CubeCart Hints & Tips
News from CubeCart Hints & Tips
CubeCart is an open source shopping cart used by a great many small and medium sized retailers, and it has changed a lot over its last few releases. The articles in this category are written for store owners rather than developers. They explain what each release actually changes, how to configure the features that are most often set up badly, and what to check before and after an upgrade.
Recent subjects include the CubeCart 6.6 and 6.7 releases, two-factor authentication and Argon2id password hashing, accurate shipping rates with box packing and All In One Shipping, customer groups for running trade and retail pricing from one store, abandoned cart recovery, the sales reports, the REST API and scheduled tasks.
If you are new to CubeCart, the CubeCart tutorials are a good place to start, and our CubeCart plugins pages describe the extensions we build ourselves. Stores on our CubeCart hosting can raise any CubeCart question as a support ticket.
What to Check Before You Install a CubeCart Plugin
Plugins are the right way to extend CubeCart, but not every plugin is a safe bet. The checks worth making before you install one on a live store.
CubeCart 6.8.2 and 6.8.3: When the Invoice Disagrees
Three CubeCart maintenance releases in eleven days, none with a security fix, but two of them correct invoices that disagreed with what the customer actually paid. Which orders to check, what else changed, and how urgently to take them.
CubeCart Security Releases: What 6.7.3, 6.7.5 and 6.7.6 Fixed
Ten responsibly disclosed vulnerabilities were fixed across three CubeCart releases, including one rated CVSS 9.0. Here is what was found, and why authenticated-only is less reassuring than it sounds.
CubeCart 6.8.1: The Fix Tax-Inclusive Stores Need
CubeCart 6.8.1 is a maintenance release, but one fix matters urgently to stores working in tax-inclusive prices: opening and saving an order in the admin panel could quietly inflate it. Which orders to check, plus bulk quantities, better search and two Atrium fixes.
CubeCart Right of Withdrawal: A Built-In Cancellation Workflow
UK and EU distance selling rules give customers a cooling off period. CubeCart 6.7.4 added a proper request workflow with states, automatic acknowledgements and an audit trail.
CubeCart 6.7.4: Right of Withdrawal, CLI Cron and a Refactored REST API
CubeCart 6.7.4 added a statutory cancellation workflow for UK and EU merchants, a proper command line cron runner, and gzip compression of order baskets.
Magecart Attacks: How Card Skimming Works and How to Stop It
Magecart injects JavaScript into your checkout to copy card details as customers type. The shop keeps working, the order completes, and nothing looks broken. Here is how it gets in and what actually reduces the risk.
The CubeCart Image Picker Rewrite: Small Change, Big Time Saving
One shared image component everywhere, image search across the file manager, per-option product images, and uploads that select themselves. Plus the protective htaccess worth checking after a migration.
CubeCart Audit, Request and Error Logs: Knowing What Your Store Did
CubeCart now records every admin action with actor, IP and a diff, logs outbound HTTP calls, and deduplicates error rows so the log is actually readable.
CubeCart Email Overhaul: Async Sending, Open Tracking and Template Preview
CubeCart email now sends asynchronously via cron, tracks opens, and generates plain text automatically. It also shipped with a bug that sent blank order confirmations, fixed in 6.7.2.