interblue.pl/.paul/codebase/concerns.md

Codebase Concerns

Analysis Date: 2026-04-27

Tech Debt

Override Chain Fragility — Order Processing:

• Issue: Three modules (modrefchange, AddOrderExtraFields, x13allegro) all modify Order class through overlapping overrides
• Files: override/classes/order/Order.php, modules/modrefchange/override/classes/order/Order.php, modules/AddOrderExtraFields/_overrides/classes/order/Order-modrefchange.php
• Why: Each module added override independently without documentation of interdependencies
• Impact: Hook execution order undocumented; disabling modrefchange orphans hooks; AddOrderExtraFields install copies override file (fragile)
• Fix approach: Document hook execution order, add comments to override file explaining all contributing modules

Payment Module Logic Bug:

• Issue: Operator precedence bug in order source detection
• Files: modules/AddOrderExtraFields/override/classes/PaymentModule.php (line ~350)
• Code: if (!$order->module == 'x13allegro') — evaluates as !(false) == 'x13allegro' not as intended
• Impact: Order source may be incorrectly set in edge cases
• Fix approach: Change to if ($order->module !== 'x13allegro')

One-Page Checkout Controller Duplication:

• Issue: override/controllers/front/OrderController.php (root, 653 lines) and modules/onepagecheckoutps/public/override/controllers/front/OrderController.php both exist; PS loads root override only
• Files: override/controllers/front/OrderController.php, modules/onepagecheckoutps/public/override/controllers/front/OrderController.php
• Impact: Module override is silently ignored; confusion when updating module
• Fix approach: Document that root override is authoritative; remove or flag module copy

Known Bugs

Die() Calls in Empikmarketplace:

• Symptoms: Admin pages may crash without user-friendly error
• Files: modules/empikmarketplace/controllers/admin/AdminEmpikOffersController.php, modules/empikmarketplace/controllers/admin/AdminEmpikProductsController.php, modules/empikmarketplace/controllers/front/cron.php
• Workaround: None — admin must retry operation
• Root cause: Missing try/catch and error recovery in module controllers

Dev Mode IP Hardcoded:

• Symptoms: Debug mode silently enabled for traffic from specific IP
• Files: config/defines.inc.php (line 28)
• Risk: Exposes debug info if that IP is compromised or reused
• Fix: Move dev detection to environment variable or remove entirely

Security Considerations

Dispatcher URL Parsing — Potential Injection:

• Risk: Regex in override/classes/Dispatcher.php (line 69) parses raw $_GET without sanitization
• Files: override/classes/Dispatcher.php
• Current mitigation: PrestaShop built-in URL sanitization may catch most cases
• Recommendations: Audit regex patterns, validate extracted values before use

Admin Path Obfuscation Only:

• Risk: admin658c34/ relies on obscurity alone (no 2FA, IP restriction visible)
• Files: admin658c34/
• Current mitigation: Randomized folder name
• Recommendations: Enable 2FA if supported, IP-restrict admin if hosting allows

Order Source Enum Hardcoded:

• Risk: order_source enum in ps_orders only allows ('Allegro', 'Sklep int.', 'Telefonicznie') — new order sources require DB migration
• Files: modules/AddOrderExtraFields/AddOrderExtraFields.php
• Recommendations: Consider VARCHAR with application-level validation instead of enum

Performance Bottlenecks

Empikmarketplace Admin Views:

• Problem: Module overrides admin product catalog list views with custom Twig templates
• Files: modules/empikmarketplace/views/PrestaShop/Admin/Product/CatalogPage/Lists/list.html.twig, products_table.html.twig
• Impact: Admin product list may be slower or behave unexpectedly after empikmarketplace updates
• Improvement: Keep module updated; test after each module upgrade

No Indexes on Custom Feature Tab:

• Problem: ps_custom_feature_tab has no index on id_feature or id_feature_value
• Files: modules/customfeaturetab/customfeaturetab.php (table creation SQL)
• Impact: Slow queries when many products loaded (full table scan per product)
• Fix: ALTER TABLE ps_custom_feature_tab ADD INDEX (id_feature, id_feature_value)

Fragile Areas

Override Load Order:

• Files: All files in override/classes/ and override/controllers/
• Why fragile: PrestaShop loads overrides alphabetically; installing new modules with overlapping overrides can silently fail or corrupt class index
• Safe modification: Always clear var/cache/*/class_index.php after adding/modifying overrides
• Test coverage: None

Hook System Intercept (cookiesplus):

• Files: override/classes/Hook.php
• Why fragile: cookiesplus intercepts ALL hook execution for GDPR consent; if module corrupts its config, hooks may silently fail site-wide
• Common failure: Module misconfiguration blocks legitimate module output
• Safe modification: Test in staging if possible before enabling

Scaling Limits

PrestaShop 1.7.x End of Life:

• Current capacity: Working for current traffic
• Risk: No official security patches available for 1.7.x
• Impact: Accumulating unpatched vulnerabilities in core and 45+ vendor dependencies
• Scaling path: Plan migration to PrestaShop 8.x (significant effort)

No CI/CD — Manual FTP Deployment:

• Current: Changes deployed manually via FTP from VSCode
• Risk: Human error, no rollback mechanism, no pre-deploy validation
• Impact: Broken deployments require manual FTP rollback

Dependencies at Risk

PrestaShop 1.7.x:

• Risk: End of life — no more security fixes
• Impact: All custom modules, theme, overrides would need migration
• Migration plan: PrestaShop 8.x upgrade (breaking changes in module APIs)

x13allegro (Allegro API):

• Risk: Allegro REST API versioning — module may need updates when API changes
• Impact: Allegro order sync breaks if module not updated
• Migration plan: Keep module updated; monitor x13.pl module updates

onepagecheckoutps (v1.0.1):

• Risk: Old version, complex OrderController override (653 lines)
• Impact: Checkout flow breaks on PS updates
• Migration plan: Test and update before any PS core updates

Missing Critical Features

No Automated Testing:

• Problem: Zero automated tests for custom modules
• Blocks: Confidence in refactoring, PS upgrade path verification
• Implementation complexity: Medium (PHPUnit setup per module)

No Staging Environment:

• Problem: Changes go directly to production
• Current workaround: Test manually in production during low-traffic hours
• Blocks: Safe testing of marketplace integrations, checkout changes
• Implementation complexity: Medium (duplicate hosting setup)

No Rollback Mechanism:

• Problem: No automated rollback for failed deployments
• Current workaround: Restore via FTP from backup
• Blocks: Confidence in deploying risky changes

Database Design Issues

utf8 vs utf8mb4:

• Files: modules/customfeaturetab/customfeaturetab.php (CREATE TABLE uses utf8)
• Risk: Cannot store 4-byte Unicode characters (some emoji, rare CJK)
• Fix: Migrate custom tables to utf8mb4 charset

---

Concerns audit: 2026-04-27 Update as issues are fixed or new ones discovered