Security Release VirtueMart 3.8.6 Closing an XSS Vulnerability

Posted in Latest News

A new XSS was found by 4N_CURZE ( It took a while to reproduce it, because it was caused by the manufactuer dropdown, which is not always activated. The problem itself was easy to fix, although the value was whitelisted everywhere else, it was missing for the manufacturer drop-down list.

Since the previous release some features got added. The long desired multicart system got implemented. Multicart means for a multi-vendor shop, that there is an extra cart for each vendor. So when a customer buys products from different vendors he needs to do a checkout for every vendor. This system is very interesting for real marketplaces, which offer products of different vendors.

Another nice new feature are payment/shipment restrictions by coupons. This can be used to offer customers other payment methods over the phone, such as bank transfer for example. Or it can be used for marketing campaigns like "use this coupon to get free shipment".

The textinput plugin can now be used for mandatory text, as we have introduced a required characters check. iStraxx contributed the toggleCartButton.js with MIT license for the required characters check.

StAn of RuposTel has provided a useful overhaul of the VirtueMart recaptcha system. It now works according to the new Joomla standards and works with any joomla captcha plugin. Read more about this on

VirtueMart 3 component (core and AIO)



  • Added MultiCart system
  • Cart module, replaced link to cart against button, old links should still work
  • Vendor dropdown for Categories.
  • Added the feature that subvendors can check orders, but only if at least one product of them is on the order.


Extended features

  • Added shipment/payment restriction by Coupon
  • Added required chars to the textinput plugin
  • Added layout orderdone for weight_countries plugin, which can be used to override the standard output
  • Added a warning to the vmconfig if the price config is overwritten by shoppergroups.
  • Product edit view and model, added filter for published/unpublished, added searching of products in multiple categories



  • Added VM config setting ReInjectJLanguage, which replaces the Joomla JLanguage object with VmLanguage
  • Update for the VirtueMart System Plugin, for multilanguage as it may be useful to load the VM config always first
  • Replaced $languages = JLanguageHelper::createLanguageList against $JLanguages = JHtml::_('contentlanguage.existing')



  • XSS leak fixed in manufacturer dropdown
  • Recaptcha Overhaul by StAn of RuposTel



  • PayPal refund configuration option to prevent VM generating a request for PayPal refund
  • Small paypal enhancement, inspired by RuposTel and written by Quorvia



  • category model added function getChildCategoryListObjectByCachedOption which is now used by getChildCategoryList and getChildCategoryListObjectByCachedOption  
  • function getSafePathFor can now be used to create any kind of subfolder
  • custom model, directTrigger for plgVmDeclarePluginParamsCustomVM3 and plgVmGetTablePluginParams vmplugin.php enhanced function declarePluginParams
  • Fixed customfield model cache. We load now always all attributes and cache that. and we use directTrigger for plgVmDeclarePluginParamsCustomVM3
  • user model, added cache
  • user model, set the function "setId" to deprecated. The use of the internal id as pointer is useless. The function getUser should now be called with id, but usese as fallback the old $this->_id construction
  • userfield model added JPluginHelper::importPlugin('user'); to the getUserFieldsFor function
  • iStraxx added the toggleCartButton.js with MIT license, need for the textinput required letters. 
  • Invoice, the product is always reloaded to create the item. 



  • Small fix for coupons using the correct language
  • Fixed that Calculation rules were not including the given end day, because the hours and seconds were not set
  • added registration of Vm Controller and View to massxref.php
  • vmTable warning if a key of the params is accidently empty
  • Added _genericVendorId to vmtable and fallback 
  • tables/order_items.php added the very important $this->_genericVendorId = false to fix virtuemart_vendor_id of order items.
  • Updates for the joomla fullinstaller
  • little fix for updatesmigration in case of multivendor store
  • little fix for the tableupdater to prevent notice.
  • important fix for the backend user view to ensure that the correct addresses are loaded.
  • fixes for tcpdf to work on higher php versions
  • fixed function updateCategory for the xref data
  • fixed tooltip in config (check for existing lang key did not work the old way anylonger)
  • mail_raw_pricelist.php replaced $item->product_final_price against $item->product_subtotal_with_tax

Skrill Merchant On Boarding, VirtueMart 3.8.4

Posted in Latest News

Great update of the Skrill Plugin

Trusted by millions across the globe Skrill meets the needs of more than 156,000 businesses worldwide providing a convenient and secure way to send and receive money in nearly 200 countries and 40 currencies.

Our payments platform comes with an exclusive reduced fee offer of 0.9% on Debit Card/Prepaid Card/Credit Card (VISA, Mastercard, Maestro) transactions, and 0.5% fees on Rapid Transfer transactions.*
*Fees apply to new merchants only within restricted industry sectors. Terms and conditions apply.

CCRT ShoppingCartPartners 900x516 EN CTA

What this module does for you:

  • Free and quick setup
  • Access credit cards and 100+ local payment solutions with 1 easy integration
  • Take advantage of the Skrill multicurrency account, giving you access to 40+ currencies
  • High-security standards and anti-fraud technology
  • Seamless payment experience across mobile, tablet and desktop
  • Connect with millions of Skrill account holders


  • Additional payment options and control over how they are displayed
  • Customizable gateway with embedded page and redirect functionality
  • Instant settlement
  • Enhanced reporting and transaction status viewing
  • Refund capability within VirtueMart

What your customers will like:

  • Easy ways to pay safely online – no sign-up required to make payments
  • Convenient and immediate payments – pay with a bank account, or debit and credit cards without any hassle
  • Multiple local payment options allowing customers to pay how they want
  • Internationally recognized and trusted brand

Don’t have an account? Sign up for free today!


VirtueMart 3 component (core and AIO)

VirtueMart, List of Bugfixes:

    • PayPal Smartbuttons should not redirect in checkout if called without redirect option
    • removed useless mod_virtuemart_product_helper and other minors
    • enhanced displayIt function, it resolves now all parameters to an array and only the non empty ones are written. It is also possible now to remove the parameter src completly or replace it with another name. For example when the array has 'src' => 'data-src', then the parameter src is renamed to data-src and filled with the correct URL.
    • enhanced lazyLoad configuration, added GUI option in template tab of vm config
    • css addtocart, addtocart-disabled and notify, All buttons should have the same height.
    • New language variables for new reviews feature.New language variables for new reviews feature.
    • Mediahandler adjustment php7.4
    • order updateBill sql a plus was not commented
    • country table added UNIQUE to the indexes of country 2 and country 3 code.
    • added Paraguay states
    • removed old jquery.min we use now always the joomla one.
    • created GUI for hidden config pricesbyCurrency, extended it by one option (restrictiv)
    • Pagination for coupon analytics
    • fixed wrong invoice numbers generated if fired in the order edit view
    • translated address in cart (translated countries)
    • fixed router in case sef is disabled and an array is used in the url
    • it could happen that payment or shipment was not set due a conflicting js, the js is now unbound for these radios
    • renderMetaEdit added real option for "index, follow".

Release of VirtueMart 3.8 and Covid support campaign

Posted in Latest News

This is a special release in these unusual times. It was planned as simple version with an optimisation boost and bugfixes for VM 3.6.10, but it became a lot more than that. Many people are affected by a corona stasis. One of our members had to go in quarantine (without being infected) where he had a lot of time tor develop and donate smaller enhancements. Personally, I had been preparing for coming restrictions since the end of February since it was clear that Germany will follow the other countries. My wife and I are now taking care of our children's homework and home-education, which are aged from 3 to 11 and my development time is severely impacted. On the other hand this period allowed to really hard-cook this version in the debug process. It is already in use on some live shops for at least the past 2 weeks now.

Some of our developers also joined the COVID Support campaign for the Joomla community Participating developers offer a 20% discount on 

VirtueMart Version Eagle Owl
Image by Alexas_Fotos from Pixabay

The biggest change under the hood are the new optimizations that avoid massive sql requests and use booleans to decide whether we need to load data from an xref table. The technique has some implications, which are described on When I worked on that pattern for categories, I noticed that we can enhance the loading of a category tree in a similar way. Rough tests with more than 200 categories (organised as years) indicate a 5 times faster loading time.

The customfield_value created a permanent performance bottleneck. VirtueMart now creates database keys shortened to the first 50 values, which is a reasonable compromise between using a customfield_value as a simple information value and using it as a searchable value.

The VirtueMart native Language Switcher, which is currently part of the VirtueMart membership, now works more more reliable after some really hard work on the router. The new language switcher creates any SEF Urls for different languages. This means it can switch between product details or just the account maintenance - of course without landing on the homepage. Maybe not that interesting for shoppers, but of importance for administrators.

Template developers who used vmbeez3 before 3.8.0 must consider the security leak reported by the Joomla community and update their templates as soon as possible. It is just two lines.

The next milestones are enhancing/fixing the VirtueMart order editing, invoice handling and Joomla 4 compatibility.

VirtueMart 3 component (core and AIO)



  • Using booleans to decide if the data of an xref table should be loaded - saving large SQL queries
  • Enhanced category tree building
  • Finally Final keys for customfield_value
  • added static to function getProductListing
  • if automaticSelectedPayment/Shipment is set to none, the whole trigger plgVmOnCheckAutomaticSelected is not longer executed
  • replaced overpowered md5 for hash replaced against crc32 or removed completly
  • renderVendorFullVendorList is cached now
  • increased size of vendor_terms_of_service to mediumtext
  • function getProductChildIds extended and cache added
  • customfield C uses now function getProductChildIds in the product model (cached)
  • smarter loading of parent category in backend category view

enhanced features for shop

  • Coupon handling enhancements - additions included from Creative Momentum Ltd
  • featured products load 3 times more than necessary to shuffle with PHP (Random per sql is not really random).
  • Snippet ld-json and double quote in product descriptions
  • Revenue report: added date_presets for reporting over previous two years with totals available by year/month
  • FE managing link, add new product link, notify me link buttonized

enhanced features for templaters/developers

  • added loading of "searchable" also for the cart
  • enhanced recognition of frontend manager
  • tableupdater enhanced being more failproof by RuposTel
  • changed function isImage so, that it takes now a full url and not just the extension as input parameter. The parameter before was quite useless, because half of the work of the function is to get the file extension.
  • medihahandler - enhanced display of the options upload, replace
  • Standard payment has now also the method as variable in the layout post_payment
  • ensureUniqueId correctly implemented for radiolists for multivariants
  • added variable show_notify to product model based on the order min level (not just 1 as before)
  • vmprices, enhanced the lines catching the add to cart button
  • Added function resetEntireCart to cart

new features for shop

  • Colors for shipment methods in the admin order list
  • Added config options for sql - optimisation
  • Added config option to disable layout overrides
  • added tool reset_Has_x_Fields to updatesmigration view, which sets all "has_" fields to NULL
  • hidden config populateEmptyST (ShipTo details remain empty and do not get auto populate by the details in the BillTo details)
  • hidden config shoppergroupDontSaveCart - dont store carts for logged in users if in specified shoppergroups
  • Product model added hidden config changeCategoryRemoveFilter

new features for templaters/developers

  • Debug Option for router
  • vmAccess added function isFEmanager()
  • added extra override posssibility for FE manager views using the suffix Admin to the view name (in case BE and FE view has the same name)
  • Important feature for class vmtables function load, when the $overWriteLoadName is within the translateable fields, then the "where table" is the language table and not the main table. So we can now load a product by slug, for example.
  • added the trigger plgVmOnSendVmEmail in function sendVmMail
  • added javascript function sendFormChange to vm2admin.js, which sends the form of changed elements if using as class sendFormChange
  • Changed the vmtime so, that we can sum up the taken measurements

compatibility for Joomla, Joomla 4, PHP7.4

  • replaced $app->isAdmin/isSite() and similar with VmConfig::isSite() or VmConfig::isSiteByApp()
  • replaced more $obj->$value with $obj->{$value}
  • replaced class hasTip with "hasTooltip", furthermore added JHtml::_('bootstrap.tooltip'); for joomla native bootstrap tooltips


  • fixed moving/ordering of categories
  • hidden configuration ChangeShopperDeleteCart fixed resetting of the cart if switching to a user or registering
  • Cart takes directly the email of logged in joomla users
  • Model customfields, customfields should now also work with 0 values
  • Important fix for customfields, Removing a disabler from a customfield must delete the customfield which stores the disabler
  • usermodel storing user of vendors
  • fixed custom language fallbacks
  • vmTable fixes for language fallback, the problem was that the function is used itself twice so the set temporarly language got lost
  • country dropdown sorted by ordering and alphabetically and with special chars like äöü
  • added _noLimit = true; to prevent that the state of the model is used for Shipmentdropdown, category ordering dropdown,
  • removed old tasks in controllers for ajax, function viewJson
  • removed false positive "Set shoppergroup error"
  • removed task=viewJson& from Urls
  • mediahandler replaced manual setup url against js variable medialink
  • fix in shopfunctions.php functions renderWeightUnitList and renderUnitIsoList, add unknown units to prevent that they are changed/deleted (thx RuposTel)
  • Rounding for currency conversion of costprice and of Margin in case "round only display" is unchecked.
  • product edit, unpublished categories were not rendered
  • cart max_order_level must be checked after checking for quantity steps (by RuposTel)
  • a bit different enhanced quantity check (by RuposTel)
  • Fixed naming of category parameters
  • Fix for usermodel function getUserList in case searchTable shoppers
  • html tag for radio buttons Multivariant fixed ids
  • replaced wrong Vmconfig ajax_category against jdynupdate


  • Big update for multilanguage pages. Loads automatically different language if a language tag is given.
  • Debug option for router
  • Important fix to prevent error if there is no menu item set for the account maintenance
  • function getProductId loads the CategoryName with array_pop not end, the hash uses base64_encode instead of md5 (was overpowered)
  • added unset "start" to productdetails view (hardly used, pagination for related products?), but could generical create bad links with the language switcher
  • function getFieldOfObjectWithLangFallBack was joining language fallback tables, but not using fallbacks in the where clause


  • html_entity_decode for order names in order list
  • When no safe path was given, it was corrected by JPath::clean() to the domain root path and created accidently safepath files and folders in the root directory, fixed.
  • vmbeez3 updated with joomla beez3 template and security update j3.9.16
  • Updated vm system pugin vmLoaderPluginUpdate. When a joomla user is deleted, the corresponding virtuemart data is now also deleted.
  • Deleting a Virtuemart user removes also the joomla user now

Payment Plugins

  • Big Update for Skrill by the Skrill Team Esphere, images compressed by iStraxx
  • Avatax, Fixes and adjustments by AXIOM
  • Realex Plugin removed trigger in createPmtRefTable, the trigger is already executed in $userFieldsModel->store($data);
  • Enhanced PayPal Smartbuttons. Shows PayPal Button now also when logged in.
  • Minors for Sofort
  • Minors for Paypal
  • Fixed core restrictions for skrill

Bugfix Release 3.6.10 Important fix for category restriction of payment/shipment plugins

Posted in Latest News

VirtueMart DoorsWhen a release is just around the corner, we stop adding new features and focus on testing and fixing bugs. So it's a normal reaction of our members to push their wishes after the release. So this new core has an above-average number of new features for a subversion. There are mainly two different groups of features. Some are like furniture. It is quite simple to add them and it is very unlikely that they break something. It may happen that the new table stands in the way of the rarely used door to the basement. But it is simple to fix. Most of the time our testers catch these issues, but sometimes the central heating door was not tested. The new features are all of that kind. The worst which can happen is, that they do not work.

VirtueMart 3 component (core and AIO)

Bigger, more complex feature changes are done in the major versions such as VirtueMart 3.6. These feature changes are more similar to changing the room layout of a house, or adding an extra floor, or replacing the roof, and so on. These are changes which require much more testing and these are more likely to break other constructions attached to your house. For example, the beautiful balcony (your one-page checkout).

Sometimes we notice that our house is not really comfortable. Displaying the order details below the order list was a good idea, but if the order list was too long then buyers did not see the order details. The order details open now above the list. This way, the logic makes much more sense. If you scroll down in the order details, you can directly select the next order. These and similar changes can be found below in the list of changed behaviors.

One of them even starts with "fixed an issue editing the order...". This one is a very typical problem with the GUI, the graphical user interface. The difference of design and art. It sounds simple, but it is not easy to create a functional GUI. It is quite simple to create a nice looking GUI, but that only counts at first glance. In the long run, a GUI must work functionally. The whole order editing started as plain edit function without any assistance. When you changed a data, the new data was taken. A rough calculation system was added to help with the simple summation.

VirtueMart 3.6 extended the order editing assisting system. The tax change works by drop-down, but this system was not written for discounts. The problem here was to find an elegant GUI. For example, a VAT does not need to be overwritten. If you select a VAT, you expect a fail-proof calculation. But sometimes a discount is granted according to a certain rule or only as a result of a specific trade. As a result, changing a quantity of a discounted item did not change the discount according to the new quantity. The system accepted the discount the old way, as direct input.

The new system now works so, that the discount is always calculated by the given prices and multiplied by the quantity. However, if some of the required prices do not exist (for example, the undiscounted gross price), the discount value is transferred as direct input for the whole position. So you can still overwrite the discount by simply emptying the gross price. The GUI concepts follows the intuitive idea, that an empty price field is calculated by the existing data. So you can of course also just set the gross price and the discount and you will get your net and final price calculated automatically.

Last but not least the bug-fixes. Sometimes it happens that a "furniture feature" turns out to be a roof changer ;-). The feature "automatic thumbnailing of the 'no image set' image" is one of these types. It led to a cascade of changes in the mediahandler.php file. The feature "remote images" remained silent in its corner and only caused problems there. But the simple sounding "automatic thumbnailing of the 'no image set' image" even caused problems when adding a new media because it suddenly behaved as thumbnail "no image set" image.
Sometimes a bugfix aggravates the problem. In German we use the word "verschlimmbessern", from "schlimm" (sad) and "bessern" (to make better). Test users reported that sometimes payment/shipment methods are not correctly selected in the cart, or not visible for selection. The provided fix solved the problem if categories were not set, but created another one. Adding the extra tests for the case 'on empty' lead to a wrongly used pattern and broke the category conditions.

I hope that I gave a good insight how complex it is to deal with new features, bugs, features removing bugs, and bugfixes adding bugs, and so on.

Thanks to our good community - join us at

List of new features

  • Added placeholders to userfields
  • Added cloning of products with children
  • Added hidden config adminProductListBruttoPrices
  • Added option to user list in backend "show only shoppers"
  • Added vendor drop-down to users list in backend, so that it filters "shoppers of a vendor"
  • Added option to user account view "showUserShopperGrp"

Changed behaviour

  • Remote medias can now also be stored with http/s (is removed automatically)
  • Discontinued products are now only filtered for shoppers (not as managers in FE or BE)
  • Fixed an issue editing the order. Increasing the quantity of an item did not increase the given discount, but used the entered one. More information here
  • Order details are now opened above the order list
  • PayPal does not directly try to validate the data (for certain sub-methods), only when in checkout process
  • When ChangeShopperDeleteCart option is activated, then it also empties of the addresses of the current cart
  • If automatic payment/shipment is set to "none", the triggers are not executed


  • Component aio should work more robust now (some plugins prevented that it loaded the vmconfig correctly)
  • Added database key for product sku
  • Added delay of 400 ms to mediahandler autosearch function

List of fixes

  • Fix for no image display in media edit
  • Fixed category conditions for methods (shipment/payment)
  • Removed a note in router due a vmdebug
  • Fixed logic of storing username, when it is not allowed to change the username
  • Fix for adding new ST address in account maintenance view
  • Fixed typo in handle404 function

Bugfix Release 3.6.8 - Registration and PayPal issues

Posted in Latest News

An unexpected error occurred when updating to VirtueMart 3.6.4 using the All-in-One installer. The error was due to the uninitialized language object. First, we discovered that the VirtueMart files were loaded incorrectly when installing with third-party plug-ins present. But then all of a sudden, even with a completely new installation. The previous installation routine only checked whether the VmConfig class existed and executed the load configuration. The new installation routine also checks the existence of the vmLanguage class.

And suddenly we had a problem with the PayPal IPN. If you google for the problem it is easy to see that it has been a periodically recurring problem. Our IPN function used the DNS records of the domains listed in the white list to check the IP. The new method uses a mixed mode and also checks if the requesting IP is resolved to the domains in the white list.

VirtueMart 3 component (core and AIO)

Update for 3.6.6: Some third-party developers only include our class VmConfig, but do not execute the loadConfig function. In other places, we check whether the VmConfig class already exists, and include AND executed loadConfig only if the class has not already been loaded. The router and the system plugin for updates now specifically check whether loadConfig has actually been executed.

Changed behaviour

  • 3.6.6 Invoice download icon is now a button with the invoice number
  • 3.6.6 Backend order list search now considers order id and order total now (round by 2 digits)

List of fixes

  • Fix for AIO installer, ensuring a correctly initialised vm config
  • 3.6.8 Fix for user registration in account view
  • 3.6.8 fix for not loaded joomla language if user activation is used (double opt-in)
  • 3.6.8 Virtuemart registration email now uses the joomla parameter "sendpassword" correctly
  • 3.6.8 checkPaypalIps now works with a mixed mode. Thanks to Studio42 for this idea.

We use cookies on our website. Some of them are essential for the operation of the site, while others help us to improve this site and the user experience (tracking cookies). You can decide for yourself whether you want to allow cookies or not. Please note that if you reject them, you may not be able to use all the functionalities of the site.