- Details
- Written by: Max Milbers
- Category: Latest News
- Hits: 1926
Another important security and bugfix release 4.6.0
An XSS found again by Adam Wallwork. This time I did general update of our filters, many functions got enhanced. Some filters are now always active, we do not leave it to the developers. This version is NOT working on Joomla 6, we will release a new VirtueMart 5 too match all the changes.
For Updaters
If you get the error in the cart "Invalid token". Please read this tutorial https://docs.virtuemart.net/tutorials/templating-layouts/fix-missing-token-in-checkout-virtuemart-4-6-x
What else happened?
We heavily work on a namespaced VirtueMart version, which runs without legacy plugin on Joomla 3 up to Joomla 6.
Read more: We put on the helmet! Important Security release 4.6.0
- Details
- Written by: Max Milbers
- Category: Latest News
- Hits: 2500
Whats going on here? 3rd security release within 6 months? Yes that is unusual, but better the leaks are found and closed than wrong safety feeling. In this special case we provide also the fix for old installations. It should work for any installation higher than vm3.6
- Details
- Written by: Max Milbers
- Category: Latest News
- Hits: 2296
The security issue requires the permission to edit categories, so it is even likely that no shop is affected. Only multivendor shops that allow category editing may be affected. This issue was found by Adam Wallwork.
A small feature has been added for the checkboxes of “tos” and similar. It is now possible to use an article id or alias in the "default" field to load a joomla article if custom userfield and layout "tos" is selected. It is also possible to set the text to the "description" field only. Very handy for additional contract terms.
We have replaced our old TcPdf library with the official updated version 6.8.2 of TcPdf. The versioning was taken from the library. So it looks like a high jump, but the library has no new features, but is better secured and adapted for PHP8.
We have opened a new discord server which is in general free for any community member. The forum shows the invite link, if you are at least in the "Jr. Member" group, which is the first after "Beginner". You are welcome to join us there.
DOWNLOAD VirtueMart 4.4.8
NOW needs membership
Read more: Security and Bugfix release 4.4.8 - Discord Server
- Details
- Written by: Max Milbers
- Category: Latest News
- Hits: 2494
I am sorry guys, the last release was rushed by the security issue and I underestimated that testers were not testing due holidays, silvester and all that. This version now is tested very well. Many hours by different testers went into testing. I added a small tool, which fixes all images which lost the image property for you.
DOWNLOAD VirtueMart 4.4.6
NOW with a membership
- Details
- Written by: Max Milbers
- Category: Latest News
- Hits: 2522
From time to time it happens. We have an XSS issue. Reported by Aman Rai. More Infos later. Version vm4.4.4 has a fix to prevent them.
[Update] After some further investigation together with the Joomla core team, this issue can not be exploited in the latest Joomla versions. If you have Joomla 5.1.4 or later or 4.4.8 or later installed, the issue is already fixed. We did not check against joomla 3.
[Update 2] Sorry guys, a little error found. If you store a product with media, the checkbox "is image" is not preselected. The fix is ready, but this time we want to take more time for testing to prevent such stupid errors (mea culpa).
- Adjustments for Tableupdater to prevent unecessary updating of keys in mysql8
- vmUri extended whitelist, function works now also with given query
- vRequest extended function getVar to work with given source
- install.sql fixed TINYINT(4) against TINYINT(1)
- added the option to add no searchfield
- added setConvertInt also for plugin tables
- added property "isImage" for medias, works BC
- fixed currency if none is set
- fixed adding of new states in the new admin layout
- fixed problem in router
- user registration fix if not in checkout
