Magento eCommerce PHP Remote Code Execution

Post by lukedev » Tue, Apr 21, 2015, 9:29 PM UTC

madaxe_again wrote: post #48

mrweasel wrote: post #14

Unless it got significantly better/redesigned in the last couple of years, Magento is a piece of junk. Arguably it's been years since I worked with it, but installation was weird, developing is slow a cumbersome, documentation was lacking, search was pretty much broken and it was slow. I can't image running it on a shared host, performance must be terrible. On the positive side Magento does have an impressive amount…

The sad thing is that they learned nothing from oscommerce. Yes, it's not a procedural pile, but it suffers from the same "can't implement sensibly. Fuck it, edit core. Patch?! Shit. Upgrade path broken" phenomenon in heaps. If I got paid every time someone ditched magento because it doesn't perform, is hard and costly to host/maintain, gets blind alley'd by "someone else's problem" developers, can't do what they nee…

Post by davidgerard » Tue, Apr 21, 2015, 9:30 PM UTC

mrweasel wrote: post #14

Unless it got significantly better/redesigned in the last couple of years, Magento is a piece of junk. Arguably it's been years since I worked with it, but installation was weird, developing is slow a cumbersome, documentation was lacking, search was pretty much broken and it was slow. I can't image running it on a shared host, performance must be terrible. On the positive side Magento does have an impressive amount…

Post by davidgerard » Tue, Apr 21, 2015, 9:33 PM UTC

Someone1234 wrote: post #40

jlas wrote: post #18

Earlier quoted context omitted.

Magento code in general is of very dubious quality. I once ran a quick static analysis on it and found some ridiculous results: https://twitter.com/jlas_/status/391615992473722880

While it could be better written, that's just their installer, it doesn't run in production by its very nature so might be a low priority for coding standards. If you wanted to call them out, at least call them out for something which actually runs during normal operation.

Post by vhost- » Wed, Apr 22, 2015, 4:53 AM UTC

madaxe_again wrote: post #49

vhost- wrote: post #35

Earlier quoted context omitted.

I did the ops-side of a large Magento site. It was a fucking nightmare... and I handled .NET and Java once too. We had 3 cache servers with 128GB of ram EACH just to cache the complete shit out of Magento pages. Each user had their own keyspace in the cache. _that's_ how bad Magento is. When cache would go down because of a network partition or something, Magento would fallback to rendering and our application web se…

Each user... So one for "not logged in" and one for each known id? That's the laziest possible implementation that can provide any variety of benefit. Caching on a per-actual-visitor basis is just a waste of ram. Fwiw we partial view cache on our platform and achieve a 90%+ hit rate on most sites. Some run many user-variable-specific (referrer,cookie,stored data) site versions which drops the cache hit rate, but is w…

Post by dspillett » Fri, Apr 24, 2015, 9:53 AM UTC

dspillett wrote: post #7

I don't see the big fuss here if people are warned, either as the main package is downloaded or in the post-install configurations screens or in the admin screens, or ... It comes down to how much time they can afford to spend on release testing for the OSS edition. They have tested the main release extensively, and have tested the patches too, but haven't had/made time to roll together a new full release and explici…