RO CSVI 9.11.0 release
Our monthly release is here again. The RO CSVI 9.11.0 release brings important security improvements, major feature additions, and numerous bug fixes. This release focuses on security hardening, expanded subform support, and enhanced J2Commerce integration.
Security improvements
This release addresses several security concerns. We have replaced the use of serialize/unserialize with json_encode/json_decode throughout the codebase to prevent potential Object Injection vulnerabilities. Path traversal vulnerabilities in file upload handling have been fixed. CSRF protection has
been added to AJAX calls on the About page and retrieval of column headers. XSS vulnerabilities have been addressed by ensuring proper JSON responses in AJAX calls and escaping output.
The affected versions are all versions prior to 9.11.0.
Multilevel subform support
A long-requested feature has been completed: full support for multilevel subforms. This allows you to import and export data with nested subform structures in Joomla content. The feature includes proper handling of subform row separators, context settings for import/export, and consolidated handling
of subform custom fields.
You can read more about it in the How to import/export into nested subforms using RO CSVI document.
J2Commerce improvements
Several improvements have been made to the J2Commerce integration:
- Fixed 500 errors and warnings in J2Commerce Product import
- Added support for storing thumb and tiny images with alt text
- Fixed empty records in J2Commerce product export
- Fixed manufacturer filter showing empty lines
- Added default value handling for merging possible non-existent arrays
- Initialized category import model before use
Template and history improvements
The Template edit page now has a Run history button, allowing you to view the history of runs directly from the template. A modal with a link to the logs page has been added, and the logs page now shows as history. Pagination has been added to the history list, and column sorting has been removed.
Notable changes
- All export example templates now include text enclosure for better CSV formatting.
- Fixed VirtueMart categories export date format not being applied
- Fixed RSForm Submission export template usage
- Added current date check in conditional rules with timezone support
- Refactored jQuery to vanilla JavaScript in various places
Changes in RO CSVI 9.11.0
Check the full list of changes in this release:
- Fixed 500 error and warning on J2Commerce Product import
- Fixed Checking default values of 0 and support for TIMESTAMP as default value
- Fixed Path traversal vulnerability in file upload handling
- Fixed Possible Object Injection vulnerability by replacing serialize/unserialize with json_encode/json_decode
- Fixed empty records when running a J2Commerce Product export
- Fixed error on importing media custom field in Joomla Content import
- Fixed full pathname shown when fixing folders on the About page
- Fixed manufacturer filter shows empty options in J2Commerce Product export
- Fixed missing CSRF check from the About page buttons
- Fixed potential XSS vulnerability when loading rule forms
- Fixed rules not showing when editing a template field
- Fixed unable to open template using RSForm Submission export
- Added History view for template runs
- Added Support for multilevel subforms in Joomla Custom Fields
- Added date formatting for the created_on, modified_on, and locked_on in the VirtueMart Category export
- Added option to check a value against the current date in the Conditional Rule
- Changed Remove obsolete imagedestroy function
- Changed Replace serialize with json_encode for ICEcat processing
- Changed Sanitize filenames used for storing uploaded files
- Changed to set text enclosure in all example templates
- Changed to show a user friendly message if restore file cannot be read on restoring a template
- Changed to store all additional image fields data when doing a J2Commerce Product Image import
- Changed to store all additional image fields data when doing a J2Commerce Product import
A full changelog of all changes is available on the download page of RO CSVI 9.11.0.
This release is available for free to everyone with an active subscription from the Download section. If you do not have a subscription yet, you can subscribe here.