Solidshop Core 1.0.6 — a security fix and a shipping accuracy pass

Solidshop Core 1.0.6 is available now. It is a small release with one important reason to install it quickly, plus a focused round of fixes to shipping rate calculation.

Security: SQL injection via cart option values

This release fixes an SQL injection vulnerability. Please update. Product-variant lookups didn't properly sanitise option-value IDs taken from the request. They are now validated and bound as parameters.

Our thanks to Krzysztof Zając of CERT PL, who reported the issue responsibly.

More accurate shipping rates

Four separate issues could make a shopper see the wrong shipping price — or none at all. All four are fixed:

• Weight-based rates use the whole shipment. Rates are now matched against the total weight of everything being shipped — variant weight multiplied by quantity, summed per shipping profile — instead of a single line's weight. Two of a 3 kg item now lands in the 6 kg bracket, as it should. Variant weights fall back to the product weight when they are not set.
• Multi-state zones match every state. A zone region covering several states only ever matched the last one on the list. All of them are now checked, so orders shipping to the other states in the region resolve to the right rate.
• Product-level profiles cover every variant. Assigning a shipping profile to a product now applies to all of its variants, and the variant picker is tri-state — so “the whole product”, “these specific variants”, and “none” are distinguishable instead of ambiguous.
• No more fatal on an unpriced zone. A shipping zone with no rates configured returned empty rather than raising a TypeError, and carrier rates that come back without a price are dropped instead of showing up as free shipping.

A tighter checkout

• Billing falls back to shipping. When a shopper does not supply a separate billing address, the order now mirrors the shipping address instead of leaving the billing fields empty — which matters for invoices and for payment providers that require one.
• Plus-addressed guests can check out. Guest email addresses are URL-encoded in address-form requests, so a This email address is being protected from spambots. You need JavaScript enabled to view it. style address no longer breaks the guest flow.
• Address validation. Street address and city are now required and filtered as strings, so orders can't be created with an address that isn't deliverable.

Star ratings on product cards

Product listings can now show a compact star rating under each product name, not just on the product detail page — so social proof does its work while shoppers are still browsing. Ratings are batch-loaded for the whole listing, so this costs no extra query per card. It appears when the Reviews & Ratings plugin is installed and a product has approved reviews.

Housekeeping

• Order status columns no longer carry foreign keys. Those columns store a status code, which is only unique within a status type — the constraint compared two unrelated numbering systems and could block perfectly valid codes. The indexes stay for list filtering; only the constraints are gone.
• The Task Scheduler health check now links task plugins that expose several routines, so you can jump straight to the one that needs scheduling.
• Translation fixes across the shipped languages, including malformed printf placeholders flagged by the JED Checker.

Updating

1.0.6 is a one-click update from System › Update. It runs a small migration automatically — it drops the three status foreign keys described above and normalises legacy zero variant weights to empty, so the fall-back to the product weight applies to stores that predate editable variant weights. There are no manual steps. Given the security fix, we'd suggest not sitting on this one.

For the complete, itemised list of changes, see the Solidshop changelog.