Security
JoomShopping 5.10.0 adds security checks and new APIs
JoomShopping 5.10.0 is available with security fixes for CSRF handling, uploaded and downloaded files, and stored data. The Joomla e-commerce extension also adds an addon installation API, new configuration controls, database…
Security changes
The release adds CSRF-token checks in the administrator area for configuration, addons, license keys, import and export, and users. The frontend now checks CSRF tokens when users edit their profiles or addresses.
JoomShopping also checks uploaded and downloaded product files and images, including blocked executable files and image-content validation. Addon parameters, addon configuration, shipping-method parameters, and import/export parameters are now stored as JSON. Existing data remains readable.
Stored data is deserialized safely, with only arrays and stdClass objects permitted.
New capabilities
- Automatic installation of required and dependent addons, including paid addons, with automatic license-key transfer.
- A new addon installation API with
onBeforeInstallAddonandonAfterInstallAddonevents. - The JoomShopping News system addon and new interface icons.
- A minimum delivery-days setting.
- Sorting dependent product attributes by stock availability, with separate styling for unavailable values.
- Attribute and characteristic values in the administrator product list; the default display is the first 10 values.
- Publishing and unpublishing users from the administrator area.
- PDF preview in settings, optional PDF headers and footers, and a cart warning when quantities change without updating the cart.
- New events:
ProductTable,onAfterSaveProductImage, andonAfterSaveProductFolerImage.
Other changes and fixes
Database queries for the order list and next order number have been optimized. Bulk product editing now shows active characteristic values. Button, cart, account-area, and search styles were updated, with an option to use Font Awesome icons. Simple Export now generates random export filenames.
Fixes cover administrator user blocking, account activation and registration emails, the administrator product filter, coupons, payments, deletion of unpublished products, and PHP warnings.
New configuration options
New settings include image_upload_check_content, frontend_csrf_strict, allow_video_upload, install_url_allowed_hosts, install_paid_addon_set_key, admin_display_attribute_values_in_list_max, admin_display_extra_field_values_in_list_max, admin_display_values_in_list_show_first, admin_display_values_in_list_name_length, meta_data_save_as_raw, and use_fontawesome.