VirtueMart 4.8.2: What the Small Update Fixes

VirtueMart 4.8.2 is a small follow-up to the 4.8.0 security release. It is not a security release itself, but it fixes two problems 4.8.0 caused on real shops. If you are on 4.8.0 or 4.8.1, update.

What it fixes

Add to cart in cached modules

4.8.0 added a token to the add-to-cart form. In a cached product module, the token of one visitor was shown to everyone, so add-to-cart failed for other sessions. 4.8.2 lets the add-to-cart script add the token itself at click time, and widens the script's selector so it finds VirtueMart forms in more templates. Full explanation.

A plugin parameter change, reverted

The parameter list of the function onstoreplugintable had been extended by accident in the parent class, which caused problems with some plugins. 4.8.2 reverts it.

Cleaner custom form fields

The display of custom form fields was tidied up.

Our verdict

• On 4.8.0 or 4.8.1: update – especially with module or page caching.
• On an older 4.x: go straight to 4.8.2; it includes the 4.8.0 security fixes. What those change.
• Test: add to cart from every product module in two browser sessions, update the cart, one checkout per payment method.

VirtueMart 4.8.2 still runs on Joomla 3.10 to 5. Joomla 6 needs VirtueMart 5 – current status.

Check what's installed

# terminal – the VirtueMart version actually running
grep -E "static \$(RELEASE|REVISION)" administrator/components/com_virtuemart/version.php
mysql -N -e "SELECT JSON_UNQUOTE(JSON_EXTRACT(manifest_cache, '$.version')) FROM jos_extensions WHERE element = 'com_virtuemart';" shop_db

Both should say 4.8.2. If the manifest and version.php disagree, an update was interrupted: install the 4.8.2 package again over itself. Background on the cache issue this fixes, and how to find cached VirtueMart modules, is in Add to cart fails with cached product modules.