J5.x

J5.x:Pagination class removes query parameters

From Joomla! Documentation

Revision as of 16:53, 20 August 2024 by Daneel (talk | contribs) (Marked this version for translation)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

Errors reported

This release for Joomla 5.1.3 and 4.4.7 changed how the Pagination class generates links. After the update, previously added parameters are missing.

Versions affected

General Information

This pertains only to Joomla! version(s): 5.1.3, 4.4.7

What is the cause

So far, the links for the individual pages as well as the "first", "last", "next" and "previous" page automatically included all query parameters that are present in the current request. That behavior create a cache poisoning attack vector.

In order to mitigate that vector, a behavior change had to be introduced. The pagination class will by default only include the following query parameters into the URL generation process:

  • format
  • option
  • view
  • layout
  • tpl
  • id
  • Itemid

How to fix

If your extension needs additional parameters, you have to register them using the "setAdditionalUrlParam" method. See the Archive view of com_content as an example: https://github.com/joomla/joomla-cms/blob/51032f65eb10bb9a78be7c264b511a933740318e/components/com_content/src/View/Archive/HtmlView.php#L220