Solidshop Core 1.4.0 — admin quick search, a visible email queue, and a sharper product form

Core 1.4.0 is out, and it is a release about the hours you spend inside the admin. Finding an order used to mean picking the right list first and then filtering it. A failed notification email left no trace anywhere in the interface. And the product edit form asked every product the same questions, whether or not they applied.

All three are fixed here. 1.4.0 is also the core that a new add-ons pin: the Downloadable Products plugin — free.

Find anything from the admin header

The new Quick Search box sits in the Joomla administrator header on every page. Ctrl+K (or ⌘K on macOS) focuses it from anywhere, and so does / when you are not already typing in a field. Results come back grouped, with status badges and a “View all” link per group that deep-links into the matching list view with the filter already applied:

• Orders — order id, order reference, customer name or email, or the gateway transaction id.
• Products — product name, SKU or barcode, including variant SKUs and barcodes.
• Customers — name or email, restricted to users with actual commerce activity (an order or a saved address), so the box does not turn into a user manager.
• Discounts — discount name or coupon code.

What you type shapes the query: a number goes to ids and references first, something with an @ goes to the email columns, anything else falls back to a broad match. Each group carries its own permission check, so a user who may manage products but not orders simply gets fewer groups back rather than an error. The box is a full ARIA combobox — arrow keys move through results, and each result is announced — and feature plugins can add their own groups through a registration event, which is how invoices, subscriptions and reviews will appear there later.

Quick Search ships as an administrator module, mod_sshop_quicksearch, bundled with the core package. A fresh install publishes it into the header for you. On an update we deliberately do not touch your module layout, so you will get a notice pointing you at System › Administrator Modules — publish it to the status position once and it is there for good. The Quick Search documentation covers the shortcuts and what each group matches.

The email queue is no longer a black box

Solidshop queues every notification email and sends it from a scheduled task. That is the right design — checkout never waits on an SMTP server — but until now a message that failed to send was invisible. The merchant found out when the customer asked.

Components › Solidshop › Email Queue is a proper list over the queue: recipient, subject, context, the related order as a link, a delivery status badge, the attempt count and the last error message. Filter by status or context, search by recipient or subject (id: and order: prefixes are supported), and click a subject to preview the exact body that was stored for sending, in a new tab.

Rows that failed can be selected and retried from the toolbar: they go back to pending with a fresh attempt budget and are picked up by the next scheduled run. Rows can also be deleted. Access is gated by the same order-management permission the rest of the sales screens use.

The order detail toolbar gains Resend Confirmation. It re-renders the confirmation from the order’s current state — so a corrected address, an edited line or a fixed email template is reflected in what the customer receives — and queues the customer copy only. The queue’s per-recipient idempotency check still applies, and the resend is written to the order timeline, so there is a record of who asked for it and when.

Invoicing: approvals that gate, PDFs that cannot be guessed

Start with the one that is a privacy fix. Generated invoice PDFs were cached at a predictable path inside the web root — files/shop/{store}/invoice/{id}.pdf — with no server deny rules. Anyone who guessed the pattern could walk the integers and read other customers’ invoices. Filenames now carry a 64-bit token derived from your site secret, and the cache directory gets deny-all guard files (.htaccess, web.config, a blank index.html) dropped into it automatically — re-created if they ever go missing, and applied to existing installs the first time the directory is touched. Old token-less files are swept and regenerate on demand at their new names. On nginx, which honours neither guard file, the unguessable filename is the protection; add a deny rule for the directory if you want belt and braces.

The approval workflow now actually gates the things it claims to. The PDF and email task only processes issued invoices; approving an invoice re-queues its PDF so the file carries the approval-stamped date, and the customer email goes out strictly after approval, never before. Customers no longer see or download draft and pending invoices anywhere — account list, print view, PDF download and the order-detail button all agree. Approve is offered on drafts too, so a rejected invoice is not a dead end, and the admin list gained the Pending Approval filter option that was missing.

Two more invoicing corrections:

• Per-line tax. Invoice items now carry the tax aggregated from the order’s tax rows, so the Detailed layout’s tax column shows real numbers instead of zeros.
• Credit notes store negative amounts in every money column, which is what the documentation always described and what any accountant importing them expects.

A product form that fits the product

Solidshop products have had types since 1.3, but the edit form barely acknowledged them. This release rebuilds it around the type you pick.

• Pick the type from cards, not a dropdown. Creating a product now starts with a row of icon cards — Physical, Downloadable, Service, Subscription, whichever types your installed plugins register. On a saved product it goes back to being an ordinary dropdown.
• Changing the type reloads the form and keeps your unsaved edits, so the tabs on screen always match the type. The Shipping tab appears only for types that can actually be shipped.
• Track quantity defaults from the type. On for physical goods, off for downloads, services and subscriptions — you can still switch it on anywhere, for example a service with a limited number of seats.
• Tabs and sidebar reordered. SEO is its own tab instead of sharing one with publishing details, so the meta description, the page title and the search-result preview sit together; the sidebar groups status, type, category, brand, tags, access and language in one block.
• Drag and drop images onto the media area to upload them, instead of going through the media manager for every file.
• The summary editor no longer grows without limit, so a long description does not push everything else off the screen.

One bug fixed along the way is worth naming, because it produced a visible artefact on the storefront: a product saved without ever opening the media picker stored a phantom empty media entry, and the downloadable and service product layouts rendered an empty slideshow because of it. New saves no longer create the row, and existing bad rows are cleaned up the next time you save the product.

Also in this release

• Public order-tracking URLs are SEF-routed. The tracking view was missing from the router, so its links stayed in raw index.php?option=… form on sites with SEF URLs switched on.
• Emails sent from a payment callback are complete again. Renders triggered from a gateway’s AJAX capture flow — PayPal’s, for one — never passed through the component dispatcher, so plugin-contributed blocks and bank-transfer instructions were silently missing from those messages.
• Plugin-owned account pages moved their queries into models. The downloads, subscriptions and bookings account templates each carried their own SQL, copy-pasted into the Foundra override as well; they now ask a model. Foundra also shows a “plugin required” notice on those pages instead of querying tables that do not exist when the plugin is not installed.
• Cart totals line up. The Estimated total row is aligned with the Subtotal row above it.

Updating

Core 1.4.0 is a one-click update from System › Update, and it carries no schema changes — nothing to migrate, nothing to back out.

Two things to do afterwards. Publish the mod_sshop_quicksearch module to the status position (System › Administrator Modules) if you want the search box — updates never place modules for you. And if you customised the Order confirmation or Payment received email bodies, the email editor will show a drift banner: the defaults gained a “Your downloads” block for orders that contain digital files, and the payment-received wording no longer promises a shipment on an order with nothing to ship. Reset to the default, or copy the changes into your version.

For the complete, itemised list of every change, see the Solidshop changelog.