Why anti-osCommerce?

4rxsid

Hi all,

I've been doing a little research into 'off-the-shelf' type eCommerce / shopping cart solutions and have found in more than one place folks who appear to be very anti osCommerce. Is there any particular reason for the apparent disdane? Is is the installation, or the customization, or something else? Perhaps there were issues with previous version, to which the current version addressed? 😕

As far as I can tell, osCommerce seems to be a pretty good solution for small to medium online cataloges. But I could be wrong 😉 of course...thus the question here. I'd like to find out any 'hidden' issues with it before I invest my time installing it.

oh yeah, in the PayPal Pro merchant section, they actually list osCommerce as being a solution that works/integrates with PP Pro....but ZenCart is not listed.

so aside from personal or 'political' reasons for not liking osc...is there any technical limitations and/or shortcomings that one should be aware of?

B.T.W. I've sucessfully installed ZenCart, but decided to dump it as it doesn't support PayPal Pro. That's a requirement I need, and osCommerce appears to support it.

Thanks for any insight into osc.

BobLennon

4rxsid wrote:
Hi all,

I've been doing a little research into 'off-the-shelf' type eCommerce / shopping cart solutions and have found in more than one place folks who appear to be very anti osCommerce. ....QUOTE]

Contrary to local opinion, I think osCommerce is a great package. The only real criticism that I have about it is that it is poorly documented on almost every level.

Maybe it's time for an other O'Reilly book like the "Missing Manual" series.

MarkR

I think oscommerce is terrible:

Its HTML is very difficult to customise- it doesn't use any kind of templating - it generates complex, incorrect, unmaintainable and obsolete HTML, which is extremely bloated. It doesn't even look good
The code is overly complex and written for a highly obsolete PHP (3)
It doesn't work with PHP5 (I think there is some new patch which makes it work though)
The admin interface is tremendously unusable
Its variables system is unusable and incorrect (e.g. doesn't maintain stock for variants)
It has a horrenous number of security vulnerabilities, including many which were unpatched in the latest release last time I checked. This includes SQL injections and XSS vulnerabilities, and the contact form is exploitable by spammers.
Its admin system allows admins to do stuff they shouldn't be able to (backup, restore, edit PHP files, etc)
Its modules system is highly complex and counter intuitive

General code maintainability is very low, because it uses a huge number of global variables (undocumented, of course), its functions do strange things (undocumented, of course).

I've never figured out how its tax system works (undocumented, of course).

Its performance is poor for larger catalogues (nav generation).

"Poorly documented" doesn't even begin to describe it.

It is possibly the only PHP app worse than phpbb (Excepting anything with "nuke" in its name).

Mark

dream_scape

Most people's gripes with osCommerce deal with the code quality, code bloat, code architecture, code standards, etc...

It really becomes quite the pain in the @ss to work with the more you want to customize your store.

vaaaska

We started development of a simple cart for a few upcoming projects...I simply do not understand what the deal is with these insane bloat systems.

Less options is more...ESPECIALLY when a dev needs to make some adjustments.

4rxsid

interesting. thanks for the replies folks.

about the "SQL injections and XSS vulnerabilities", where is that documented and specifically how is osc affected by those? I'd like to learn more about this supposed vulnerabilities.

thanks.

BobLennon

MarkR wrote:
I think oscommerce is terrible:

Its HTML is very difficult to customise- it doesn't use any kind of templating - it generates complex, incorrect, unmaintainable and obsolete HTML, which is extremely bloated. It doesn't even look good

The code is overly complex and written for a highly obsolete PHP (3)

It doesn't work with PHP5 (I think there is some new patch which makes it work though)

The admin interface is tremendously unusable

Its variables system is unusable and incorrect (e.g. doesn't maintain stock for variants)

It has a horrenous number of security vulnerabilities, including many which were unpatched in the latest release last time I checked. This includes SQL injections and XSS vulnerabilities, and the contact form is exploitable by spammers.

Its admin system allows admins to do stuff they shouldn't be able to (backup, restore, edit PHP files, etc)

Its modules system is highly complex and counter intuitive

General code maintainability is very low, because it uses a huge number of global variables (undocumented, of course), its functions do strange things (undocumented, of course).

I've never figured out how its tax system works (undocumented, of course).

Its performance is poor for larger catalogues (nav generation).

"Poorly documented" doesn't even begin to describe it.

It is possibly the only PHP app worse than phpbb (Excepting anything with "nuke" in its name).

Mark

Your comments have great merit.

             >Its HTML is very difficult to customise- it doesn't use any kind of 
 templating...

But surely, templating systems are not the hallmark of all successful applications.

MarkR

BobLennon wrote:
Your comments have great merit.
             >Its HTML is very difficult to customise- it doesn't use any kind of 
 templating...
But surely, templating systems are not the hallmark of all successful applications.

The way the HTML is output in oscommerce contributes heavily to its non-maintainability.

If it used a templating system, in my opinion, it would be easier.

Mark

Jason_Batten

4rxsid wrote:
interesting. thanks for the replies folks.

about the "SQL injections and XSS vulnerabilities", where is that documented and specifically how is osc affected by those? I'd like to learn more about this supposed vulnerabilities.

thanks.

And why is that?

4rxsid

And why is that?

why not? haha. I mean really...what a crazy thing for someone to ask huh? :rolleyes: I certainly wouldn't want to ask questions about serious allegations about a product i'm thinking of using.

a few reasons for wanting to know:
1. for information. i personally feel that the more i know and the more i'm aware of a products limitations (or security issues), the better i can set up/ code to protect against these types of things if I wind up using that product.
2. so that i can compare these venerabilites against the other eCommerce solutions to see which has the least vulernability or possible which would be easier to 'fix' or safeguard as best I can with the least amount of work.

3. unless there is documentation, an article, white papers, etc describing these things...I'm inclined to view those statements as false accusations...perhaps by someone who has some sort of axe to grind with osc. which doesn't do me (or others) any good when evaluating these things.

if I had to guess, I would think that osc can't be the only eCommerce shopping cart system that has these vulnerabilities (if they are even true)....is it?

so again...any proof of these serious security issues with osc? i would appreciate the info/links. 😉

thanks.

Weedpacket

Well, here's the first one I found with a Google search:
http://secunia.com/product/1308/

4rxsid

thanks for the info weedpacket. after reading that notice, it appears that the most critical part of that alert isn't considered 'too critical' by the Secunia folks.

and, the less critical (per Secunia) 'unpatched' alert states that the pages in question are behind the \admin directory. If that directory is password protected via .htaccess...wouldn't that remove (or at least greatly minimize) that vulnerability? The osc doco says to pw protect the admin dir post implementation.

i didn't see anything there regarding SQL injections with current versions.

thanks.

MarkR

Not all vulnerabilities in the product are known about by Secunia.

For example, there is definitely an email header-injection vulnerability in the contact form which isn't listed.

Mark

vaaaska

I think knowing and wanting to know about XSS issues is a smart thing...Sitepoint had a useful post with resources on the topic recently:

http://www.sitepoint.com/blogs/2006/02/17/safehtml-cleaning-form-input/

MarkR

I take the opposite view of them- rather than having a blacklist of things NOT allowed, I have a whitelist of HTML elements which ARE allowed.

User HTML is parsed with DOM::loadHTML and then stripped of all elements / attributes not in my whitelist.

There is nothing javascript-related in my whitelist, and I also treat some attributes specially, to remove URLs with offending protocols (currently anything except http and https).

It's harder to defend against certain types of style (MSIE behavior: style, Mozilla moz-binding: style), but I try to do that anyway. That is, assuming that the style element or attribute is on my whitelist anyway.

Mark

4rxsid

thanks for the reply's all.

it appears that the osc folks have a fix (?) for the issue of email header-injection

looks like ZenCart has it's share of security issues as well (as probably do most applications like these):

Zen Cart SQL Injection and File Inclusion Vulnerabilities listed as 'highly critical'

X-Cart, CubeCart, .... they all have security vulnerabilities listed.

I originally thought there would be some security issue with any eCommerce product like osc or zencart, because at this point i'm not aware of any publically used or accessed product (or system) that is 100% failsafe and secure 100% of the time. hackers will probably always find a way if they are determined enough.
I was more concerned with technical (such as platform incompatibilites, or product x doesn't install very well and requires a highly experienced programmer and dba to install, will not integrate at all with paypal, etc) or functionality shortcomings.

so i guess the botton line would be to chose a product that meets one's needs, then become as aware as possible (via searches and postings in forums like this) of all the security vulnerabilities with that product and either report them (if not already done so) and/or apply the latest fix/patch for the issue.

thanks again!

jazz_snob

I dislike OSC and zen cart simply for their admin area (oh yeah, I think the coding isn't very good either). I write custom shops for people and they are all amazed at how simple the admin area is to use. Granted, when you write a custom shop you can focus on how the user will prefer to work, rather than OSC which tries a 'one-size-fits-all' approach. BTW xcart is the worst---the coding is so insane to me it looks as if it is obfuscated.