Caming back from holidays, our project VirtueMart was unpublished on JED. There was a security audit by a Joomla member with claude and we did not pass. Some of them were already addressed in VirtueMart5, which is almost ready. Some even in not delivered plugins, which we kept in the trunk. So I removed all the old plugins and the vmf folder and moved it to a branch.
Security Fixes
- Skrill payment plugin: There is a security issue with the Skrill payment plugin. If you use it in your store, please either update to this version or remove the plugin entirely.
Token validation
- Token checks added to backend controllers and frontend forms. Unauthorized form submissions are now rejected.
Rating System Improvements
- Shop owners can now edit customer names and review messages in the backend (voting results remain protected against modification)
- Added various validation for example for the generic child selection dropdown when editing ratings
- Better handling of limit start and empty checks in rating models
- Miscellaneous bug fixes for rating list view styling
Plugin Download simple
- Fixed improper check for correct requested media
Enhanced validation for media uploads
First we allow the unsecure files like php in zips now only for files to sale. Furthermore the mime check was before only done for medias and is now done for any file.
RECOMMENDED FOR ALL USERS: Please update to this version, in special if you are using the Skrill payment plugin or manage ratings/reviews for products.
Payment Plugin Cleanup
We have removed the following legacy payment plugins that are no longer maintained or productively used:
- HeidelPay
- Klarna (old invoice API)
- Payzen
- Systempay
- Sofort
- Sofort_ideal
Note: Klarna Checkout (the newer checkout variant) has been retained as it is still in use by at least one merchant.
Evaluation vmTable Enhancements
We've ported a new approach from VirtueMart 5 to VirtueMart 4 for enhanced storing of arrays in the xref table.
Currency Display Changes
- Added vendor_currency_id property for more accurate currency representation per vendor
- Fixed typo that prevented proper currency display in certain setups
- Prevented PHP notices when prices are not set on currency objects
PayPal Checkout Updates
- Fixed OnStoreInstallPluginTable function parameters to work with the updated vmplugin
- Added allowedCurrentStatuses parameter to updateOrderStatus for better order status control
Native Dropdown Replacement (Choices)
We replaced Chosen dropdown JS against the modern Choices library in the backend. As a bonus, it works natively without jQuery and is compatible with Joomla 6.
You can use the old config setting to disable this completely, or enable it also in the frontend.
Misc Improvements
- Samples products added for category pagination testing
- Added force mail log mode for outbound VirtueMart emails (helps debugging email delivery issues)
- Fixed logInfo path cache so dedicated log file names work correctly
- RouterDebug now has improved URL query logging capabilities
