Important
This is the fifth release candidate of Shopper 3.0. Image imports and webhooks can no longer reach private addresses, and product imports download each image once, report the images that fail and end in the right status. Let your queue process the image downloads queued by rc.4 before updating.
Installation
"minimum-stability": "RC",
"prefer-stable": truecomposer require shopper/framework:^3.0.0-rcBug Fixes
- fix(core): block non-public hosts in image imports and webhooks (#685)
Product imports downloaded images with Spatie's addMediaFromUrl, which follows redirects and connects to whatever the host resolves to. An image URL in a CSV or a migrated catalog could reach loopback, the private network or a cloud metadata endpoint from the queue worker. Downloads now go through Shopper\Core\Import\ImageDownloader: http and https only, the host is resolved once and refused unless every address is in the global range, and the connection is pinned to the checked address. Redirects are followed by hand (3 at most) and checked again, the download stops past media-library.max_file_size counted on the raw bytes, and all hops share a 30 second budget.
WebhookUrl let the shared address space (100.64.0.0/10) through, including the 100.100.100.200 metadata endpoint. It now uses the same global range check.
- fix(core): download each imported image once and track it in the import batch (#686)
Re-importing a product added its images again when their URL had no extension (Unsplash, most CDNs), and two images sharing a file name in different folders kept only the first one. Imported media now record their source URL, and a URL already imported for a product is skipped. The same image repeated on every variant row is downloaded once.
Image downloads run inside the import batch, so an import finishes once its images are processed instead of being marked completed while they still download. An image that fails after 3 attempts (10 and 60 seconds apart), or at once on a 4xx response or a file the collection refuses, is listed in the import errors and the import ends as completed with errors, shown as a warning in the admin notification. image_position from the CSV sets the media order.
Imports also end in the right status in more cases: a file with only a header row completes, an unknown source or a batch that cannot be queued marks the import as failed, and on the deferred queue the import finishes and its notification is sent.
Breaking Changes
- Imported images no longer go through the
media-library.media_downloaderclass: a custom downloader is ignored for imports. - Image URLs pointing to a private, loopback, link-local, shared or reserved address are refused, except when
APP_ENV=local. Hosts are resolved over IPv4 only, so a host without an A record is refused. - Webhook URLs resolving to 100.64.0.0/10 are refused.
ProductRowImporter::import()no longer dispatches the image downloads. Code calling it directly must dispatchimageDownloads($product, $row)itself.
Upgrading
composer update "shopper/*"
php artisan queue:restartLet your workers process the DownloadProductImageJob jobs queued by rc.4 before deploying: their payloads lack the new position property and fail when they run.
Media imported before this release have no source_url, so the first re-import of a product downloads its images once more.
MEDIA_DOWNLOADER_SSL (media-library.media_downloader_ssl) is still honored. With HTTP_PROXY set in the worker environment, image downloads go through the proxy, which resolves the host itself.
The npm packages (@shopperlabs/shopper-sdk, @shopperlabs/shopper-types) have no changes in this release.
Contributors
Full Changelog: v3.0.0-rc.4...v3.0.0-rc.5