SuiteCommerce & SCA 2019.2.x Patch Roundup: File Cabinet Security Fix, SS2 SSP Deployment, and Bug Fixes

NetSuite shipped five minor releases under the 2019.2 branch (2019.2.1 through 2019.2.5) targeting SuiteCommerce (SC) and SuiteCommerce Advanced (SCA). Most are storefront bug fixes, but several carry real implications for developers, admins, and anyone managing file cabinet security or bundle deployments.

Critical: File Cabinet Permissions Bug (2019.2.3)

A deployment of SC or SCA could incorrectly mark all files in the file cabinet as Available Without Login. If you deployed SC/SCA on or after 2019.2.2 and before 2019.2.3, audit your file cabinet immediately. Files that should be login-protected (custom scripts, templates, CSVs) may have been exposed to anonymous access.

SS2 SSP Deployment Fix (2019.2.3)

The SuiteCommerce bundle installation script was updated to correctly deploy the SS2 SSP application to the same domains/sites as the legacy SSP application. This was broken in 2019.2.2. If you installed the SC bundle during that window, verify that your SS2 SSP application records are deployed to the correct website/domain entries under Setup > SuiteCommerce Advanced > SSP Applications.

APM Data Collection Now Always On (2019.2.3)

Application Performance Management (APM) data collection is now enabled for SC and SCA regardless of whether the SuiteCommerce Real User Monitoring feature is toggled on the Enable Features page. Previously, disabling the feature also stopped APM telemetry. This change means Oracle collects performance data from your storefront even if you have the feature disabled. There is no opt-out mechanism documented.

Duplicate Shipping Address Regression (2019.2.3 → 2019.2.3.a)

Version 2019.2.3 introduced a fix for duplicate customer/lead shipping addresses created when a new user registers on a One Page Checkout site with Billing Address Same as Shipping Address selected. The fix wrote duplicates to both the website session and the customer record. However, the fix was rolled back in 2019.2.3.a due to side effects. If you are on 2019.2.3 specifically, expect the duplicate address bug to persist until a later patch.

Developer Tooling: gulp local Error (2019.2.3)

A console error when running gulp local with the core SCA developer tools was fixed:

jQuery.Deferred exception: generator.childViewInstance.getContextDataRequest is not a function TypeError

This affected local development builds. If you pinned your dev tools to work around this, you can remove the workaround after updating to 2019.2.3+.

SuiteScript Search API Errors (2019.2.2)

Two nlobjSearch* errors surfaced in the storefront layer and were fixed:

• Auto-apply SuitePromotions on quote requests threw: An nlobjSearchFilter contains an invalid operator, or is not in proper syntax: internalid. This was a server-side SuiteScript 1.0 search filter bug in the promotion engine.
• Invoice details page (SCA only) threw: An nlobjSearchColumn contains an invalid column, or is not in proper syntax: ccexpdate. The ccexpdate column was being referenced on the invoice record where it does not exist or was removed.

Other Notable Fixes by Version

2019.2.5 (SCA Only)

• Quote Detail page orders redirected to Thank You page instead of External Payment page.
• Enabling the Payment Instruments feature caused blank My Account and Checkout pages.
• Cash sales via SuiteCommerce InStore not appearing in Purchase History.
• cartView event not firing in the Google Tag Manager data layer when using the Criteo service.

2019.2.4

• Password reset redirect loop: the reset link briefly showed the Reset Password page then immediately redirected to Log In.
• Order quantity exceeding availability showed a generic error instead of a corrective message.
• Return Authorizations failed with Error: The minimum quantity for this item is x when the item record had a minimum quantity set.
• Editing multiple item options on the PDP threw a generic "problem with this Item" error.

2019.2.3.a

• SEO tags (canonical URL, meta description, meta keywords, title) missing entirely for a site.
• Site search required multiple clicks to select a result.
• Google Analytics tags missing on first page load when using the SC Google Tag Manager extension.
• Default shipping address could not be selected during Checkout.

2019.2.2

• Twitter Bootstrap Sass updated to 3.4.1 (addresses upstream XSS fix in Bootstrap 3.4.x).
• Removed redundant Development folder from SCA 2019.1 bundle.
• See More link removed from PDP in the Base Theme — if you extended the Base Theme, you must manually remove this link from your custom theme.
• Guest checkout broken in Firefox Private Window mode.
• Analytics Blockers not functioning with Google Universal Analytics.
• Google AdWords &gclid parameter stripped from URLs.
• SCA 2019.1 Development SSP folder relocated outside expected path on bundle install, causing Web Store Page Not Found.

2019.2.1

• Translation issues on My Account and Checkout pages.
• Home page URL parameters stripped.
• Incorrect shipping cost on Sales Orders.
• Return Authorization allowed returning more items than the fulfilled quantity.

What to Do

1. Audit file cabinet permissions. If you deployed SC/SCA between 2019.2.2 and 2019.2.3, run a saved search on the file record filtering on availablewithoutlogin = T and review unexpected matches. Correct any files that should not be publicly accessible.
2. Verify SS2 SSP deployment targets. If you installed the SC bundle during 2019.2.2, check that your SS2 SSP application is deployed to the correct domains under Setup > SuiteCommerce Advanced > SSP Applications.
3. Check your theme for the removed See More link. If you extended the SuiteCommerce Base Theme, the See More link on PDP was removed in 2019.2.2. Custom themes built on top of it must remove the link manually.
4. Review APM telemetry expectations. APM data is now always collected. If your organization has data-governance requirements around telemetry, note that disabling the Real User Monitoring feature no longer stops data collection.
5. Update local dev tools. If you applied workarounds for the gulp local jQuery.Deferred error, remove them after updating to 2019.2.3+.
6. Test Return Authorizations. If you have items with minimum quantity constraints, verify that returns process correctly after patching to 2019.2.4+.