Issue
A cookie that keeps a customer logged when they revisit the site could possibly be modified which may give another user the opportunity to access another customer account.

This security issue will not give someone access to any payment or credit card details because that information is not saved in the data. It also does not effect admin access.

Fix
Download the zip file below for the version of Photo Cart you are using to your computer and unzip it.

Upload the included files (pc_head.php, pc_login.php, pc_login_page.php) into your Photo Cart folder (whatever the name of that folder is) on your website overwriting the existing ones.

You can upload these files either with the File Manager in your hosting control panel or with your FTP program.

Photo Cart 7 Files:
https://www.picturespro.com/sy-misc/download/Photo-Cart-7-Security-Patch-2018-c.zip

Photo Cart 6 Files:
https://www.picturespro.com/sy-misc/download/Photo-Cart-6-Security-Patch-2018-B.zip

Edited Fri Apr 27, 18 5:19 AM by Tim - PicturesPro.com

Receiving these errors after uploading the files on Photocart 7:

removed

Edited Mon Sep 24, 18 3:23 AM by Tim - PicturesPro.com

The error means you are missing a file.

Download this zip file:
https://www.picturespro.com/sy-misc/download/Photo-Cart-mobile.detect.zip

Unzip it and upload the included file it into your photocart -> pc_inc folder.

Edited by

That worked, thank you!

Edited by

Hi,

I got an email about this from Brian, have had Photocart 4.1 and went ahead and upgraded to 7.1 with the patch installed. Everything seemed to go fine in the admin, but when I go to look at a gallery or the homepage, I just get a blank screen. Any idea what might be causing this?

My Photocart is here:

http://rwphotography.com/photocart/

I did adjust the page width, which was causing an error message in the admin Customize Theme page, put it at 95% as it was just showing a number without "px" or a "%". That was the only thing I can find that is looking like a problem in the Admin.

Update Edit: I saw another post in this forum describing the problem I'm experiencing. However, that post indicated it was an issue with the older Photocart versions and new PHP versions, and the solution was upgrading to Photocart 7.1, which is what I did that seemed to cause the problem. (Just for reference, the PHP version for my website is 4.4.9) Could this still be a PHP version issue?

Edited Wed Apr 25, 18 11:34 PM by Robert Welch

Robert, you should have the PHP version updated to PHP 5 (5.4)

Kristi see my post about for the download of the mobile.detect.zip

Edited by

From above

The error means you are missing a file.

Download this zip file:
https://www.picturespro.com/sy-misc/download/Photo-Cart-mobile.detect.zip

Unzip it and upload the included file it into your photocart -> pc_inc folder.

Edited by

Never mind, I got it, I finally saw the missing file and uploaded it.... It was not included in the original download....

Thank you

Edited by

Tim,

Thank you for your help. I just called my host company and they said I had to upgrade my account to get the PHP updated. Funny thing is, the new account is less expensive than the account I had! I've had my account so long I was paying older prices that were more expensive I guess...

Anyway, hope to get the upgrade completed and get everything transferred over this evening. They said I can upgrade all the way to PHP 7.1 with this new account, so I guess that will allow me any future updates if I want to move to Stylus in the future perhaps?

Thanks again, I'm very appreciative of all that you and your friends have done with this software, you guys are the best!

Edited by

Robert, for Photo Cart the PHP version will need to stay on PHP 5. Photo Cart is not compatible with PHP 7. Sytist is though.

Edited by

Tim,

Thanks, it looks like it will be a lot of hassle to get this Photocart transferred over. I'm looking into getting someone to help, and by the time I do I will have probably spent about enough to buy Sylist and start over. That would probably be a good thing to do anyway, I have a lot of old stuff on the website and I could just use Stylist as a website homepage instead of my old HTML. Should I just upgrade the PHP to 7 before installing Stylist?

Edited by

It wouldn't be necessary to update the PHP to 7 before installing. But it would need to be at least PHP 5.4.

Edited by

To follow up, I did get Sytist and am very happy with it. I was a happy user of Photocart for many years, it more than paid for itself and I had no issues with spending the money for the new software and had no issues installing it. I didn't try to transfer any user data info from Photocart as I had so many old and "fake" accounts loaded into that system, I figured it was best to start over and just let new clients start new accounts. I like the new software, it has so many nice aspects that I didn't realize how much I would appreciate. Photocart was fine software, but I can see why it had to be updated and how much of an improvement there is in the new software.

Edited by

I have photocart 7, I uploaded the files and overwrited the old ones. But my website is still showing it to be "Not Secure". What do I need to do to fix this? Thank you for your help!

Edited by

That message has nothing to do with the security patch. That means you don't have a SSL / Security Certificate on your website. You can contact your host about getting a SSL.

Edited by

Thank you Tim for the info. I have contacted my webhost and have a SSL certificate now. They were able to add it to my wordpress blog, but they could not tell me how to get HTTPS for photocart. Where would I find info about this?

Edited by

They should be able to force the httpS on all of your pages with the .htaccess file in your main website folder. Here is info on that:
https://www.google.com/search?q=force+https+htaccess

Edited by

Thank you Tim. I'm on the phone with bluehost as I write. The tech has told me there is no https access for bluehost to create a redirect to https.
What should I do?

Edited by

Sounds like you need to talk to a different tech support there. You can send them this link:
https://www.google.com/search?q=force+https+htaccess

Edited by