected line numbers when a tag spans multiple lines (subversion 25013) - Mia now properly handles empty string registry values in its configuration - The packaged set of certificates has been updated New Features ------------ - A new debug logging facility has been added, which logs various information about script execution. In Miva Empresa for IIS and Miva Mia, this facility is configured through a new "Debug Log" button in the GUI configuration. On UNIX systems using the environment based configuration, the facility is configured using two environment variables: MvCONFIG_LOG_FILE specifies the name of the logfile MvCONFIG_LOG_LEVEL a bitfield which controls which operations are logged On UNIX systems using the 3.x configuration, the facility is configured using the following configuration settings: logfile=<logfile name> loglevel=<numeric log level> For security purposes, on UNIX the configured logfile is relative to the MivaScript data directory, and the logfile is opened after dropping root privileges if the binary is setuid root. The log level is constructed by adding the values of the desired output items from this list: MvCONFIG_LOG_FUNC_CALL 16 Calls to native (MivaScript) functions MvCONFIG_LOG_FUNC_PARAM 32 Parameters to native (MivaScript) functions MvCONFIG_LOG_FUNC_RETVAL 64 Return values from native (MivaScript) functions MvCONFIG_LOG_FUNC_RETURN 128 Return from native (MivaScript) functions MvCONFIG_LOG_EXTERNAL_FUNC_CALL 256 Calls to builtin or other external functions MvCONFIG_LOG_EXTERNAL_FUNC_PARAM 512 Parameters to builtin or other external functions MvCONFIG_LOG_EXTERNAL_FUNC_RETVAL 1024 Return values from builtin or other external functions MvCONFIG_LOG_EXTERNAL_FUNC_RETURN 2048 Return from builtin or other external functions MvCONFIG_LOG_MvDO_FILE_ENTER 4096 MvDO of an entire file has begun MvCONFIG_LOG_MvDO_FILE_EXIT 8192 MvDO of an entire file has ended MvCONFIG_LOG_RUNTIME_ERROR 268435456 All runtime errors MvCONFIG_LOG_FATAL_ERROR 536870912 All fatal errors MvCONFIG_LOG_TRACE 1073741824 Logs each line of source code executed - New tags MvIMPORTCONTINUE, MvPOPCONTINUE, MvWHILECONTINUE, MvCALLCONTINUE and MvCOMMERCECONTINUE return program flow to the top of their associated loop, doing whatever operations would normally occur at the bottom of the loop (moving to the next record in MvIMPORT, the next email in MvPOP, etc...) - A new looping construct, MvFOREACH, has been added to make dealing with arrays of items more convenient. <MvFOREACH ITERATOR = "l.item" ARRAY = "l.array" INDEX = "l.pos"> </MvFOREACH> <MvFOREACH ITERATOR = "l.item" ARRAY = "l.array" INDEX = "l.pos" FIRST = "{ 1 }" NEXT = "{ l.pos + 1 }" LAST = "{ 100 }"> </MvFOREACH> <MvFOREACH ITERATOR = "l.item" ARRAY = "l.array" INDEX = "l.pos" COUNT = "{ 100 }"> </MvFOREACH> Only the ITERATOR and ARRAY elements are required. When COUNT is specified, FIRST, NEXT, and LAST may not be, but when COUNT is not present, FIRST, NEXT, and LAST may be used in any combination with each other. ITERATOR is the name of a variable which will point to a specific element in the array. The mechanism used is the same as MvREFERENCE or MvREFERENCEARRAY. ARRAY is the array over which to iterate. INDEX describes the name of a variable that is used to track the iterations through the loop. It is optional, and if nothing is specified an internal anonymous variable is used. When specified, the variable can be used inside the expressions for the NEXT and LAST attributes, and is present inside the MvFOREACH loop. FIRST if specified, defines the index of the first element to iterate over. If not specified, the loop starts at the first element present in the array (more on this later). NEXT if specified, is called at the end of the loop to increment the INDEX variable. If not specified, the loop transitions to the next element present in the array (more on this later). LAST if specified, defines the upper bound of the loop. If not specified, the loop terminates after the last element in the array. COUNT is shorthand for dealing with known-dense arrays. It sets the loop up to iterate from 1 to COUNT, incrementing by 1 each time. It has some performance advantages when proper handling of sparse arrays is not a concern. To efficiently traverse sparse arrays, MvFOREACH outputs code that calls the miva_array_min() and miva_array_max() functions. When combined with the -C (compatibility) compiler flag, MvFOREACH generates code that will run on any engine version 5.00 or newer, using runtime engine version checks to either call these functions or emulate their behavior. Tags MvFOREACHCONTINUE and MvFOREACHSTOP exist and behave as other similarly named tags. - A new looping construct, MvFOR, has been added. <MvFOR INDEX = "l.pos" FIRST = "{ 1 }" NEXT = "{ l.pos + 1 }" LAST = "{ 100 }"> </MvFOR> <MvFOR INDEX = "l.pos" COUNT = "{ 100 }"> </MvFOR> <MvFOR INDEX = "l.pos" FIRST = "{ 1 }" EXPR = "{ l.pos LT 100 }" NEXT = "{ l.pos + 1 }"> </MvFOR> Exactly one of COUNT, LAST, or EXPR must be specified. All other attributes are optional. INDEX describes the name of a variable that is used to track the iterations through the loop. It is optional, and if nothing is specified an internal anonymous variable is used. When specified, the variable can be used inside the expressions for the EXPR, NEXT and LAST attributes, and is present inside the MvFOR loop. FIRST defines the low-end range of the loop. This expression is executed only once, at the beginning of the MvFOR block. NEXT if specified, is called at the end of each iteration to increment the INDEX variable. If you don't specify NEXT, the index variable is incremented by one for each pass through the loop. LAST defines the high-end of the loop (inclusive). This expression is executed at the beginning of the loop and also at every iteration through the loop, allowing you to perform interesting operations, such as calling a function. If you use a simple expression here with a static value or simple variable, there is no performance overhead by evaluating the expression after every iteration. COUNT is a shorthand for an extremely simple loop which iterates from 1 to the value of the COUNT expression, incrementing by 1 after each iteration. Unlike LAST, the expression in COUNT is executed only once, at the beginning of the loop. EXPR is a boolean expression that is evaluated each iteration through the loop. If it resolves to a true value, the loop continues. Otherwise, the loop terminates. Tags MvFORCONTINUE and MvFORSTOP exist and behave as other similarly named tags. Miva Merchant Empresa/Mia/Script Compiler v5.09 Release Notes ------------------------------------------------------------- Bugs Fixed ---------- 5659: POP3 handling of STAT response incorrectly allocates POP3Message array 5663: Mia: Logging into MM5 results in empty or error page (all POST forms broken) 5684: <MvASSIGN> with no VALUE attribute reports "MvASSIGN requires the NAME attribute" 5690: MvPACK on dBase table without memo fields uses uninitialized variable and can cause a crash 5691: UNIX VM: <f\|s>exists() requires read access to the target, which is different than 5.06 and earlier 5696: Assigning a variable to itself results in an overlapped memcpy() 5709: Win32FileManager::Rename cannot replace files open in another process/thread 5710: MvPACK: Errors occurring while the original table is closed lead to crashes 5731: running mivavm-v5.08 .exe removes Synchro registration info 5758: Upgrade from Mia/Empresa 5.06 or earlier leaves the installation with broken commercelibs setting 5760: Empresa setup fails to remove script mapping on uninstall 5774: Miva Merchant Mia - Installation with Upgrade from Mia 5.06 doesn't install properly 5776: Miva Merchant Empresa 5.09 / Win03 - Miva Merchant Empresa tab is missing from IIS Default Web Site Properties when upgrading directly from 5.06 to 5.09 5781: Mia: Upgrade does not preserve errorsettings or maxdocache registry values 5782: Win32 Compiler Installer does not set MVC_LIB environment variable 5783: Win32 Compiler Installer does not remove msc_license.txt when upgrading from 5.06 Other Changes ------------- - When renaming a file on Windows, if the rename fails because the process does not have permissions to read an existing destination file, the engine no longer enters an infinite loop. New Builtin Functions --------------------- - crypto_sha256( buffer var, format, result var ) Calculates the SHA-256 hash of "buffer", storing the result in "result". Format may be one of "binary" or "hex". - crypto_hmac_sha256( buffer var, key, format, result var ) Calculates the SHA-256 HMAC of "buffer" using binary key "key", storing the result in "result". Format may be one of "binary" or "hex". - Note: The SHA-256 functions may not be available on platforms running older versions of OpenSSL. SHA-256 was introduced in OpenSSL v0.9.8. On platforms with a version of OpenSSL that does not support SHA-256, the functions will return 0. Miva Merchant Empresa/Mia/Script Compiler v5.08 Release Notes ------------------------------------------------------------- Bugs Fixed ---------- 5621: The level arguments to the -p option of mvc do not work as expected 5623: MIVAVM - Notification Server not working in store admin 5636: Non-SSL MvCALL callreturnheaderN values are missing their last character 5651: The -P option to mvc detects the errors and prints diagnostics but does not cause the compiler to exit with a failure code. 5652: 3.x Config: Relative paths to authfile are handled differently than 5.06 5655: Miva Merchant 5.5 PR5: core-16 patch installation fails on 5.07 engine 5656: miva_array_sort can cause an engine crash with numeric sort callback and non-numeric data (actually related to the number of items being sorted) 5657: MivaVM::cat does not NULL terminate the resulting string 5658: Inconsistent segfault in MvCREATE when DATABASE is the result of an expression 5663: Logging into MM5 results in empty or error page (all POST forms broken) Configuration Changes --------------------- - The UNIX 3.x configuration library now supports a new directive, "builtindir". When specified, the engine loads all builtin function libraries found in the configured directory path. This functionality is similar to the environment based configuration's MvCONFIG_DIR_BUILTIN directive. New Builtin Functions --------------------- - New GD library functions have been added allowing images to be created from data stored in a variable instead of a file: gdImageCreateFromPngMem( data var ) gdImageCreateFromGifMem( data var ) gdImageCreateFromWBMPMem( data var ) gdImageCreateFromJpegMem( data var ) gdImageCreateFromGdMem( data var ) gdImageCreateFromGd2Mem( data var ) - New GD library functions have been added allowing images to be written to a variable instead of a file: gdImagePngMem( im, output var ) gdImageGifMem( im, output var ) gdImageWBMPMem( im, fg, output var ) gdImageJpegMem( im, output var, quality ) gdImageGifAnimBeginMem( im, GlobalCM, Loops ) gdImageGifAnimAddMem( im, ctx, LocalCM, LeftOfs, TopOfs, Delay, Disposal, previm ) gdImageGifAnimEndMem( ctx, output var ) - New GD library functions have been added allowing images to be written directly to the output stream: gdImagePngOutput( im ) gdImageGifOutput( im ) gdImageWBMPOutput( im, fg ) gdImageJpegOutput( im, quality ) gdImageGifAnimBeginOutput( im, GlobalCM, Loops ) gdImageGifAnimAddOutput( im, LocalCM, LeftOfs, TopOfs, Delay, Disposal, previm ) gdImageGifAnimEndOutput() Miva Merchant Empresa/Mia/Script Compiler v5.07 Release Notes ------------------------------------------------------------- Bugs Fixed ---------- 903: Fatal error on Windows servers- mysql_init failure 909: securityoptions differences between 5.02 and 5.03 1003: fscopy on a directory doesn't act as expected 1015: Directories created by streaming updates have no access to others 1446: crypto_sha1 may return sha1 hash of undefined value 1565: EULAs in VM and compiler software need updating. 1659: Insufficient feedback for disk space errors. 1805: Packaged certificate files are out of date 1916: MySQL: unsupported buffer type error 1934: Does our ROUND operator employ banker's rounding? 2368: Add array sort function to the language 3739: Drop table fails to drop index 4199: Product sorting bug reported by partner hosts 4519: limitation on number of stores 4535: engine crashes when calling crypto_md5_file on certain files 4536: Query causing engine crash with MivaSQL db library 4622: Expressions in MvDO parsed differently than other expressions 4626: MvCAPTURE does not properly terminate its result. 4672: Scripts cannot capture/handle MvCALL timeouts 4673: tar_create output cannot be opened in WinRAR or 7-Zip 4678: URLs bleed through SMT mvt:comment tags 4679: Template Compiler generates debugging files in production version 4687: File upload corrupts data when a line begins with "--" 4701: Template compiler reports error when ampersand used in param 4783: decimal fields are bound as type "unknown" when connecting to 5.0 or 5.1 4785: Storemorph won't display global array variables. 4803: Crash when ALTER TABLE is used on a previously referenced table 4930: Template Compiler outputs incorrect lineno instructions 4933: CGI temporary directory uses data directory configuration settings 4934: UNIXFileManager::DirectoryListing leaks DIR handles 4945: Engine capture mechanism should not fail on setuid during restore 4947: UNIXFileManager::ModifiedTime uses lstat(), not stat() 4950: 3.x API supports "commerce" path, 5x API does not 4957: MvPOP uses MakeTemporary inefficiently 4959: MvLOCALIZED always outputs the first language encountered 4960: TaggedFile::Section_Read[_Start]() return values are improperly handled 4962: NetworkConnection SSL certificate handling needs to be revamped 4964: Encoded filenames in open errors leak memory 4965: Session IDs are not sufficiently random 4968: MvCALL TIMEOUT attribute leaks into subsequent MvCALLS 4969: Network reads should never have an infinite timeout 4970: Multiple CRYPT operations in the same expression get the same value 4972: Buffer overflow in MvPOP 4973: MvPOP gets stuck in an infinite loop when the server terminates the connection 4978: tar_create crashes when the source directory does not exist and compression is enabled 4980: Win32 packaging and branding requires update 4983: Template Compiler gets confused by mismatched quotes 4984: Template Compiler misbehaves when semicolon omitted from mvt entity 5006: CGI VM won't handle ";" in content type for posted form data 5009: Non-Miva files having their size reported incorrectly. 5010: Entering a slash after the filename outputs compiler code in the main window 5012: Order Management feature is intermittently not loading some order data in Mia 5036: Entities preceeded by empty/self closed tags are not interpreted 5073: Column reference validation errors are reported as blank in some cases 5075: GROUP BY is incorrectly applied when also using UNION 5078: File descriptor leak in MvOPENVIEW/MvCLOSEVIEW 5115: Alter table in MivaSQL can lose all data in the table 5203: MivaApplication::DecodeAttributes generates invalid characters when given invalid input 5221: Passing a non-array to the glosub_array "replace" parameter crashes 5281: mktime_t does not return -1 when given an invalid date 5325: time_t functions have no ability to properly account for daylight savings time 5532: Network::OpenURL() (MvCALL) does not handle network write errors 5542: Admin secure redirect does not work on IIS 5571: xml_parse terminates in-progress xml_parse_section 5576: xml_parse_section_[get\|set]state cause segfault if used immediately after xml_parse_section_init() 5578: MivaApplication::itos with INT_MIN overwrites memory and crashes 5579: MivaApplication::dtos does not handle NaN or Infinity correctly 5580: Crash when making a variable a reference to one of its children 5581: Whitespace compression fails to suppress blank first line 5584: MvLOCALIZED uses primary language when attempting to fall back to default language 5592: MvCALL only supports HTTP GET, HEAD and POST methods New Builtin Functions --------------------- - xml_parse_var( var var, output var ) - xml_parse_set_colon_replacement( colon ) - miva_struct_members( aggregate var, members var ) - miva_array_sort( aggregate var, callback, data var ) - miva_array_min( aggregate var ) - miva_array_next( aggregate var, index ) - miva_array_previous( aggregate var, index ) - miva_template_compile_itemlist( signat, source var, sourceitems var, target, errors var ) - miva_template_compile_dump( source var, errors var ) - All builtin time functions which accept a "timezone" parameter (mktime_t(), time_t_year(), etc...) now accept the string value "local" for this parameter, which allows the underlying operating system to apply daylight savings time rules for the current timezone. - New system logging functions have been implemented for both Windows and UNIX hosts. On Windows, log messages are written to the event log. On UNIX, log messages are sent to the syslog facility: miva_openlog( ident, logopt, facility ) miva_closelog() miva_setlogmask( maskpri ) miva_writelog( priority, message ) - All libgd 2.x functions are now supported. The builtin functions are also compatible with GD 1.x installations, in which case 2.x specific functions will fail gracefully: gdImageCreate( sx, sy ) gdImageCreateTrueColor( sx, sy ) gdImageCreateFromPng( filename, location ) gdImageCreateFromGif( filename, location ) gdImageCreateFromWBMP( filename, location ) gdImageCreateFromJpeg( filename, location ) gdImageCreateFromGd( filename, location ) gdImageCreateFromGd2( filename, location ) gdImageCreateFromGd2Part( filename, location, srcx, srcy, w, h ) gdImageDestroy( im ) gdImageSetPixel( im, x, y, color ) gdImageGetPixel( im, x, y ) gdImageGetTrueColorPixel( im, x, y ) gdImageAABlend( im ) gdImageLine( im, x1, y1, x2, y2, color ) gdImageDashedLine( im, x1, y1, x2, y2, color ) gdImageRectangle( im, x1, y1, x2, y2, color ) gdImageFilledRectangle( im, x1, y1, x2, y2, color ) gdImageSetClip( im, x1, y1, x2, y2 ) gdImageGetClip( im, x1P var, y1P var, x2P var, y2P var ) gdImageBoundsSafe( im, x, y ) gdImageStringFT( im, brect var, fg, fontlist, ptsize, angle, x, y, string ) gdImagePolygon( im, points var, n, color ) gdImageOpenPolygon( im, points var, n, color ) gdImageFilledPolygon( im, points var, n, color ) gdImageColorAllocate( im, r, g, b ) gdImageColorAllocateAlpha( im, r, g, b, a ) gdImageColorClosest( im, r, g, b ) gdImageColorClosestAlpha( im, r, g, b, a ) gdImageColorClosestHWB( im, r, g, b ) gdImageColorExact( im, r, g, b ) gdImageColorExactAlpha( im, r, g, b, a ) gdImageColorResolve( im, r, g, b ) gdImageColorResolveAlpha( im, r, g, b, a ) gdImageColorDeallocate( im, color ) gdImageCreatePaletteFromTrueColor( im, ditherFlag, colorsWanted ) gdImageTrueColorToPalette( im, ditherFlag, colorsWanted ) gdImageColorTransparent( im, color ) gdImagePaletteCopy( dst, src ) gdImagePng( im, filename, location ) gdImageGif( im, filename, location ) gdImageWBMP( im, fg, filename, location ) gdImageJpeg( im, filename, location, quality ) gdImageGifAnimBegin( im, filename, location, GlobalCM, Loops ) gdImageGifAnimAdd( im, out, LocalCM, LeftOfs, TopOfs, Delay, Disposal, previm ) gdImageGifAnimEnd( out ) gdImageFilledArc( im, cx, cy, w, h, s, e, color, style ) gdImageArc( im, cx, cy, w, h, s, e, color ) gdImageEllipse( im, cx, cy, w, h, color ) gdImageFilledEllipse( im, cx, cy, w, h, color ) gdImageFillToBorder( im, x, y, border, color ) gdImageFill( im, x, y, color ) gdImageCopy( dst, src, dstX, dstY, srcX, srcY, w, h ) gdImageCopyMerge( dst, src, dstX, dstY, srcX, srcY, w, h, pct ) gdImageCopyMergeGray( dst, src, dstX, dstY, srcX, srcY, w, h, pct ) gdImageCopyResized( dst, src, dstX, dstY, srcX, srcY, dstW, dstH, srcW, srcH ) gdImageCopyResampled( dst, src, dstX, dstY, srcX, srcY, dstW, dstH, srcW, srcH ) gdImageCopyRotated( dst, src, dstX, dstY, srcX, srcY, srcWidth, srcHeight, angle ) gdImageSetBrush( im, brush ) gdImageSetTile( im, tile ) gdImageSetAntiAliased( im, c ) gdImageSetAntiAliasedDontBlend( im, color, dont_blend ) gdImageSetStyle( im, style var, n ) gdImageSetThickness( im, thickness ) gdImageInterlace( im, interlaceArg ) gdImageAlphaBlending( im, alphaBlendingArg ) gdImageSaveAlpha( im, saveAlphaArg ) gdImageCompare( im1, im2 ) gdTrueColor( r, g, b ) gdTrueColorAlpha( r, g, b, a ) gdImageTrueColor( im ) gdImageSX( im ) gdImageSY( im ) gdImageColorsTotal( im ) gdImageRed( im, c ) gdImageGreen( im, c ) gdImageBlue( im, c ) gdImageAlpha( im, c ) gdImageGetTransparent( im ) gdImageGetInterlaced( im ) gdImagePalettePixel( im, x, y ) gdImageTrueColorPixel( im, x, y ) gdImageSquareToCircle( im, radius ) gdImageStringFTCircle( im, cx, cy, radius, textRadius, fillPortion, font, points, top, bottom, fgcolor ) gdImageSharpen( im, pct ) gdClearLastError() gdLastError() API Changes ----------- - mvFile_Resolve has been deprecated as there is no secure way to resolve a path and then separately open it without introducing a race condition that could allow an application to break out of the sandbox. - New functions have been added to access the new system library registry: mvSystemLibrary mvProgram_SystemLibrary( mvProgram program, const char code ); void mvSystemLibrary_GetFunction( mvSystemLibrary library, const char function_name ); const char mvSystemLibrary_Error( mvProgram program, mvSystemLibrary library, int error_length ); - The configuration API version has been changed (to 2), and a new function, load_script_config_v2( mvConfig, void *, const char , mvFile ) now replaces load_script_config. Version 1 configuration libraries that provide load_script_config() will no longer function. Compiler Changes ---------------- - A new compiler option, -O <bytes>, performs basic obfuscation of string constants by splitting them into chunks <bytes> long. After splitting, duplicate chunks are "compressed" (not repeated) when written to the output .mvc file. - A new compiler option, -d, causes the compiler to output pseudo-C code suitable for use with Doxygen for generating automated documentation. - The compiler no longer requires license validation. Other Changes ------------- - Support for the ODBC database connector has been dropped. - MvREFERENCEARRAY now correctly applies its aggregate tags (MvDIMENSION, MvMEMBER) to the variable specified by the VARIABLE attribute, rather than the destination variable specified by NAME. - The MySQL connector library now automatically reestablishes connections that were lost while a long running SQL statement was in progress on a secondary connection. - The MySQL connector library now uses less memory when dealing with resultsets with multiple BLOB columns. - On UNIX, the engine may now be configured to capture and replay requests, for debugging purposes. Two configuration settings control this option: 3.x Configuration: capture_trigger_file=<path> capture_file=<path> Environment Based Configuration: MvCONFIG_CAPTURE_TRIGGER_FILE=<path> MvCONFIG_CAPTURE_FILE=<path> When configured, if the specified trigger file exists, the engine will dump its input state into a file created using the prefix specified by the capture file option. The capture files may then be replayed from the commandline by appending the "-c <file>" parameters. For example: $ /var/www/cgi-bin/mivavm -c /tmp/capture001 - The MySQL connector library now properly calls my_init(), which should resolve most multithreading issues that occured on Windows platforms. - Support for the Authorize.Net commerce library has been dropped. - The <MIVA> tag now supports attribute IDENT, which may be used to add rcs-style ident tags to compiled MivaScript files - Newly created MivaSQL databases now support table and index names up to 64 characters long. - The file management code that maintains the script and data directory sandbox has been completely rewritten to eliminate race conditions and restore proper functionality when handling symbolic links. The existing functionality was broken in v5.03. - Files created by the engine now properly apply umask. - MvLOCALIZED support in previous versions was completely broken. The new version restores the 3.x functionality. Scripts compiled with pre-5.07 compilers which make use of MvLOCALIZED will have to be recompiled using 5.07 in order to function properly. - Network operations which have their own configurable timeouts (MvCALL, MvSMTP, etc...) now use the global timeout if no operation-specific timeout is specified. - Implemented proper timeout handling for MvSMTP and MvCALL. - Network protocols that need to read a line of input at a time (SMTP, POP, HTTP, etc...) now do so much more efficiently. - MakeSessionID() now generates statistically more random session identifiers. - ROUND operations now truly use banker's rounding. In previous versions, a banker's rounding algorithm was applied, but would sometimes fail to produce the expected result due to inaccuracies inherent in floating point numbers. The new system applies correction code for these inaccuracies prior to performing the rounding. - The template compiler has been completely rewritten to fix a large number of parser related bugs. - A new system library registration mechanism has been added. Presently, this mechanism is only used to locate an installation of libgd for the GD builtin functions: Win32: The library registration dialog now supports a "System" library type. 3.x Configuration: <SYSTEM-LIB CODE="GD" LIBRARY="/usr/lib/libgd.so.2.0.35"> Environment Based Configuration: MvCONFIG_SYSTEMLIB_<code>=<path> - Builtin functions have been added implementing all libgd 2.x functionality. - When running under IIS, the engine now properly detects and manages mismatches between an IIS virtual directory path and the configured Miva root directory. - A new DWORD registry setting "maxdocache" allows configuration of the maximum number of MvDO'd files to be cached on Win32. This setting is not exposed through the user interface. - Handling of INFINITY, NaN, and values larger than INT_MAX or smaller than INT_MIN is now uniform between Windows and UNIX platforms. - MvCALL now supports additional METHOD values "OPTIONS", "PUT", "DELETE", "TRACE", and "CONNECT". Data handling for these action values is identical to "RAW".
(3 vote(s)) This article was helpful This article was not helpful

Help Desk Software by Kayako support.miva.com/supportsuite/index.php?