PrestaShop Debug-Mode Flaw Shows Risk Extends Beyond Storefront Pages

·3 views

Administrators reviewing PrestaShop exposure should look beyond public storefront pages to the back office, the PHP runtime and the configuration files it can write. CERT/CC VU#385711 describes a code injection in the Performance debug mode, where an authenticated administrator can insert crafted values into the debug cookie configuration that PrestaShop writes into executable PHP. ZoomEye count-only queries showed 32,915 app-fingerprint matches versus 8,974 title matches, but these counts do not establish which installations are vulnerable or expose the back office. Teams are advised to combine both query views with internal ownership and version records, and to avoid inferring vulnerability from count differences. PrestaShop 9.2.1 fixes the issue, and older installations should review debug mode, administrator permissions and file write access.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Which product photos merit an upscaler credit: a test of eight enlargement methods

Free upscaler tiers are metered, so a solo seller must decide which photos justify a credit. The author enlarged three test images, a portrait, a landscape and a self-made text page, down to 512 or 256 pixels and back to 1024, then scored eight methods against the originals. Mostly empty frames such as sky left little for any model to recover, while fine eyelashes and small type separated the methods more clearly. On the text page a GAN-based tier scored lowest on small type despite looking sharpest, and its redrawn strokes make it unsuitable for reading batch codes or prices. Images with hairlines or dense small text should instead be re-exported at the size actually needed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Laravel 13 Tutorial Covers Validating, Storing and Downloading Uploaded Files

A DEV Community tutorial explains how to handle file uploads in Laravel 13 using a form with multipart encoding, validation rules and the framework's store method. It walks through building a document upload feature that saves the file to a private disk and records its original name, path and size in a database. The guide also shows how to deliver downloads through an authorized route so users can only access their own files. It further advises on choosing between private and public disks and on configuring PHP upload limits in php.ini.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Common Product Mistakes That Lead to App Store Rejection for Under-18 Software

A frequent error in software aimed at under-18s is treating age as an unverified form field, which leaves downstream consent and data handling resting on unreliable information. Teams also often retrofit a parental branch late in development, and the resulting seams signal to reviewers that the consent design was not carefully considered. Safeguarding reporting routes are another weak point: a button without a named responsible person, response time, and record does not function as a real channel. The article further notes that consent records often fail to show which consent model applied to which account and when it changed, and that app store rules from Apple and Google require declared ratings, data disclosures, and screenshots to match the actual product. Products that pass review typically offer age assurance, track consent history, maintain a named safeguarding contact, and present a listing that accurately reflects the app.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Building AJAX CRUD in Laravel 13 with the Fetch API, No Page Reloads

A tutorial shows how to build create, edit and delete actions without reloading the page in Laravel 13. The approach pairs a controller that returns JSON with the browser's Fetch API and a small script that updates the page, avoiding jQuery entirely. The walkthrough covers a task list model and migration, controller methods, and routes that use session and CSRF protection. It also explains how sending an Accept: application/json header makes Laravel return validation errors as 422 JSON responses rather than redirects. The guide targets Laravel 13 with PHP 8.3 to 8.5, Blade and plain JavaScript.

0 comments Read more at DEV Community