You can download this patch from the zen cart website Should you choose to install it yourself, be sure to read the directions that are given on how to proceed to get the mod to work properly.

You can also have zen cart experts install it for you by visiting Zen Cart Ecommerce Website Design

Be sure after placing your order that you click the button for modification installation to be taken to a secure form to give us the info we would need to install the patch.

This patch will work on versions 1.3.8, 1.3.9 and 1.5.0. We HIGHLY advise that if you are using version 1.3.8, you have your site upgraded to 1.3.9H immediately to protect your clients and sensitive information. Zen Cart version 1.3.8 is no longer PCI Compliant, nor is it considered secure and is constantly being targeted by hackers.

1. Create the form at http://docs.google.com in your account
2. Click on the link to the form to see the spreadsheet
3. Mouse over the form menu and a dropdown will appear, go down to embed form in a webpage and click on that link – (see image)
4. Copy the iframe coding it gives you in the popup
5. Go into your ezpages and set up an ezpage for the form (Tools>Ezpages) – make SURE you are using Plain Text as the editor
6. Put a title in, put a sort number in the header, footer, sidebox, etc wherever you want the link to be, paste the code from google and save the ezpage
7. If you do not want a column to show up with this form, go to Configuration>Ez-Page Settings and you will see EZ-Pages Pages to disable left-column and EZ-Pages Pages to disable right-column where you can enter in the number of your ezpage.
8. When someone fills out the form, the information will be displayed on your spreadsheet in your google docs area of your Google account.

Hope this helps someone with adding a form to their zen cart website easily.

Release of Zen Cart 1.5.0
At the end of July of this year, the Zen Cart developers released a beta version of 1.5.0. Since that time the community has been installing and testing it to work out any bugs in the beta.

Today, the official version was released that is safe to use on a live store. One of the main reasons for this 1.5.0 release is in becoming PA DSS certified. PA DSS (Payment Application Data Security Standards) certification is important in the area of PCI compliance when accepting credit cards online as well as in passing stringent testing for security holes so that hackers cannot breach the software. Zen Cart is the FIRST open source e-commerce software that has passed PA DSS certification! I was impressed with Zen Cart and the developers when I first starting using the software eight years ago – and continute to be impressed! Needless to say, I am thrilled to be a part of this open source community and to be able to help my clients have carts with top of the line software!

Below is some info from the developers about this new release:

Minimum Server Requirements:
PHP 5.2.14 or higher
MySQL 4.1.3 or higher
Apache 2.0 or higher.
Apache configured with AllowOverride set to either ‘All’ or at least both ‘Limit’ and ‘Indexes’ parameters, and preferably the ‘Options’ parameter as well.
PHP configured to support CURL with OpenSSL

While Zen Cart® can run on Windows/IIS servers, Linux/Apache servers are recommended for best results, superior performance, and easier use by shopowners.

What’s New In v1.5.0:
Updates include:
CHANGE-12 – Numerous system changes to support PA-DSS compliance certification
*Admin passwords now expire every 90 days, as per PA-DSS specification
*Admin passwords now require a combination of letters and numbers, as well as uniqueness (cannot use already-used passwords)
*Admin passwords can have a configurable length, but no less than 7 characters
*Admin passwords also expire, for security reasons, when changing admin configuration from non-SSL mode to SSL mode.
*Admin Profiles – is now built-in, with a significant number of additional features, and simpler to use.
*Add basic admin Activity Log Viewer/Exporter tool
HTMLarea editor removed from core due to obsolescence. Use preferred plugin instead if similar functionality is required.
FCKeditor components removed from core due to obsolescence. CKEditor is the replacement editor by the same author. Switch to the new plugin if desiring to use this editor.
USPS module removed from core in favor of being an addon, due to the volatility of frequent changes made by USPS. The addon is available in the Free Addons section of the Zen Cart website.
CHANGE-12 – PA-DSS – prevent payment modules from ever storing more than 10 characters of sanitized CC numbers
CHANGE-12 – PA-DSS – prevent built-in “gateway” payment modules from functioning if the site is not protected by SSL
CHANGE-12 – PA-DSS – add admin detection of SSL mode change and auto-expire all passwords if SSL mode is enabled either with ENABLE_SSL_ADMIN or using an https address for HTTP_SERVER
CHANGE-12 – PA-DSS – add two-factor authentication hook in admin login
zc_install now treats supplied initial admin password (during install) as temporary … requiring the admin user to select a new password at first login. This is to prevent abuse from password sniffing.
Incorporate TZ (timezone) support, with ability to override/disable simply by defining a DISABLE_MYSQL_TZ_SET constant. c/f http://www.zen-cart.com/forum/showthread.php?t=174346
PADSS-30 – Admin SSL now enabled by default in configure.php file if Enable-SSL is selected during zc_install
BUGSFORUM-1774 – Add ‘secure’ flag support for session cookie when site is running entirely in SSL
BUGSFORUM-1081 – Fixed: no default set for shipping radio buttons if module is disabled after previously selecting a shipping method
BUGSFORUM-1347 – Remove file-based session handling support due to security concerns and chicken/egg situation caused by garbage collection processes.
BUGSFORUM-1497 – Admin order totals section of orders.php page ignored currency-formatting display rules in some cases
BUGSFORUM-1550 – Fix occasional problem with “duplicate entry” in sessions table caused by some servers using longer session ID keys
BUGSFORUM-1558 – typefilter incorrect lookup problem in case of (unlikely) file-not-found scenario
BUGSFORUM-1554 – Shopping Cart Problems when updating product quantities for products with Max limit set
BUGSFORUM-1564 – orders_status wrongly set to 0 in rare cases
BUGSFORUM-1584 – no_picture.gif could be accidentally deleted if specified as an actual product image
BUGSFORUM-1589 – Fixed problem with some downloadable orders where an update of an order might set the number of days to a wrong value
CHANGE-151: Fix rounding and tax calculation issues in Cart/Order Class
CHANGE-90 – SECURITY: Fix Local File Inclusion Vulnerability
Whos_online – several improvements to allow the option to exclude spiders and/or admin IP’s from the list of displayed results
Improvement: Developers Toolkit can now optionally search .js files too.
CHANGE-136 on new installs, DB_CHARSET now defaults to UTF8, not latin1
CHANGE-137 Removal(deactivation) of CDE payment modules when SSL disabled
BUGSFORUM-1592 – Fix rounding problems affecting coupon min-purchase eligibility calculations
CHANGE-70 – zc_install now checks whether .htaccess rules will work, and provides an alert if there’s a problem.
BUGSFORUM-XXXX – PayPal improvements – allows Transaction ID to show on admin order confirmation emails for WPS, just like other payment modules do
BUGSFORUM-XXXX – PayPal – partial fix for bug where currency code not specified during partial refunds causes request to fail
BUGSFORUM-XXXX – PayPal – fixed bug where debug logging might happen even if switched off (caused by broader server-config issues)
BUGSFORUM-XXXX – PayPal – fix bug in Express Checkout where a shipping-override would still send a shipping phone number, causing a 10001 error without explanation.
BUGSFORUM-XXXX – PayPal – fix bug where EC button was removed from login page but left PayPal text prompts, resulting in confusion.
BUGSFORUM-XXXX – PayPal – Change to VPS-Timeout-90 instead of 45 at PayPal’s request. This means customers might have to wait longer for transactions to complete, but will reduce timeout errors when PayPal’s systems are slow.
BUGSFORUM-XXXX – PayPal – include product ID number on line-item details since is needed for order fulfillment
BUGSFORUM-1673 – PayPal – Fix minor html table syntax bug in paypal history details on admin orders screen
BUGSFORUM-1754 – PayPal – fix various rounding problems in all modules
BUGSFORUM-1760 – PayPal – Fix problems with Hungarian Forint and other 0-decimal currencies
BUGSFORUM-1926 – PayPal – Fix problem with attributes — if a product had attributes, the product name was being replaced with attribute details, instead of being appended to
BUGSFORUM-1971 – PayPal – Trap cases where PayPal returns a blank address unexpectedly, and ask them to supply address details by creating an account
BUGSFORUM-1971 – PayPal – Minimize address matching issues which arise when storeowners rename their countries to non-ISO standard names (something they should not do)
BUGSFORUM-1892 – PayPal Express: Item details were shown as “Tax included in prices: 0 (0)”
BUGSFORUM-1959 – PayPal IPN and Express Checkout Missing free Items, or listing free items without description
BUGSFORUM-2024 – PayPal IPN – address-override alert might insert duplicate update notices in order status history
BUGSFORUM-2151 – Paypal – Error 10413 when redeeming Gift Certificates for amount greater than product-subtotal
CHANGE-164 – paypal logging not properly disabling consistently
BUGSFORUM-1613 – Media Manager Assign to Products wouldn’t allow assigning of new products due to security change in 1.3.9h
Fix to admin customer search: search for new customers by customers_email_address to get correct customer and not everyone named Smith
Fixed display bug with category icons generating link to cPath=0 if cPath not set
Fix the display of Discount Coupons when a redemption code is applied so it is more readable by the customer
Fix Add to Cart to stay on listing when set to not display cart
Fixed coupon admin screen to land on correct page after adding new coupon
Various Admin pages: Fix pagination problems when changing status, searching, etc.
Improvement: Shorten CPU cycles on double-parsing an array needlessly in Authorize.net modules. Also improved sanitized debug output.
BUGSFORUM-1645 – Adding Featured Products ERROR Warning Warning: Product ID already on Special
Admin products-to-categories copier: Add additional message for clarity when Copy to categories_id is invalid but allow for obscure usage
Fixed bug on Order History going to page not found when set to not display cart
Fix: restore shopping cart products in the order they were added
BUGSFORUM-1662 – Gift Certificates Will Not Release
Fixed Error message when restricting coupons
Fixed hard-coded table names which should have been using constants, to allow for prefixes properly.
Fix problems with the word “search” in spiders.txt
Admin orders page now passes unformatted value back for availability to customizations which want to redisplay the values differently.
BUGSFORUM-1696 – clear COUPON_GV_QUEUE when deleting an order
BUGSFORUM-1681 – fix links in GV mails
BUGSFORUM-1689 – email validation regex improvements
BUGSFORUM-1634 – Bugfix: Prevent loading of non-PHP files in some admin autoloading routines
BUGSFORUM-1650 – sanitize whosonline output
Downloads – improvements and addition of support for IE9
BUGSFORUM-1708 – Combine class methods to reduce chance of race conditions and add error suppression to filemtime
Fix potential GZIP error if server configuration is overly generic
CHANGE-74 Sanitization
VARIOUS changes made to admin/catalog page forms to protect against CSRF using security token
VARIOUS changes for date fields to be handled consistently and to remove some pre-quoting which was breaking bindVars
CHANGE-102 Fix broken error checking in SQLPatch tool
CHANGE-128 obscure sql injection fix
CHANGE-135 add default value to zen_draw_pull_down_menu call to stop the value being drawn from the GLOBALS array and tested as a string.
CHANGE-138 Set CURL Proxy Status to FALSE by default, and remove from display since it’s now deprecated
CHANGE-139 fix sprintf() error when generating an outgoing email notification caused by language file refinement
CHANGE-142 fix tax calculation
CHANGE-143 fix sidebox query to ensure a correct limit statement is built, if necessary
CHANGE-143 catch SQL errors and output generic message to user and write message to log instead
CHANGE-144 XSS mitigation for admin forms — adds logging for inputs flagged as “rogue” by blacklist algorithm.
CHANGE-145+146 Blank values for various Maximum Values settings causes PHP errors
CHANGE-147 zc_install was throwing warning for MySQL versions over 5.2
BUGSFORUM-1709 Fix extraneous products_id in url
BUGSFORUM-1783 Fix Virtual Product defaults for all core Product Types
BUGSFORUM-1798 Preview icon was linked directly to product-general type. Now linked to the product type handler, allowing correct language defines to be loaded when previewing a product via this icon.
BUGSFORUM-1862 status filter not retaining state, restrict to first char for safety
BUGSFORUM-1754 change to calculate price/tax on zen_round(zen_add_tax(price,rate)*quantity, decimals)
BUGSFORUM-1696 SQL error due to non-matching field name
BUGSFORUM-1907 Fix ambiguous description on admin search switch
BUGSFORUM-1905 Adjust schema to handle ipv6 addresses
BUGSFORUM-1949 various ISO country updates
BUGSFORUM-1973 Downloads might deliver an empty file if readfile() is disabled in PHP and symlink support is off
BUGSFORUM-2046 HTML Entities not retained while editing via admin
CHANGE-159 – Remove Welcome-Email Preview from admin
BUGSFORUM-2038 Invalid email address formatting can cause ugly failure message without explanation
CHANGE-168 – Fix tax calculations for not-logged-in users, by defaulting to default country/zone just like it does for product listings
.htaccess – add safety around apache directives to prevent errors with poorly configured servers
Fix bug in properly detecting SSL mode with zen_redirect calls
Addressed SSL logoff scenario specific to shared SSL on shared hosting.
Fix email error handling – was only setting error info if the message succeeded, thus always blank.
Fix broken markup in admin layout-controller
add extra line-break before “spam” disclaimer in email footers
Disable language/currency sideboxes by default, to minimize some confusion
Fix some collation errors encountered during upgrades
CHANGE-160 – Various changes for basic compatibility with the proposed PHP 5.4 specifications
CHANGE-175 – Fix Maximum limit to manage merge of cart on login
CHANGE-176 – Fix Text Required to allow for 0 to work as Required Text content
BUGSFORUM-2121 – zc_install – fixed broken link for help with disabling session.use_trans_sid in help text
Simplified the admin-directory-rename process: New installs now only require renaming the folder. No more special configure.php file edits!
CHANGE-186 – Removed Tell A Friend feature
BUGSFORUM-2138 – stripslash keyword in first parsing of search keywords, to protect against broken sql resulting in blank page
BUGSFORUM-2140 – fix problem with metatag deletion where multiple languages exist
BUGSFORUM-2150 – PHP Warning: strlen() expects parameter 1 to be string
BUGSFORUM-2175 – fix XSS issue reported by intermittent PCI scans
CHANGE-190 – fix constants from discount coupon to gv
The current version of Zen Cart – 1.3.9h – will continue to be supported for 6 months from today, per the developers.

At some point I will be trying to get a list of mods together that are working with 1.5.0. Right now…. it is “slim pickins” because of the stringent coding requirements for PA DSS certification.

If you use authorize.net as your payment processor on your zen cart store, one way you can give your visitors an extra feeling of security is to display their verified merchant seal.

Here is the way you can do that.
1. Log into your authorize.net account
2. On your main page once you log in, you will see a menu on the left. Look under Account and you will see a link for Verified Merchant Seal to click on
3. Click on the Sign Up button.
4. Read the agreement (no worries – this seal is free) and click the appropriate places to say you have read and agree with the terms.
5. In the box provided, list any distinct / different domains that you have that are a part of your authorize.net account. (no need to add sub domains). While I do not know if it is required, it is a good idea to make sure the way you type your domain is the way you purchased your SSL certificate. Eg: www.yourdomain.com or simply yourdomain.com with no www before it. No need to put the http:// before the domain name(s). After adding the domain(s) to the box, press the submit button.
6. Copy the code that is provided to you and paste it into the desired spot on your website.

If you want the code in a sidebox, there are a couple of ways to do this. One way is by placing the html code provided to you into your banner manager. Another way is to install the Sidebox Editable in Admin zen cart module.

My rationale for this answer two-fold:

1. SSL (Secure Sockets Layer) Certificates encrypts your customer’s data by scrambling it up in a numeric process so that when it reaches the place it is supposed to go to (eg: authorize.net, paypal, etc.) it is then decoded and read. This safeguards your customer’s sensitive information.

2. SSL certificates also provides your customers the assurance that a 3rd party verification from the certificate issuer (eg: Comodo, Verisign) has been done to verify you are who you say you are. This is very important today as scammers are stealing people’s money and identities. Any savvy shopper will look for indications that your site is secure. If they do not see that indicator, they will most likely leave the site to shop somewhere else.

In my professional opinion, any web site that will be collecting sensitive information from their clients should have their own SSL certificate for their company. Using a shared server SSL certificate is not even close to professional and should be an indicator to your visitors that your business is not “successful” enough to afford the $100 per year for your own SSL certificate and dedicated IP. For this reason, we do not even offer a shared SSL certificate on our servers.

To remove this background image, you will need to go into includes/templates/YOUR TEMPLATE NAME HERE/css/stylesheet.css and find the following code:

#popupShippingEstimator, #popupSearchHelp, #popupAdditionalImage, #popupImage, #popupCVVHelp, #popupCouponHelp, #popupAtrribsQuantityPricesHelp, #infoShoppingCart {
background-color: #ffffff; }

After the background-color code, add the following:
background-image:none;

So, you end up with this:
#popupShippingEstimator, #popupSearchHelp, #popupAdditionalImage, #popupImage, #popupCVVHelp, #popupCouponHelp, #popupAtrribsQuantityPricesHelp, #infoShoppingCart {
background-color: #ffffff;
background-image:none;
}

*NOTE: background-color: #FFFFFF is the hex code for white. You can replace the FFFFFF with any other hex codes you want that will match your template design.

For those of you who are using Paypal IPN as your method of receiving payments, the Zen Cart Developers are recommending that you do NOT use the Paypal IPN as a payment method because it is “antiquated”. They recommend that you use PayPal Express checkout which is more up to date.

To quote from this post: http://www.zen-cart.com/forum/showthread.php?t=177771

“This is a good time to remind you that you really should be using PayPal Express Checkout if you’re accepting PayPal on your site. Using the old IPN/Website-Payments-Standard method for payments is becoming antiquated and has been known to have problems in various circumstances. Using the newer Express Checkout approach is far more reliable for completing payments and giving your customer up-to-date confirmation that their order has been paid and accepted by your store.
Naturally, also upgrading to the latest version of Zen Cart is similarly valuable and important.”

To check what method you are using, you can log into your admin area and mouse over the word MODULES then click on PAYMENT

If there is a “green light” by Paypal IPN, under the status column, it is what you are using.

To de-activate Paypal IPN, simply click on it and and click the REMOVE button on the right side.

NOTE: You CANNOT have both PayPal IPN and Express checkout activated at the same time in your admin. You must uninstall the IPN first.

To activate PayPal Express, click on it and click the install button and follow the instructions to fill in the information from PayPal that it is requesting. Here is a link with instructions on how to do that: http://www.zen-cart.com/index.php?main_page=page&id=15

To order an upgrade to the latest version of Zen Cart, please visit http://zencart-ecommerce-website-design.com/index.php?main_page=product_info&cPath=27&products_id=139

Should you decide to continue using PayPal IPN, please note:

As of April 7th, PayPal has added several IP addresses to its DNS as follows:
66.211.169.74
66.211.169.14
64.4.241.193
64.4.241.225
173.0.84.2
173.0.84.34
173.0.88.2
173.0.88.34

PayPal instructs those using IPN to check with their hosting company to make sure these IP’s are listed if the server is behind a firewall.

“However, if you are using IPN for Order Management and your IPN listener is behind a firewall, you may need to update your firewall configuration to allow outbound access to these IP addresses. This action will ensure that your IPN listener does not get intermittent timeouts when performing IPN validation by posting back to https://www.paypal.com.”

If you are hosted on one of our servers, we have sent a notice to our Technical Support Department to make sure these IP’s are added if necessary. You will also receive a duplicate of this email from our server.

THANKS!!

Judy and Tommy Gunderson

On March 8th, 2011, HIT abandoned over $15,000 customers they provided hosting for through fibernet and also provided zen cart web design to customers.

Fiber.net is trying to help hosting companies that HIT abandoned. You can see their help section for more info if you were unfortunate enough to be entangled in this nightmare.

The local TV Station in Utah – Ksl.com has a news report on HIT Web Design (below) with more information about HIT, Heritage, and the “new” company that sprung up a week before HIT abandoned their customers. This company, ISO Web Works, is owned by former Vice President of HIT – Kevin Morrill, who claims he is not a “revamp” of HIT. Some may know that a couple of years ago, Heritage Web Design closed its doors and opened up under the name HIT. The below video from KSL is very informative.

Video Courtesy of KSL.com

We will be happy to help anyone who wants to have their zen cart websites redesigned in the current version of zen cart – which requires a brand new site due to the old 1.3.7 zen cart coding that HIT used and hacked to suit their purposes. Please feel free to contact us at 816-550-1900 for a quote.

For example, when doing a manual install of zen cart version 1.3.9, the software will force you to change the name of your admin folder. It will not allow you to log into your administration area without renaming the /admin folder and removing the zc_install folder. This is an important security feature, because hackers know that the standard name for the admin folder is /admin.

If you are using an automated installation program such as Fantastico to install your zen cart, it will automatically rename your admin folder name to zc_admin. Nice, huh? No… not really.

Keep in mind that hackers have the same access to hosting accounts with these automated installation programs. If they were to use Fantastico to do an install… they would see what the admin folder name is re-named to and from there can write their stupid little hacking programs to search for and try to hack into that folder.

It is ALWAYS in your best interest for security sake to rename your admin folder to something meaningful to you. Do not feel secure with the fact that the automated installation program has renamed your admin folder. Change it to something else – and don’t forget to change that information in your admin/includes/configure.php file as well. There are 3 different lines of code that you will need to change in that file.

While gray is a nice neutral color, it may not be what you want displayed on YOUR zen cart website design.  Here are a few steps to follow by editing includes/templates/YOUR TEMPLATE NAME HERE/css/stylesheet.css

In your stylesheet.css you will find the following code:

.rowOdd {
background-color: #E8E8E8;
height: 1.5em;
vertical-align: top;
}
.rowEven {
background-color: #F0F0F0;
height: 1.5em;
vertical-align: top;
}

If you change the background-color to white eg:#ffffff this is the result you will see:

Next, you may want to change the top heading line to another color.  To do this, find the following in your stysheet.css and change the background color to the color of your choice:

TR.tableHeading {
background-color: #cacaca;
height: 2em;
}

We have changed our heading to a green that matches the green in our website as shown here:

If you want to change the color of the line that is at the bottom of this table, you would need to search for and revise this code:

.tableHeading TH {
border-bottom: 1px solid #00bec8;
}

Our next step is to change the color of the sub total bar.  In your stylesheet, find:

.tableHeading, #cartSubTotal {
background-color: #f1d4d3;
}

And if you want to change the color of the lines around this, you can do that here:

#cartSubTotal {
border-top: 1px solid #cccccc;
font-weight: bold;
text-align: right;
line-height: 2.2em;
padding-right: 2.5em;
}

In our case, we have now changed the shopping cart page to where it beautifully matches our design!