magicpowers

@omarfpg

thanks! keep up the good work!

hi @rodelgc

Ok, I get that. Thanks. A couple of final points:

I do realize that it could come across as concealing a minor tweak.
no, that’s the other way around. The major update was “hidden” i.e. was not visible, in the minor tweak.

WooCommerce 9.3 was never set as the stable version.

This may be so, but your plugin users other than developers and webmasters did not have this information. I don’t visit github every day or read every plugin’s update release notes. I have no time for that nor interest. I manually update my plugins once I receive an alert notification that an update is available, check the update details in the plugin changelog to determine whether I need to update it on my staging site first to pick up any potential conflicts, and fully rely on the information provided there.

I’m aware that it is not unusual for a major update to skip few versions as they often incorporate minor tweaks, patches etc. However, I have never seen before a minor update that includes a major update without any information about it in the update details, especially when the major update has modified 919 files which is very likely to be picked up by the users’ security plugins.

If you included this information in the changelog accessible via the plugin update link (learn more about this update), there would be no issue raising the red flag – how the heck a minor tweak has modified 919 files on my computer.

Communication is key. And also, it would be very helpful if you could please keep in mind your plugin’s regular users who don’t live in GitHub and rely on the information provided in the changelog linked to the updates.

thanks

Hi @ckadenge

OK, I finally found the problem.
I can see in your changelog on github that there was indeed a major update 9.3.0 released on Sep 10 – simply titled “Woocommerce” – involving changes to a large number of files.

That major update followed a minor update 9.2.3 released on Aug 26 – so there was a jump from 9.2.3 to 9.3.0.

That major update was followed two days later on Sep 12 by a minor update 9.3.1 titled: Tweak – Disable remote logging feature by default.

Here is the problem: I did NOT receive an alert to update Woocommerce to 9.3.0.

I received an alert: The Plugin “Woocommerce” needs an upgrade (9.2.3 ->9.3.1) – which clearly included the major update. – but that’s not the proper way of releasing a major update, concealed in the subsequent minor tweak. I can send you a screenshot of this email as a proof, if you claim that the major update 9.3.0 was altered to separately.

The update 9.3.1 is a Tweak which should not have modified over 900 Woocommerce files, and so naturally this has raised a red flag for me.

Now – if the major update did alert the users separately and I didn’t receive that email alert, then there is a problem with my email alerts, either by WordPress or the Wordfence plugin.

Could you please confirm whether the major update alert was issued to users separately or whether you postponed it and clumped together with the update to 9.3.1.

I will investigate this further depending on your reply, as I don’t like this sort of surprises and will always investigate all suspicious activity on my website.

thanks

Hi @ckadenge

Thanks for your reply.

While I understand that a plugin update usually involves file modifications, but I have a problem with your explanation in this scenario.

A simple update – ” a tweak to prevent remote login” – as per your description – surely would not modify 919 files which were all woocommerse files with all possible type you can think of – php, css, js, json, pot – of I think every single element of the plugin. This is not a typo – nine-hundred nineteen files have been modified. I’m not a developer but have sufficient understanding of plugin updates to know the difference between a TWEAK and a MAJOR UPDATE.

So – either something went very wrong with this ” tweak” update you are not telling me, OR this was in fact a major update which was not disclosed.

I don’t worry about few modified files in the plugin update, but this number of files with all possible types and for every single element of the plugin not related to the login process (like assets, product images, product tags, upsell etc) is not warranted and can’t be explained by this tweak update.

Could you please explain what has really happened.

@macmanx

thank you!

@shameemreza

Good Lord!! – THANK YOU!

yes, it worked. Phew.

@ckadenge

I just realised that the second error message is about another plugin, not WooCommerce.
This means that the issue is most likely somewhere else.

I have also reached out to my host for assistance.
will keep you posted.

hi @ckadenge

These are the screenshots. One of the cart – visible to the public, I tested it on my phone where I am not logged into my Admin, and another one showing an error once I put my website in the maintenance mode.

https://ibb.co/HYgRyFx
https://ibb.co/MkN8C14

I need to get rid of them asap.
I have rolled back WooCommerce to 9.0 – these errors are still there.

https://quickforget.com/s/f2077d71968e3d8856e9206c704bbcc634df2a6693e41a9d

WC-Info

Please hurry – you don’t have much time left.

thanks

hi @ckadenge

This is not my cart. I don’t sell headphones, and my products are in AUD not in the strange currency I don’t even recognise.
secondly, as I said I had to put my website under construction, so you can’t see the cart.

How can I insert here a screenshot here? I can’t post it from my computer.

Thirdly, I can provide the status log but not here on a public forum. To much security risk. Please give me your email address I will send it to you.

I have rolled WC back to 9.0.0 – and these error messages are still there!

What has happened? I always check my store after each update – and didn’t see that error message until today.

Please advise ASAP how to remove them – the other one about my maintenance mode is also still there — as I my website is hidden from the public.

I can’t attached here the screenshots to show you – so please give me your direct email where I could send them, if you need to see them.

@ckadenge

I did create a new topic. You will see it in the recent posts.

@carolm29

You said you have not had any other error reports? well here is one from me

This update created error messages about deprecated lines in php etc etc on the cart page which is visible in the public view , which I cannot remove and which I have no clue what to do about!!

I had to put my website in the maintenance mode until this is resolved. As soon as I did – There is yet another error message about some unresolved lines in the maintenance mode.

This update is clearly creating a lot of issues , looks like it hasn’t been properly tested.

I’m now rolling it back to the previous version until you release a corrected update.

Can you please reply ASAP.

• This reply was modified 3 months, 1 week ago by magicpowers.

hi
thanks for your reply. Well, I finally found the cause.

I realised that your plugin worked perfectly for a long time until I migrated my website to another host few months ago.
When I reached out to them, it turned out that the WP Toolkit in my cpanel (which I never turned on or even looked at) had the Smart Updates toggle ON which overrides any other updates settings.
They toggled it off so it will not interfere with my settings in your plugin anymore.

I’m not happy that WP Toolkit was activated on my website without my knowledge or approval, but that’s a separate issue.

My apology for blaming your plugin for this misbehavior.

Thanks for your support.

Update – since the plugin settings work on my staging site but are bypassed on my production site – I am investigating whether my website host is enforcing WordPress updates bypassing your plugin.

hi @anastas10s

thanks for your reply. I’d like to address your points.

1. As I said, the issue was not just the email, but also the download links in the checkout did not work. When clicked in the checkout, the links opened a blank page with the error message I have quoted.
2. I have configured my downloads correctly – with the ONLY way I can use with my current website host. I tested all the download links and they worked perfectly with the correct configuration
3. Your colleague said I need to backup my WC store. You are talking about updating my WC plugin to the current version and backing up the whole site. To “back up” is not the same as to “update”. Backing up my whole site is a different issue. My question was – how can I back up my WC store separately – as this is what your colleague has implied.
4. My staging site is created on the same server as a clone of my production site. It is connected to the internet and receives plugin and WP updates. It shares the database with the production site, I believe (would need to check with my host). I keep it permanently in the Maintenance mode so that it can’t be accessed by the public. My point however was about the WooCommerce database. I don’t know whether it is separate to my site database or a part of it. Either way, updating the WC DATABASE (not my website database, and not the plugin!) on STAGING will not be the same as the database update I will run on the production site. These two databases are not connected and can behave differently. They also have different content as I don’t keep my staging store and products up to date necessarily.
5. Regarding the recommended WC Update Manager – I don’t allow auto updates of any plugins not even my WordPress.
6. The tool you suggest to test my WC on staging will not do what I need to test – inbound orders, purchase, payments etc. I can’t test this on my staging site.

*** Speaking of updates – there is yet another issue.
My current WC version is 8.8.3. Today I received a WordPress notification email saying that
* The Plugin “WooCommerce” needs an upgrade (8.8.3 -> 8.9.0).

The problem is that there is NO OPTION to update the plugin on my plugins page.
My updates are working fine – I have updated two other plugins today.

Could you please advise what seems to be the problem and how can I update my WC plugin. I do hope that this is not a strategy to enforce the installation of your Updates Manager as I will not do that.

thanks