CE Phoenix Cart Forum

Hi,

Maybe I'm overthinking things here, but maybe this is something that needs addressing or at least thinking about?

Say for instance I downloaded a payment module and started using it, and it works great. BUT - six months down the line, the author discovers that there is a massive security vulnerability with his module and creates an update to address this.

However, in the meantime 200 shop owners are happily using the original module blissfully unaware that their payment system could be compromised.

Is there any way to be automatically subscribed to the addon discussion thread, or any way to inform people who have downloaded an addon of potential problems.

NOTE This is purely hypothetical, None of my addons or any others that I am aware of fall into this situation!

HI @Mort_Lemur

You are dead right. I do believe that with the paid for payment modules from @BrockleyJohn as far as I am aware you can get free downloads once you have purchased the addon as there are no limits set to most of the files. As the file name does not change in theory I believe you can get updates. Hopefully @BrockleyJohn could confirm this.

The other developers may have their own way of notifying past customers but to date I cannot ever remember having an email from any of them notifying me of any security updates, so may be this never happens. Saying that some developers could increase sales of addons if they did contact the customer letting them know of an update or added feature to the addon and could possible offer either free updates, or low cost updates.

I think any free addons would get updated by the creator if something serious was wrong with their code, but again I don't think I have ever seen this happen.

Does this go to prove that the core of Phoenix is solid.

Hi Steve,

I think any free addons would get updated by the creator if something serious was wrong with their code, but again I don't think I have ever seen this happen.

Agreed, but the point is, how would i know as a user of a mod i downloaded a year ago had been updated unless I constantly check the addons area, even then it is not really obvious which ones have been updated.

Also how would the author of a free mod know who to contact if one of his mods had serious flaws?

I haven't tried it but there is a subscribe button showing with the addons. See this screen shot.
Dan

It is possible to have in (the admin screen of) an add-on the ability to include update history of the add-on, and a link to get the latest version. @BrockleyJohn has included this in his USPS shipping paid add-on ...


The notice in the admin links to his web site, explaining the update ...

https://cartmart.uk/help-updating-pm-8.html

The only issue that I see with this is that you, as the shop owner, have to 'visit' the admin screen of this add-on to see if there are any updates.

M

(yes, the screen shot is of the admin in an older version of Phoenix, but, as you can see by the dates in the notice, the add-on 'history' is current)

Actually it doesn't display the whole history but any available updates so you are rather behind!
This is the preferred situation: I have been working on an addon manager that so far uploads the zip and installs/updates the addon; the intention being to pull the zip directly in future. The link to the help page will be replaced with a link to kick it off.
A dashboard module could show any that need updating.

I want in future to get admins to register their installation which will enable tracking the versions that are in use and will allow me to proactively notify of any important updates that are security related or a serious functional issue.

I have chosen not to require people to buy the addon again after a year if they want access to updates - I do not want to further discourage folk from updating their stores. However at some point I intend to introduce maintenance subscriptions for access to updates which will be very much cheaper if continuous, and somewhat cheaper if lapsed.

@Dan Cole

I haven't tried it but there is a subscribe button showing with the addons. See this screen shot.

I gave this a try and it does work - email notification when a mod is updated - So maybe worth subscribing to all the mods (free ones) that are installed.

BrockleyJohn wrote: ↑Sat Aug 08, 2026 6:33 am A dashboard module could show any that need updating.

I was wondering whether a security_check module would be better? And then make it best practise for all add-ons to include a file with a path or similar to their update-feed (maybe the add-ons area could even be made to create and add that file to the add-ons on upload?)

But I look forward to see your add-on manager! I have Zipurmans and like that a lot, but seeing the work you did with the updater, I'm quite sure I will buy the manager, once released.

//Daniel