VM has a virtual function register, which allows to fine tune access rights for each action that can be performed. Each function is assigned to a core module and points to a function inside of a class file.

For example, to add a product into the system, a function called productAdd exists in the table jos_vm_function.

When you add a product, you pass the hidden parameter func with the value of productAdd to the system (besides all the other form fields).

If the current user has the permission to execute the function (permissions can be set for each function separately), the file virtuemart_parser.php looks for the class file name and the function name mapped in the table jos_vm_function for that specific function name (productAdd). In this case we get ps_product as the class name and add as the function name.

After having fetched this information, we can start to execute the real function, which is done in this part of virtuemart_parser.php:

    // Load class definition file
    require_once( CLASSPATH."$class.php" );
    $classname = str_replace( '.class', '', $funcParams["class"]);
    if( !class_exists(strtolower($classname))) {
        $classname = 'vm'.$classname;
    }
    if( class_exists( $classname )) {
        // create an object
        $$classname = new $classname();
    
        // RUN THE FUNCTION
        // $ok  = $class->function( $vars );
        $ok = $$classname->$funcParams["method"]($vars);
    }    

The function is invoked using the parameter $vars. This variable is just a working copy of the superglobal $_REQUEST Array and used as the variable $d inside of the functions.

Each function called that way is expected to return a boolean value (true on success and false on failure). The variable $ok stores the function result.