Sunshine Photo Cart 3.8 is now available, along with updates to 23 add-ons. The two big parts of this release are a detailed security audit of Sunshine and every add-on, and photo imports that run several times faster than they did before.
A detailed security audit, with the help of AI
If you saw the news yesterday about "PHP2Shell", the two serious flaws found in PHP itself, this release isn't a response to that. It's work I've had in progress for a while, and it just happens to land the same week. Those PHP flaws live on your web server, not in Sunshine, so it's worth asking your host to confirm they've updated PHP.
AI tools have gotten very good at reading code and finding weaknesses in it, and the people trying to break into websites are using them too. I'd much rather find those weak spots myself before someone else goes looking for them, so I did a detailed security audit of Sunshine Photo Cart and every one of its add-ons, with AI helping me look for anything that could be misused. That covered how payments are confirmed, who can see which galleries and photos, what visitors can send to your site, and what's allowed in your admin area. The fixes from it are in this release, and each one was tested before it went out.
I'm not going to list the specific issues, since not every site updates on the same day and I don't want to point anyone toward sites that haven't updated yet. In broad terms, the changes are:
- Every payment method confirms with the payment company that an order was really paid, in full, before Sunshine marks it paid.
- Gallery photos, comments and sub-galleries follow your gallery's access settings in more places, including feeds, sitemaps, sharing and favorites.
- Your original photo files are never handed to visitors, whatever image size a theme or another plugin asks for.
- Logins, gallery passwords, sharing and signups have limits on repeated attempts.
- Connecting Stripe or Square no longer passes your keys through the browser. If your store is connected to Square the old way, you'll see a notice asking you to reconnect, which takes about a minute. The Square doc walks through it.
I'll be doing this regularly from now on. As the tools for finding problems keep getting better, I want to keep using them on Sunshine first so I can stay ahead of the curve.
The most useful thing you can do is update Sunshine and all of your add-ons. Most of the add-on fixes work best alongside 3.8, so update everything together if you can.
Much faster photo imports
If you bring in a lot of photos at once, through the Bulk Galleries add-on or by importing from an FTP folder, imports are much faster in 3.8. I've significantly improved how efficiently they run, and in my own testing they ran roughly 5 to 16 times faster:
- 1,000 photos into 10 galleries went from about 4 and a half minutes to about 21 seconds.
- 3,000 photos into a single gallery went from about 17 minutes to just over a minute.
- 600 photos from an FTP folder went from about 3 and a half minutes to 35 seconds.
Your numbers will be different, because your web host makes a big difference here, but large imports should feel a lot faster on any host. Importing into a gallery that already has thousands of photos no longer slows down with every photo added, either.
To get all of it, update both Sunshine to 3.8 and Bulk Galleries to 3.3.0. If you import from cloud storage with ready-made thumbnails, Cloud Storage 3.1.9 speeds that up too.
Other improvements
A lot more went into this release, including:
- Totals add up the same everywhere. The cart, checkout and saved orders now work out discounts, tax, fees, gift cards, store credit and shipping in one place, and several discount and tax edge cases were corrected along the way.
- A new email for payment problems. You can turn on an Admin Payment Problem email to hear about declined or failed payments, payments that don't match the order, or an order marked Failed. You choose who gets it and which of those events send it. See the Emails doc for details.
- Clearer checkout messages. If an order is below the smallest amount a payment method accepts, your client is told before they try to pay. If they cancel or a payment fails on the payment company's site, they come back to checkout to try again.
- Marking an order paid by hand finishes it the same way a paid checkout does, including store credit, gift cards and the receipt email.
- Regenerating images gives each new size a new file name, so browsers stop showing old copies, and the old files are cleaned up.
- Gift Cards 3.0.7 makes a separate card for each one when a client buys more than one, and only sends a gift card once its order is paid. The Gift Cards doc covers how cards work.
- Payfast stores can now refund from the order screen. Make sure a passphrase is set in your Payfast settings, and see the Payfast doc for details.
All 19 translations were updated for this release too.
Update now
Update Sunshine and your add-ons from your WordPress dashboard the usual way. With the security work in this release, this is one I'd do today rather than next week.
Thanks for reading, and thank you for trusting Sunshine with your galleries.
