AbleCommerce Shopping Cart Software

In my case still on AC7, it's still the same data, but typically years old, so 7.x revisions mainly, not sure if this is AC5 data. As my mobile apps and desktop apps for that matter use a "NC Software" account for login it gets a lot of bad password hits in the event log so who knows. Once I move in...

I've seen this in 7.0.7 and I have the Merchant inactivity set to 24 months and have been battling this issue forever. Account disabled and the user cannot reset it, requires me to reactivate and then reset the password. I see this a lot when passwords are really out of date, i.e. > 1000 days and ma...

Interesting article: http://blogs.msdn.com/b/webdev/archive/ ... temac.aspx

I don't know the steps taking, all I know is the user gets locked out and I have to go in and clear the checkbox that their account is disabled. However, I have never asked them to retry their login, they may be getting locked out and then coming to me with a store assistance e-mail. In these cases ...

Katie - can you run a test on this? Trigger an account lockout then come back to it X minutes later where X is your lockout period set in Admin. Is it supposed to remain disabled for admin action? Can the user reattempt another login or password reset? I just want to make sure this behavior is worki...

Lockout period is set to 5 minutes. I have always had to go unlock accounts for people. The "account disabled" box is checked and I have to uncheck it and I also reset their password for them at the same time. FYI - may be broke...

I want and need my store to be automated. For small companies or companies that only allow certain people to access the admin, when you lock out an account it requires human interaction to re-enable an account. It also frustrates the user. If a user exceeds the failed login attempts the account shou...

Wow! If this is true I'd deem this a critical bug and needs to roll out in R9 ASAP before holiday season approaches. Good catch!

It only affects Admin data "viewing" AFAIK so it could be processed on access to /admin

Oh yes it has :) Long long ago and many times in other forums. Logan is well aware. The reasoning I "believe" was a .NET framework issue but with .NET 4 and later support it "should" be implemented. I think the AC site is the only one that doesn't have this functionality, even lesser PHP sites have ...

Please don't clear when locked out so I can see why it's locked out. Clear on login.

Viewing the user: .../Admin/People/Users/EditUser.aspx?UserId=

All of those "right side" fields need to be tested, I'm not sure what works and what doesn't and I'm not confident they area such as:

Last Active: -
Failed Logins: 0
Last Lockout: -

I don't know if this problem continues into GOLD so I'll post it here. But when an account is locked out due to too many failed login attempts the admin has no indication of the actual reason it was locked out as the failed login attemps always shows a hyphen. Please ensure in GOLD that the counter ...

Your help doc only lists SQL Server 2012 as the max, I'd like to get the official statement on SQL Server 2014. There are query plan and other performance improvements switching to SQL 2014 Compat mode. We can use a prior compat mode but would only want to if necessary. I'm concerned mainly about NH...

Oh I love the End of Life discussion. Windows XP is EOL and no one at Microsoft uses it. However.... I digress :) For these things you guys really should consider posting the source on one of the social code sharing networks wherever as there are several. Empower your devs to work for you on these t...

I think the days have come a long way in SQL since that guidance was provided potentially. I think starting in SQL 2008 the password policy is available directly in SQL and does not require windows auth. You can use windows auth on another computer etc etc but that's beyond this topic. We have so ma...

While in my opinion WSP is something I will forever avoid and I do not consider it secure, PCI would never block it because that would block essentially all script based e-commerce carts and they can't do that. We don't run ASP for a reason any more (script based compiling) for a reason, WSP is the ...

WSE runtime is fine, I have it on Win 2008 R2 and Win 2012 R2 and use it for my legacy ASMX services still in use.

WSE runtime only is fine, I use it on Win 2008 R2 and I also have it installed on Win 2012 R2 - nothing to worry about.

1) Do you store cardholder data? (cc numbers?) 2) Is your SQL Server accessible by the Internet? (should be blocked by the firewall) BUT it's still accessible by other servers that can be accessed by the Internet so it's moot. Don't take the example as gospel, just understand what you're storing (no...

I don't think this forum is used or referenced, log your ideas at http://ablecommerce.uservoice.com/forum ... merce-gold

Not to mention the fact that you are completely out of PCI compliance running web/sql on the same physical computer.

This doesn't sound right to me either, first time I've heard this one.

What are your maintenance values set to currently? I would keep it 7 days or less.

When I first did my Gold R7 test, I forgot to "prep" the database and had an issue. Here are some ideas I've thought of since my original post. For your devs: If SQLEXPRESS -limit the maintenance, i.e. hard code maximums and don't allow unlimited storage ANY/ALL -manage maintenance in chunks, smalle...

Those smart developers can account for all of this. It's just being smarter in processing. Never rely on the user.