E-commerce v6.0.6

Release Date: March 6, 2026 Tags: CRITICAL FIXES, ORDER LIFECYCLE, DISCOUNT SYSTEM, INVENTORY, SECURITY

Overview

Version 6.0.6 is a comprehensive bug-fix and hardening release. It corrects critical flaws in the order lifecycle, discount system, inventory management, and download access control. It also closes a path traversal security vulnerability in the file download endpoints, unifies the discount flow into a single atomic path, and improves frontend calculation accuracy.

Update Instructions

After updating, run the following command in terminal:

pnpm updator

Fixed

Order lifecycle

• Fixed orders being marked completed the moment they were created, which left the admin cancel, reject and refund actions unreachable. An order for a physical product now stays pending until an admin acts on it, and only a downloadable product completes automatically after successful payment.
• Fixed admin status changes being unconstrained. A pending order can now move to completed, cancelled or rejected, a completed order to cancelled or rejected, and an order already in a final state cannot be moved again.
• Fixed cancelling or rejecting an order for a physical product leaving the reserved stock off the shelf. The stock is now restored using the same locking pattern used during checkout.

Discounts

• Fixed a discount record being able to hold only a percentage. Discount type — percentage, fixed amount or free shipping — along with amount, maximum uses and start date are now stored, so every discount type works rather than percentage discounts only.
• Fixed checking a discount code consuming it. A customer who validated a code and then abandoned checkout lost it permanently; validating a code now records nothing.
• Fixed the split discount flow. The discount is now looked up and locked inside the order transaction, every condition is checked there, and the usage record is written only once payment succeeds.
• Fixed discounts not being checked against the product being bought, so a code for one product could be applied to another. The discount's own product is now enforced on every lookup.
• Fixed a race on the maximum-uses limit, where simultaneous requests could all pass the check and overrun it. The count is now taken inside the locked order transaction.
• Fixed the expiry-date check comparing against the time the server started rather than the current time, so on a long-running server a discount could be saved with a date already past.

Order creation rolls back cleanly

• Fixed several failure paths during order creation — product not found, not enough stock, not enough balance, invalid discount — leaving an uncommitted transaction behind. Every failure now rolls the whole order back.

Security

• Fixed the download file-path guard matching on a prefix without a directory separator, so a folder whose name merely began with the uploads folder's name passed the check. Both download endpoints now require the separator, closing the path-traversal bypass.

Download access after a product is deactivated

• Fixed customers losing access to files they had already bought when the product was later deactivated — the download was refused outright. Product status is no longer consulted at download time; the purchase and the order status remain the only access gates.

Orders record what was charged

• Fixed the order record holding no pricing at all, leaving the wallet transaction log as the only trace of what a customer paid. An order now stores its subtotal, discount, shipping, tax, total, currency and wallet type, so admins and customers can see the breakdown directly.

Affiliate rewards

• Fixed affiliate rewards being issued only for downloadable purchases. Physical product purchases now generate rewards too.

Catalogue integrity

• Fixed two products created at the same moment under the same name being able to receive the same web address. Uniqueness is now enforced by the database rather than by a check made before the insert.
• Fixed an incorrect link between products and shipping methods that could never resolve. It has been removed.

Checkout figures now match what is charged

• Fixed the checkout screen calculating tax on the full subtotal and then subtracting the discount, while the charge calculates tax on the discounted subtotal. The displayed price differed from the amount actually taken; the screen now applies the discount first and matches the charge exactly.
• Fixed a discount being sent for every item in a multi-item basket. Discounts belong to one product and are now sent only for that product's item.
• Fixed basket items being submitted all at once, so a failure on a later item left an earlier one already charged with no way back. Items are now submitted one at a time; on a failure the remaining items are skipped and the customer is shown which succeeded and which failed.
• Fixed the order confirmation screen reading the basket after it had been emptied, so every figure showed $0.00. The order summary is now captured before the basket is cleared and used for the confirmation display.

Wishlist

• Fixed the wishlist living only in the browser, so it never synced across devices or sessions. Adding and removing now reach the server, applied locally straight away and rolled back if the server refuses.

Basket stock limits

• Fixed adding to the basket and changing a quantity not checking stock for physical products, so a customer could order more than existed. Both now refuse with an explanation when the quantity exceeds available stock.

Review spam

• Fixed product review submission having no rate limit. Reviews are now rate-limited.

Removed

• Removed an update call in the download endpoint that wrote nothing.
• Removed an unused order-placing method in the storefront that nothing called.
• Removed a product status lookup in the download endpoints that nothing read.