Magento 2.x Feature Requests and Improvements

A mode of operation of a block cipher is an algorithm that describes how to repeatedly apply a cipher's single-block operation to securely transform amounts of data larger than a block. Some of the modes of operation include Electronic Codebook (ECB), Cipher Block Chaining (CBC), and Cipher Feedback (CFB). ECB mode is inherently weak, as it results in the same ciphertext for identical blocks of plaintext. CBC mode is the superior choice as it does not have this weakness.Messaege encrypted with weak cryptography algorithm can be decrypted via brute-force attacks. 1. Use a strong mode of operation like CBC instead of ECB. 2. Use any authenticated encryption mode, such as GCM, EAX or OCB. For more information refer: https://www.owasp.org/index.php/Testing_for_Weak_Encryption_(OTG-CRYPST-004) Ex :   $mode = MCRYPT_MODE_ECB   $mode = MCRYPT_MODE_ECB, $initVector = false ) { if (true === $initVector) { // @codingStandardsIgnoreStart $handle = @mcrypt_module_open($cipher, '', $mode, ''); } traced in vendor\magento\framework\Encryption\Crypt.php Line: 57 and few other vendor files. CWE Code : CWE-327   ... View more

The software may use insufficiently random numbers or values in a security context that depends on unpredictable numbers.When software generates predictable values in a context requiring unpredictability, it may be possible for an attacker to guess the next value that will be generated, and use this guess to impersonate another user or access sensitive information. 1. java.security.SecureRandom should be used instead of java.util.Random 2.Use Cryptographically secure generators that are strongly believed to be very difficult to predict. ex : var rand10 = Math.random().toString().substr(2, 10);   this.boundary = '------RWWorkerFormDataBoundary' + Math.random().toString(36); Math.random() code traced in \lib\web\FormData.js (Line:46) and few other vendor files.   CWE Code : CWE-676 ... View more

The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information.Attacker may be able to break the algorithm and compromise whatever data has been protected that may result in the exposure of sensitive information. 1.Do not develop custom or private cryptographic algorithms. 2.Ensure that you use a strong, modern cryptographic algorithm. Use at least AES-128 or RSA-2048. For more information refer: http://wiki.scap.org.cn/cwe/en/definition/327 ex : $sha1Sum = sha1($contents);   $cacheKey = sha1($routePath . $this->serializer->serialize($cachedParams)); if (!isset($this->cacheUrl[$cacheKey])) { $this->cacheUrl[$cacheKey] = $this->getUrlModifier()->execute( $this->createUrl($routePath, $routeParams) ); } in vendor\magento\framework\Url.php (Line:870) file, SHA1 used. We can use the modern crypto algorithm. CWE Code : CWE-327 ... View more

Password or key management issues occur when a password or key is stored in plaintext in an application's properties or configuration file. A programmer can attempt to remedy the password or key management problem by obscuring the password or key with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password or key. Attacker can easily gain access to the system by breaking encryption.   Example : $user_pass = base64_encode($auth_username . ":" . $auth_password);   $user_pass = base64_encode traced in vendor\magento\framework\HTTP\Client\Curl.php (Line Number-173) and few other vendor files.   public function setCredentials($login, $pass) { $val = base64_encode("{$login}:{$pass}"); $this->addHeader("Authorization", "Basic {$val}"); } and in the file path : vendor\magento\framework\HTTP\Client\Socket.php (Line : 179)   public function setCredentials($login, $pass) { $val = base64_encode("{$login}:{$pass}"); $this->addHeader("Authorization", "Basic {$val}"); }   CWE Code : CWE-261 ... View more

Feature request from snky1987, posted on GitHub Jan 05, 2015 When I was in a sample category (201) and changed store group in a footer I received 404 error (which is correct). I think it may be useful to reset view into main view when change store group (unless there is a option to show different products under the same category depends on store group). It's not a bug but I am 99% sure that it will come back as an issue to any agency that set up Magento multi-store. ... View more

This is more of a general request to install the Magerun command (https://github.com/netz98/n98-magerun2) on every cloud install. Even though the bin/magento has opened a new "life" of CLI tooling, Magerun offers more and better commands for everyday debugging and QOL for developers. I strongly urge Adobe to consider this going forward. ... View more

Feature request from navarr, posted on GitHub Feb 05, 2015 Suggested Labels: feature request, up for grabs Request Autocomplete is a web technology implemented in Chrome that enables very speedy entry of a customers credit card details, addresses, and more. It is very simple to implement, and would be a general improvement to Magento in all forms. More information: HTML5 Rocks page HTLM5 Rocks Demo Store (check it out!) Firefox browser implementation bug Previous Art: Magento1 Extension by the Chromium team ... View more

Feature request from seansan, posted on GitHub Mar 17, 2015 When one build up product reviews and a second store is opened. Then the product reviews are not enabled (selected from scope list) in the second store. This can be done manually, review per review. There should be a method to mass update product reviews to enable them in other store views. Some more information here http://magento.stackexchange.com/questions/55716/sql-to-make-product-reviews-available-in-other-store ... View more

Feature request from seansan, posted on GitHub Mar 17, 2015 It should ne able to pre-select a layered navigation filter for a category: meaning, that when opening the category page, then a layered navigation filter is already applied Suppose you sell shoes (configurable product) and you have a category stating to show all shoes in size 10 you would then create a normal shoe category (select all shoe products) then selected the (new setting) for a layered navigation pre-select filter for size 10 this way only shoes available in size 10 are shown http://magento.stackexchange.com/questions/55191/magento-set-selected-filter-in-layered-navigation ... View more

Feature request from fooman, posted on GitHub May 07, 2015 Custom Totals are a great feature of Magento. I do believe we can improve their implementation and reduce overall complexity by keeping custom totals in separate dedicated database tables similar to how we store line items. With the current structure to add a new custom total to cover base and order currency plus tax, at my last count, one has to add: 1.) 13 columns to table sales/order 2.) 4 columns to sales/invoice 3.) 4 columns to sales/creditmemo Not everyone gets this right including for example Enterprise custom totals: getData('base_' . $code) vs. sales/order::gw_card_base_price_invoiced I believe if we had the following tables sales/order_totals sales/order_invoice_totals sales/order_creditmemo_totals with the following columns: total_id parent_id code amount base_amount tax_amount base_tax_amount calculation_order and additionally for the sales/order_totals table description amount_invoiced base_amount_invoiced amount_refunded base_amount_refunded tax_amount_invoiced base_tax_amount_invoiced tax_amount_refunded base_tax_amount_refunded this would help a lot with the aim to a.) remove duplication of efforts (every custom total shouldn't need to add all these columns) b.) take away complexity of having to set up the database to reduce chances for errors Additionally to keep track of tax I think these should be linked through to the same table that we use to keep track of taxed items to allow for multiple taxes on the totals (and be able to reconstruct this later). If we don't link to the tax table we should at least add tax_percentage . ... View more

Feature request from chrom, posted on GitHub May 26, 2015 extend global product search through search the pages of the blog (CMS page) ... View more

We used Magento Queue support extensively in our project, we even created a connector to use Amazon SQS instead of RabbitMQ (I intend to share it with the community soon).   During a process of improving the performance of our consumer jobs, I found that the native  message queue module uses MySQL to manage the lock of messages, which ends up competing with the IO of the other calls to the database. As we have a very high volume of messages processed per minute (+ 15k messages), the database ends up being unnecessarily overloaded with this native lock approach.   As Magento already provides native support for using ZooKeeper to control the locking of cronjobs processes, it would be very interesting if this feature were also made available to Message Queue, reducing the unnecessary usage of MySQL database.   ... View more

Feature request from seansan, posted on GitHub Jul 25, 2015 Request for ability to add new cart rule action - type cart id Now it is not possible to give a discount on the FIRST item only For instance we have a deal: the first T-shirt with 50% off ... (as a try out) If the cart ID can be used in a rule action then this is possible Concrete: please add cart id as a new rule type ... View more

Feature request from chasteIT, posted on GitHub Sep 03, 2015 Filtering items in grouped product grids using the attributes of their associated simple products could allow users to select options to find their desired simple products similar to configurable product selectors, but it would also allow the store owner to display all of the available simple products initially. For example, a Grouped Product could contain TVs of brand Samsung, Vizio and LG available in sizes 50, 55 and 60 inches. Upon entering the page, the customer could see the grid of products and their varying brands, sizes and prices. The customer could then select options in a dropdown filter to only show their desired brand and size. A sorting feature for the initial grid would also be cool. Edit: I found Magneto extension, Grouped Products Filter, which does this exactly. Here is the demo. ... View more

Feature request from markoshust, posted on GitHub Sep 10, 2015 The customer id (entity_id) should be included in the customers export for referential checks & database/SQL update capabilities ... View more

Feature request from markoshust, posted on GitHub Sep 10, 2015 The customer id should be included in customer addresses export for referential check capabilities ... View more

Feature request from CRYX2, posted on GitHub Sep 18, 2015 Hello, i'm currently testing 1.0 beta and I think who all the textarea of block could be improved with a Syntax Highlighter like CodeMirror or Ace Editor. it would be a big improvement that should not take away too much work. ... View more

Feature request from markoshust, posted on GitHub Oct 24, 2015 The ./bin/magento CLI tool contains the command admin:user:create . It would be very helpful to add another command admin:user:update , which would allow the user to update the admin password. This comes up a lot when taking over development for projects from other companies, and/or just needing a quick way to change the admin password to access the site. The same directives should probably be used from admin:user:create . ... View more

Feature request from owenhaynes, posted on GitHub Oct 25, 2015 At the moment the json API is not very compliant to http://jsonapi.org. This makes life hard when trying to use the magento API with angluarjs modules such as rectangular, angualr-restmod. I can imagine this is a lot of work. ... View more