OXID eShop bugtrack - Issues

0008003: Installation on 7.5 not working anymore

Tue, 08 Sep 2026 12:41:57 +0200

Installation and activation in admin-area on 7.5 PE and EE leads to shop crash due to
[2026-09-08 12:27:09] OXID Logger.ERROR: ArgumentCountError: Too few arguments to function OxidEsales\EshopCommunity\Internal\Framework\Module\Facade\ActiveModulesDataProviderBridge::__construct(), 0 passed and exactly 1 expected in /var/www/oxideshop/vendor/oxid-esales/oxideshop-ce/source/Internal/Framework/Module/Facade/ActiveModulesDataProviderBridge.php:16

0007837: Cleared SelectionList in Admin

Mon, 07 Sep 2026 16:20:41 +0200

If you try to add a new selection list in the admin area, after you enter the title, name and price: if you click "add field", every input gets cleared.
In our eyes "add field" should at this point be inactive or a field should be saved.

0007061: It is not possible to delete the bonus article in basket

Mon, 07 Sep 2026 13:15:18 +0200

It is not possible to delete the bonus article, regardless of whether the bonus was created for an article in the products -> extended -> assign product or as a discount -> itm.

0008001: When the WYSIWYG editor is rendered in the admin area, the OXID help buttons stop working.

Mon, 07 Sep 2026 08:23:28 +0200

On admin pages that use the WYSIWYG editor (e.g., articles, categories), the helper buttons for other input fields on the page no longer work. An error is logged in the error console, but it indicates only the symptom rather than the root cause.

Uncaught TypeError: can't access property "trim", $(...).innerHTML is undefined
showPanel https://mario.oxiddev.de/out/admin_twig/src/js/widgets/yui-polyfill.js:804
onclick https://mario.oxiddev.de/admin/index.php?editlanguage=0&force_admin_sid=9a4221357e23097ead725b4f654dab55&stoken=9B181333&shp=1&&cl=article_main&oxid=-1:1

0006996: New 3-D Secure standard data

Thu, 03 Sep 2026 10:25:44 +0200

As part of the new 3-D Secure standard that is coming into force in Europe, there are a number of new parameters that should be sent to credit card acquirers. More details under -> https://doc.wirecard.com/CreditCard.html#CreditCard_3DS2

Missing data from the user:
- authentication timestamp (When the user logged in)
- account update date (When was the account updated)
- account password change date (When was the password changed)
- suspicious activity (Settable value in the back end from the shop owner if an conusmer is "suspicious" (true/false) value)
- street2 (missing from the shipping and billing address)
- street3 (missing from the shipping and billing address)
- work phone (Work phone number)

Missing for shipping methods:
- info delivery timeframe (value in time when is the delivery to be expected)

0002423: oxArticle::getStockCheckQuery() problem

Wed, 26 Aug 2026 16:25:33 +0200

When blUseStock ON, blVariantParentBuyable OFF oxArticle::getStockCheckQuery() builds SQL subquery which slows down product search

0007998: Hidden dependency in the b2b-scheduled-orders-module for the b2b-offers-module

Wed, 26 Aug 2026 15:13:46 +0200

The `b2b-scheduled-orders-module` calls the `hasOffer` basket method twice:

b2b-scheduled-orders-module/Service/Service.php:163: if ($basket->hasOffer()) {
b2b-scheduled-orders-module/Controller/ApprovalDetailsController.php:87: if ($basket->hasOffer()) {

But this method is defined in `b2b-offers-module` which is not a dependency of `b2b-scheduled-orders-module`.

So either:
1. add `b2b-offers-module` as dependency of `b2b-scheduled-orders-module`
2. or check that the method `hasOffer` exists before calling it

0007990: Metapackage requests insecure composer version during installation

Wed, 26 Aug 2026 15:13:12 +0200

During
composer create-project --no-dev oxid-esales/oxideshop-project htdocs dev-b-7.4-ee
OR
composer create-project --no-dev oxid-esales/oxideshop-project htdocs dev-b-7.4-pe
OR
composer create-project --no-dev oxid-esales/oxideshop-project htdocs dev-b-7.4-ce

this error occurs

oxid-esales/oxideshop-metapackage-ce v7.4.1 requires composer/composer 2.9.8 -> found composer/composer[2.9.8] but these were not loaded, because they are affected by security advisories ("PKSA-q3ht-3g42-rg8f", "PKSA-4pm6-g63v-5rkr", "PKSA-zcdk-qnhk-hq2g"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add them to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.

0007921: Extending module templates is not simple where it should be

Tue, 25 Aug 2026 16:50:05 +0200

Extending module templates is not simple where it should be

0007984: Refund - send Mail

Tue, 25 Aug 2026 12:21:28 +0200

There is no email notification indicating when a refund is processed in the admin panel.

Add a function to send an email t the customer.
Add an additional checkbox next to "Refund all."

Content:
"A refund has been initiated.
You can find further information in your PayPal account or the PayPal app."

-----
D3/MG

0007677: During setup, the SymfonyCache is already needed, although it is not yet present

Tue, 25 Aug 2026 10:58:19 +0200

When the OXID setup is started in the browser, the cache is already required and used, even though the cache directory does not yet exist.

Since the variables and are not yet set in the config.inc.php, a chain of errors may occur.

OXID incorrectly tries to create the cache under /var/www/source/Setup//.

On some systems, this does not work and OXID then tries to write an error message to the log and also fails because the folder /var/www/source/Setup//log is also not writable.

Many Linux systems can apparently handle corrupt paths. At the file level, this then looks like the screenshot.

However, the path is invalid for phpStorm and phpStorm cannot display the path.

0007738: Password forgotten form disappears if language is switched from de to en.

Mon, 24 Aug 2026 17:06:36 +0200

It's not possible to switch the language while being on the page with the form for a forgotten password, because the form won't be displayed anymore.
If language is changed back (from en to de), the form is sill gone and the SEO URL has changed, too.

0007687: Inactive country in delivery address leads to Unauthorrized error

Mon, 24 Aug 2026 15:19:21 +0200

If a customer has a delivery address with an inactive country, the API returns an Unauthorized error but also returns result data. The result contains null for the inactive country. This differs from the shop's frontend which shows the country no matter if active or not.

0007073: Left entries from the popup "Assign article" in the category management do not disappear after assignment

Fri, 21 Aug 2026 13:27:59 +0200

If you move articles in the popup from the left column "All articles" to the right column "Articles in this category" under Categories->Master->"Assign articles", this article will not disappear from the left column.

0007979: smarty-to-twig-converter

Thu, 20 Aug 2026 12:20:32 +0200

Der Smarty-to-Twig-Converter konvertiert die folgende Zeile falsch:
[{assign var="webconnectFileMTime" value=$oViewConf->getModulePath('oxps/webconnect', 'out/src/js/webconnecterp_productlists.js')|filemtime}]

Diese Zeile wird übersetzt zu:
{% set webconnectFileMTime = oViewConf.getModulePath('oxps/webconnect', %}

Erwartete Ausgabe:
{% set webconnectFileMTime = oViewConf.getModulePath('oxps/webconnect', 'out/src/js/webconnecterp_productlists.js')|filetime %}

0007113: Module information is not deleted completely

Thu, 20 Aug 2026 12:19:18 +0200

If a registered module is not present in modules directory, a question is displayed:
Invalid modules were detected. Do you want to delete all registered module information and saved configurations?
Answering "yes" does not update configuration file, so the message appears again and again.

0007978: login token for admin and frontend user

Thu, 20 Aug 2026 11:20:48 +0200

- In our project we have an impersonation feature that lets an admin user load a frontend user and place orders on their behalf. This worked fine up to OXID 7.0.
- OXID 7.4 introduced a login-token mechanism (in UserComponent and in User::loadActiveUser()): on login a hash derived from the user's password hash is stored in the session under a single key login-token, and on every loadActiveUser() call it is re-verified against the current password hash — if it doesn't match, the user is logged out.
- This breaks impersonation, because the core uses one shared login-token key for both the admin (backend) and the frontend user, distinguished only at runtime via isAdmin(). With admin and frontend logged in in parallel within the same session, whichever context writes the token last overwrites the other, so the other context fails the check and gets logged out.
- I've worked out a workaround that splits the token into two context-specific session slots (login-token-admin / login-token-frontend) and translates between them and the generic login-token key the core expects, leaving the actual verifyHash check untouched.
- My concern: this relies on the internal login-token key name and the way the core reads/writes it. If a future OXID version renames the key, changes where it's set, or alters the verification flow, the workaround will silently break.
- Question: is the login-token handling considered stable/public API, or is it an internal implementation detail that may change? And is there an officially supported extension point for impersonation-style parallel sessions that I should use instead?

Thanks

0007985: Refund - send Mail

Thu, 20 Aug 2026 08:08:19 +0200

0007311: User remains logged in when switching between subshobs, although "Allow users from other stores" is disabled

Wed, 19 Aug 2026 15:05:34 +0200

If the user is logged in to one shops and switches to another subshop, he is always logged in there as well, even though the "Master Settings > Core Settings > Shop 1 > Mall > Allow users from other shops" setting is not set, which is the default.

0005930: System health check should also check if folder for default cache backend on filesystem has sufficient permissions

Wed, 19 Aug 2026 14:42:37 +0200

Should be added to Files/folders access rights, otherwise Default Cache Backend can be activated, but will just provide nonsense.

Or, additionally, when activating Default Cache Backend, or changing Filesystem foldername, a check should verify if folder exists and if permissions are sufficient.

0007604: The manufacturer name in the article page doesn't change due to cache reasons

Wed, 19 Aug 2026 14:22:07 +0200

If you change the manufacturer of a product while default backend cache is configured, the manufacturer name on the product details page doesn't change

0007630: After submitting the contact form, input values remain, so some people may submit the form twice

Tue, 18 Aug 2026 13:09:07 +0200

After submitting the contact form, input values remain, so some people may submit the form twice. There is a little information on top: "Thank you. OXID eShop appreciates your comments."
But this can easily be overlooked and the form is not empty, which is unusual behavior.

0004420: Discount title didn't change in basket

Fri, 14 Aug 2026 11:12:48 +0200

Discount title didn't change in basket when changing languages.

0006352: Validation Registration E-Mail is inconsistent

Thu, 13 Aug 2026 17:54:32 +0200

oxMailValidator::isValidEmail is using a preg_match with an inconsistence regex "eMailRule".

Better use php standard email validation:
filter_var($email_a, FILTER_VALIDATE_EMAIL)
http://php.net/manual/de/filter.examples.validation.php

0007992: Add a Twig Variable Library to the Visual CMS that provides an overview of all available Twig variables and functions for easier

Wed, 12 Aug 2026 15:17:48 +0200

The Visual CMS should include a built-in Twig Variable Library that serves as a reference for content editors and developers.

The library should:

Display all available Twig variables and functions.
Provide a short description of each variable/function.
Include usage examples.
Optionally allow users to insert variables directly into the editor.
Improve productivity and reduce errors caused by incorrect or unknown Twig variables.