0008001: When the WYSIWYG editor is rendered in the admin area, the OXID help buttons stop working.

Wed, 21 Oct 2026 07:37:23 +0200

On admin pages that use the WYSIWYG editor (e.g., articles, categories), the helper buttons for other input fields on the page no longer work. An error is logged in the error console, but it indicates only the symptom rather than the root cause.

Uncaught TypeError: can't access property "trim", $(...).innerHTML is undefined
showPanel https://mario.oxiddev.de/out/admin_twig/src/js/widgets/yui-polyfill.js:804
onclick https://mario.oxiddev.de/admin/index.php?editlanguage=0&force_admin_sid=9a4221357e23097ead725b4f654dab55&stoken=9B181333&shp=1&&cl=article_main&oxid=-1:1

0007662: SEO URLs of oxseohistory ignore oxtype

Fri, 16 Oct 2026 11:02:11 +0200

In _decodeOldUrl() there is searched for old seo urls via ident. But if there is more items in the shop with the same ids and different oxtypes there is a problem, because oxseohistory don't holds the oxtype and there is only the object id and language which is used to get the new one. So you will maybe end up with a old content URL which is redirecting to a category or something else. I experienced this problem while using my own SEO objects and values in oxtype, having multiple views on the same db object with different models and SEO URLs. Wondering why the old URL of View B is redirected to View A.

I think this Bug is there till the beginning of time but never have been discovered?

0007967: Double-Encoded Quotes in Tag (Search Results Page) - in Twig-Templates</h1> <p>Thu, 15 Oct 2026 13:00:57 +0200</p> FrontendController::getPageTitle() calls the private method replaceDoubleQuotesWithHTMLCharacters(), which replaces " with ".<br /> This is a Smarty-era relic: back then the title was rendered without auto-escaping, so the entity had to be produced manually.<br /> <br /> Under Twig, however, the <title> tag (and og:title) is auto-escaped. As a result the ampersand gets encoded a second time:<br /> <br /> " -> " -> the browser tab literally displays ".<br /> <br /> This is most visible on the search results page, where the title wraps the search term in double quotes (e.g. Search results for "term"). The <h1> heading is not affected, because it is built with literal quotes in the template and is therefore auto-escaped only once. </article> <article> <h1>0007973: Demodata - several Shippingcostrules has same sorting-position</h1> <p>Wed, 14 Oct 2026 11:12:23 +0200</p> In the demo data, some shipping cost rules share the same sort position; specifically, position "0" has been assigned twice. The "first" shipping cost rule holds special significance: if a customer is not logged in, shipping costs can still be calculated during checkout, with the shop applying the first applicable rule. This duplicate assignment can cause shipping costs to fluctuate during checkout. Payment modules with express functionality sometimes fail to display shipping costs consistently. </article> <article> <h1>0007982: oe:license:add silently stores nothing on an offline (grace-expired / unlicensed) shop</h1> <p>Wed, 14 Oct 2026 10:23:09 +0200</p> A shop whose license grace period has expired serves the maintenance/offline page (HTTP 500) and considers itself unlicensed. Attempting to recover it with oe:license:add <valid-serial> appears to succeed but stores nothing:<br /> <br /> - The command prints only Adding new license, exits 0, and prints no status line and no error.<br /> - Reading the database directly shows aSerials remains a:0:{} (empty) before and after the command.<br /> <br /> Root cause: the shop-validity/offline check runs during config load, triggered by the very first getConfigParam() call. When the license is invalid, this check terminates the process with a clean exit() (no PHP error). oe:license:add internally reads config (validate() then getSerialList() then getConfigParam('aSerials')) as its first config access, so it is killed before it reaches the code that persists the serial. The shop therefore cannot license itself via the console once it has gone offline. </article> <article> <h1>0008003: Installation on 7.5 not working anymore</h1> <p>Fri, 09 Oct 2026 12:43:09 +0200</p> Installation and activation in admin-area on 7.5 PE and EE leads to shop crash due to <br /> [2026-09-08 12:27:09] OXID Logger.ERROR: ArgumentCountError: Too few arguments to function OxidEsales\EshopCommunity\Internal\Framework\Module\Facade\ActiveModulesDataProviderBridge::construct(), 0 passed and exactly 1 expected in /var/www/oxideshop/vendor/oxid-esales/oxideshop-ce/source/Internal/Framework/Module/Facade/ActiveModulesDataProviderBridge.php:16 </article> <article> <h1>0008006: Recommendation-Lists are not rendered (Twig-Tpl-Error)</h1> <p>Fri, 02 Oct 2026 17:32:05 +0200</p> Affected: oxid-esales/apex-theme, branch b-7.4.x (commit 2f38cdd5), file tpl/page/recommendations/recommlist.html.twig<br /> <br /> Error:<br /> Twig\Error\SyntaxError: Unexpected token "operator" of value ">" in "@main__/page/recommendations/recommlist.html.twig" at line 5.<br /> In the frontend this results in Template "page/recommendations/recommlist" not found and the page is not rendered.<br /> <br /> Cause: The Smarty/PHP arrow syntax -> was left over from the Smarty-to-Twig migration in two places. Twig only supports . for this:<br /> <br /> - Line 5: _actvrecommlist->oxrecommlists__oxauthor->value<br /> - Line 37: oView->getSearchForHtml(). This one doesn't appear in the error message because Twig stops at the first syntax error.<br /> <br /> Fix:<br /> - {% set recommendation_head = _actvrecommlist.oxrecommlists__oxtitle.value ~ " <span>(" ~ recommendation_head ~ " " ~ _actvrecommlist->oxrecommlists__oxauthor->value ~ ")</span>" %}<br /> + {% set recommendation_head = _actvrecommlist.oxrecommlists__oxtitle.value ~ " <span>(" ~ recommendation_head ~ " " ~ _actvrecommlist.oxrecommlists__oxauthor.value ~ ")</span>" %}<br /> - {% set recommendation_head = oView.getArticleCount() ~ " " ~ hitsfor ~ " "" ~ oView->getSearchForHtml() ~ """ %}<br /> + {% set recommendation_head = oView.getArticleCount() ~ " " ~ hitsfor ~ " "" ~ oView.getSearchForHtml() ~ """ %} </article> <article> <h1>0007219: Difference between FF and Chrome/Egde when editing father articles in the subshop in the backend</h1> <p>Thu, 24 Sep 2026 13:03:45 +0200</p> It has been noticed that when editing father articles in the subshops, the save button is normally (specifically in Chrome and Microsoft Edge) greyed out and non-functional.<br /> In Firefox, this button can be activated under certain circumstances by clicking in the Title or Art-Num fields. <br /> <br /> Whether this behaviour occurs only with the fields or in this combination cannot be judged conclusively, but I have put some debug time into it, i.e. I assume that the above problem can only be reproduced reliably in the combination of children's shop and father's article. By this I also mean that unpleasant behaviour with variants and simple articles does not occur. Everything seems to work as intended there.<br /> <br /> Update of issue:<br /> The expected behaviour is that the price/item (also father item) should be saveable regardless of the browser. </article> <article> <h1>0007866: missing Product-Action-Widget [widget/product/action.html.twig]</h1> <p>Thu, 17 Sep 2026 17:23:48 +0200</p> The widget was registered in "Component/Widget/Action.php:21", but the widget template does not exist in the current Apex theme.<br /> <a href="https://github.com/OXID-eSales/apex-theme/tree/v2.1.0/tpl/widget/product" rel="noopener,nofollow">https://github.com/OXID-eSales/apex-theme/tree/v2.1.0/tpl/widget/product</a><br /> <br /> Additionally, the related documentation is empty.<br /> <a href="https://docs.oxid-esales.com/eshop/de/7.2/betrieb/aktionen/aktionen-und-startseite.html#eigene-aktionen-einbinden" rel="noopener">https://docs.oxid-esales.com/eshop/de/7.2/betrieb/aktionen/aktionen-und-startseite.html#eigene-aktionen-einbinden</a><br /> <br /> Kind regards,<br /> Anton Heinze </article> <article> <h1>0007837: Cleared SelectionList in Admin</h1> <p>Mon, 07 Sep 2026 16:20:41 +0200</p> If you try to add a new selection list in the admin area, after you enter the title, name and price: if you click "add field", every input gets cleared.<br /> In our eyes "add field" should at this point be inactive or a field should be saved. </article> <article> <h1>0007061: It is not possible to delete the bonus article in basket</h1> <p>Mon, 07 Sep 2026 13:15:18 +0200</p> It is not possible to delete the bonus article, regardless of whether the bonus was created for an article in the products -> extended -> assign product or as a discount -> itm. </article> <article> <h1>0006996: New 3-D Secure standard data</h1> <p>Thu, 03 Sep 2026 10:25:44 +0200</p> As part of the new 3-D Secure standard that is coming into force in Europe, there are a number of new parameters that should be sent to credit card acquirers. More details under -> <a href="https://doc.wirecard.com/CreditCard.html#CreditCard_3DS2" rel="noopener,nofollow">https://doc.wirecard.com/CreditCard.html#CreditCard_3DS2</a><br /> <br /> Missing data from the user:<br /> - authentication timestamp (When the user logged in)<br /> - account update date (When was the account updated)<br /> - account password change date (When was the password changed)<br /> - suspicious activity (Settable value in the back end from the shop owner if an conusmer is "suspicious" (true/false) value)<br /> - street2 (missing from the shipping and billing address)<br /> - street3 (missing from the shipping and billing address)<br /> - work phone (Work phone number)<br /> <br /> Missing for shipping methods:<br /> - info delivery timeframe (value in time when is the delivery to be expected) </article> <article> <h1>0002423: oxArticle::getStockCheckQuery() problem</h1> <p>Wed, 26 Aug 2026 16:25:33 +0200</p> When blUseStock ON, blVariantParentBuyable OFF oxArticle::getStockCheckQuery() builds SQL subquery which slows down product search </article> <article> <h1>0007998: Hidden dependency in the b2b-scheduled-orders-module for the b2b-offers-module</h1> <p>Wed, 26 Aug 2026 15:13:46 +0200</p> The `b2b-scheduled-orders-module` calls the `hasOffer` basket method twice:<br /> <br /> b2b-scheduled-orders-module/Service/Service.php:163: if ($basket->hasOffer()) {<br /> b2b-scheduled-orders-module/Controller/ApprovalDetailsController.php:87: if ($basket->hasOffer()) {<br /> <br /> But this method is defined in `b2b-offers-module` which is not a dependency of `b2b-scheduled-orders-module`.<br /> <br /> So either:<br /> 1. add `b2b-offers-module` as dependency of `b2b-scheduled-orders-module`<br /> 2. or check that the method `hasOffer` exists before calling it </article> <article> <h1>0007990: Metapackage requests insecure composer version during installation</h1> <p>Wed, 26 Aug 2026 15:13:12 +0200</p> During<br /> composer create-project --no-dev oxid-esales/oxideshop-project htdocs dev-b-7.4-ee<br /> OR<br /> composer create-project --no-dev oxid-esales/oxideshop-project htdocs dev-b-7.4-pe<br /> OR<br /> composer create-project --no-dev oxid-esales/oxideshop-project htdocs dev-b-7.4-ce<br /> <br /> this error occurs <br /> <br /> oxid-esales/oxideshop-metapackage-ce v7.4.1 requires composer/composer 2.9.8 -> found composer/composer[2.9.8] but these were not loaded, because they are affected by security advisories ("PKSA-q3ht-3g42-rg8f", "PKSA-4pm6-g63v-5rkr", "PKSA-zcdk-qnhk-hq2g"). Go to <a href="https://packagist.org/security-advisories/" rel="noopener,nofollow">https://packagist.org/security-advisories/</a> to find advisory details. To ignore the advisories, add them to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config. </article> <article> <h1>0007921: Extending module templates is not simple where it should be</h1> <p>Tue, 25 Aug 2026 16:50:05 +0200</p> Extending module templates is not simple where it should be </article> <article> <h1>0007984: Refund - send Mail</h1> <p>Tue, 25 Aug 2026 12:21:28 +0200</p> There is no email notification indicating when a refund is processed in the admin panel.<br /> <br /> Add a function to send an email t the customer. <br /> Add an additional checkbox next to "Refund all."<br /> <br /> Content:<br /> "A refund has been initiated. <br /> You can find further information in your PayPal account or the PayPal app."<br /> <br /> <br /> -----<br /> D3/MG </article> <article> <h1>0007677: During setup, the SymfonyCache is already needed, although it is not yet present</h1> <p>Tue, 25 Aug 2026 10:58:19 +0200</p> When the OXID setup is started in the browser, the cache is already required and used, even though the cache directory does not yet exist.<br /> <br /> Since the variables <sCompileDir> and <sShopDir> are not yet set in the config.inc.php, a chain of errors may occur.<br /> <br /> OXID incorrectly tries to create the cache under /var/www/source/Setup/<sCompileDir>/.<br /> <br /> On some systems, this does not work and OXID then tries to write an error message to the log and also fails because the folder /var/www/source/Setup/<sShopDir>/log is also not writable.<br /> <br /> Many Linux systems can apparently handle corrupt paths. At the file level, this then looks like the screenshot.<br /> <br /> However, the path is invalid for phpStorm and phpStorm cannot display the path. </article> <article> <h1>0007738: Password forgotten form disappears if language is switched from de to en.</h1> <p>Mon, 24 Aug 2026 17:06:36 +0200</p> It's not possible to switch the language while being on the page with the form for a forgotten password, because the form won't be displayed anymore.<br /> If language is changed back (from en to de), the form is sill gone and the SEO URL has changed, too. </article> <article> <h1>0007687: Inactive country in delivery address leads to Unauthorrized error</h1> <p>Mon, 24 Aug 2026 15:19:21 +0200</p> If a customer has a delivery address with an inactive country, the API returns an Unauthorized error but also returns result data. The result contains null for the inactive country. This differs from the shop's frontend which shows the country no matter if active or not. </article> <article> <h1>0007073: Left entries from the popup "Assign article" in the category management do not disappear after assignment</h1> <p>Fri, 21 Aug 2026 13:27:59 +0200</p> If you move articles in the popup from the left column "All articles" to the right column "Articles in this category" under Categories->Master->"Assign articles", this article will not disappear from the left column. </article> <article> <h1>0007979: smarty-to-twig-converter</h1> <p>Thu, 20 Aug 2026 12:20:32 +0200</p> Der Smarty-to-Twig-Converter konvertiert die folgende Zeile falsch:<br /> [{assign var="webconnectFileMTime" value=$oViewConf->getModulePath('oxps/webconnect', 'out/src/js/webconnecterp_productlists.js')|filemtime}]<br /> <br /> Diese Zeile wird übersetzt zu:<br /> {% set webconnectFileMTime = oViewConf.getModulePath('oxps/webconnect', %}<br /> <br /> Erwartete Ausgabe:<br /> {% set webconnectFileMTime = oViewConf.getModulePath('oxps/webconnect', 'out/src/js/webconnecterp_productlists.js')|filetime %} </article> <article> <h1>0007113: Module information is not deleted completely</h1> <p>Thu, 20 Aug 2026 12:19:18 +0200</p> If a registered module is not present in modules directory, a question is displayed: <br /> Invalid modules were detected. Do you want to delete all registered module information and saved configurations?<br /> Answering "yes" does not update configuration file, so the message appears again and again. </article> <article> <h1>0007978: login token for admin and frontend user</h1> <p>Thu, 20 Aug 2026 11:20:48 +0200</p> - In our project we have an impersonation feature that lets an admin user load a frontend user and place orders on their behalf. This worked fine up to OXID 7.0.<br /> - OXID 7.4 introduced a login-token mechanism (in UserComponent and in User::loadActiveUser()): on login a hash derived from the user's password hash is stored in the session under a single key login-token, and on every loadActiveUser() call it is re-verified against the current password hash — if it doesn't match, the user is logged out.<br /> - This breaks impersonation, because the core uses one shared login-token key for both the admin (backend) and the frontend user, distinguished only at runtime via isAdmin(). With admin and frontend logged in in parallel within the same session, whichever context writes the token last overwrites the other, so the other context fails the check and gets logged out.<br /> - I've worked out a workaround that splits the token into two context-specific session slots (login-token-admin / login-token-frontend) and translates between them and the generic login-token key the core expects, leaving the actual verifyHash check untouched.<br /> - My concern: this relies on the internal login-token key name and the way the core reads/writes it. If a future OXID version renames the key, changes where it's set, or alters the verification flow, the workaround will silently break.<br /> - Question: is the login-token handling considered stable/public API, or is it an internal implementation detail that may change? And is there an officially supported extension point for impersonation-style parallel sessions that I should use instead?<br /> <br /> Thanks </article> <article> <h1>0007985: Refund - send Mail</h1> <p>Thu, 20 Aug 2026 08:08:19 +0200</p> There is no email notification indicating when a refund is processed in the admin panel.<br /> <br /> Add a function to send an email t the customer. <br /> Add an additional checkbox next to "Refund all."<br /> <br /> Content:<br /> "A refund has been initiated. <br /> You can find further information in your PayPal account or the PayPal app."<br /> <br /> <br /> -----<br /> D3/MG </article> </main></body></html>

OXID eShop bugtrack - Issues

0008001: When the WYSIWYG editor is rendered in the admin area, the OXID help buttons stop working.

0007662: SEO URLs of oxseohistory ignore oxtype