Joom Donation 7.6

⚠ Important Security Notice
Joom Donation 7.6 focuses especially on frontend security, where attackers may try to exploit user-facing forms, uploaded data, invoice generation, invoice download links, or payment callback processes to perform malicious actions.

Overview​

Joom Donation 7.6 is a security-focused release designed to improve the overall protection, reliability, and data validation of the extension.

By strengthening security in frontend areas, including invoice generation and invoice access control, this version helps provide a safer donation process for website owners, donors, and administrators while maintaining a smooth and user-friendly experience.

Key Security Improvements​

1. Improved Protection Against SQL Injection
This release improves data validation to help prevent unauthenticated blind SQL injection risks in frontend validation processes. Input data is now handled more securely before being processed by the system.
2. Stronger File Upload Restrictions
Joom Donation 7.6 improves file upload handling by adding stricter checks and restrictions. These improvements help prevent unsafe or unauthorized files from being uploaded through frontend forms or user-accessible areas.
3. Protection Against Reflected XSS
The donation form has been improved to reduce the risk of reflected Cross-Site Scripting — XSS. User-submitted data is now filtered and escaped more carefully before being displayed.
4. Improved Invoice Download Access Control
This release fixes an IDOR (Insecure Direct Object Reference) issue in invoice download. Additional access checks have been added to help ensure users can only download invoices they are authorized to access.
5. Improved Security for Invoice Generation
The invoice generation function has been improved with additional validation and security checks. These changes help prevent unauthorized or unexpected invoice creation and ensure invoice data is generated more safely.

Additional Security-Related Enhancements​

• Input filtering: User input is checked, cleaned, and validated more carefully before being processed.
• Payment IPN / callback validation: Payment notification and callback requests are validated more strictly to help ensure they come from trusted payment sources.
• Currency checking: Currency data is checked more carefully to help prevent invalid, unexpected, or manipulated payment values.
• Invoice storage protection: Security for the invoice storage folder has been improved to better protect generated invoice files.

⚠ Joomla 3 Security Fix Availability​

For customers who are still using Joom Donation on Joomla 3, we also provide a security-fixed version for Joomla 3 in specific cases.

Customers with a valid subscription, or customers whose subscription expired in 2026, can create a support ticket in the Joom Donation category. Our team will then provide the Joom Donation version for Joomla 3 that includes fixes for these security issues.

Summary​

Joom Donation 7.6 is an important security update, especially for frontend protection. It addresses common web security risks, strengthens user input handling, improves invoice generation security, improves invoice access control, improves payment validation, and makes the donation process more secure and reliable. Website administrators are strongly encouraged to update to Joom Donation 7.6 to benefit from these security improvements.

• Added JD Campaigns Slideshow module.
• Added JD Slider module.
• Added campaign QR code to Multi-step Donation page.
• Added 4-column layout support for campaigns grid view.
• Added email failure logging.
• Improved Simple Donation layout and form usability.
• Improved Multi-step Donation layout and currency display.
• Improved Configuration page and added visual color picker.
• Improved Dashboard data display.
• Improved email handling and fixed duplicate email issue.
• Improved Backend Fields Management.
• Improved Donation Failure page.
• Fixed Donation Complete page donor information issue.
• Hidden verification label for invisible captcha methods.
• Hidden empty email tags when no data is available.

1. Certificate Templates (Admin)
Create/Edit Templates: Design custom certificate templates using HTML and CSS
Template Fields:
Title and published status
HTML content with placeholder support
Optional CSS styles
Page size (A4/Letter) and orientation (Portrait/Landscape)
Optional logo, signature, and background images
Preview: Generate preview PDFs with sample data
Clone: Duplicate existing templates for easy customization
2. Campaign Configuration
Enable/Disable: Turn certificates on or off per campaign
Template Selection: Choose which template to use for each campaign
Email Settings: Option to send certificates via email automatically
Download Settings: Allow donors to download certificates from their donation history
Privacy Settings: Control whether donor names appear on certificates
3. Certificate Generation
Automatic: Certificates are generated automatically when donations are marked as completed/paid
Idempotent: Each donation receives only one certificate, even if processed multiple times
Secure: Certificate codes are randomly generated (24 characters)
Storage: PDFs are stored securely in /media/com_jdonation/certificates/
4. Email Distribution
Certificates can be automatically attached to thank-you emails
Customizable email subject and body via language strings
Tracks when certificates were sent
5. Donor Access
Download: Donors can download their certificates from the donation history page
Access Control: Only the donor who made the donation can download their certificate
Download Tracking: System tracks how many times each certificate is downloaded
6. Certificate Verification
Public Verification: Anyone can verify a certificate using its unique code
Verification Page: /index.php?option=com_jdonation&task=certificate.verify&code=XXXXX
Information Displayed:
Certificate code
Campaign name
Donation amount
Donation date
Certificate status
Privacy: Does not reveal donor identity or email
Template Placeholders
Use these placeholders in your certificate HTML templates:
{certificate_code} - Unique certificate code
{donation_id} - Donation record ID
{donor_name} - Donor's full name (or "Anonymous")
{donation_amount} - Formatted donation amount with currency
{donation_currency} - Currency code
{donation_date} - Formatted donation date
{campaign_title} - Campaign name
{campaign_id} - Campaign ID
{organization_name} - Site/organization name
{site_name} - Site name
{site_url} - Site URL
{verify_url} - URL to verify the certificate
Usage Instructions
For Administrators
1. Create Certificate Templates
Navigate to Components → Joom Donation → Certificate Templates
Click "New" to create a new template
Enter template details:
Title
Page size and orientation
HTML content (use placeholders)
Optional CSS styles
Optional logo, signature, and background images
Click "Preview" to see how it looks
Publish the template
2. Enable Certificates for a Campaign
Edit a campaign
Go to the "Certificates" tab
Enable "Enable Certificates"
Select a certificate template
Configure email and download options
Save the campaign
3. Managing Certificates
View all generated certificates in the database
Certificates are automatically created when donations are completed
Donors can access their certificates from their donation history
For Donors
1. Receiving Certificates
Certificates are automatically generated when your donation is processed
If enabled, you'll receive the certificate via email
You can always download your certificate from your donation history
2. Downloading Certificates
Log in to the site
Navigate to your donation history
Find your donation in the list
Click the three-dot menu
Select "Download Certificate"
3. Verifying Certificates
Look for the "Verify at" URL on your certificate
Visit that URL or go to the verification page
Enter your certificate code
View the verification details
Security Considerations
Access Control: Only donors can download their own certificates
Secure Storage: PDF files are stored outside the web root or protected by access controllers
Unique Codes: Certificate codes are cryptographically random (24 characters)
Verification: Public verification doesn't expose sensitive donor information
Idempotency: Duplicate certificates cannot be created for the same donation

• Added Conditional Custom Fields
• Show/hide fields based on selected options
• Improved donation form layout & field rendering
• Updated data handling/storage for custom fields
• General fixes and performance improvements

• Child Campaign Support: Now, you can create child campaigns under a parent donation campaign, making it easier to mobilize support and manage sub-campaigns for a larger cause.
• Enhanced Layouts: The My Campaigns, My Received Donations, Add/Edit Campaign, and Donation Details pages on the frontend have been redesigned for a more beautiful and intuitive user experience. On the backend, campaign management and statistics sections now display information more clearly and in greater detail, fully supporting the new parent-child campaign structure.
• Campaign Report and Data Export: Administrators can now export both comprehensive campaign reports and detailed campaign data as PDF flyers, providing an at-a-glance overview and in-depth information for each campaign.
• Improved Multiple Donation Layout: The multiple donation interface has been refined for better usability and clarity.
• Saved Payment Methods: Users’ payment methods are now securely stored, allowing for faster and more convenient donations without reselecting payment gateways.

• Fully Compatible with Joomla 6

v6.1 - Released on August 2025

• Upgraded payment library for the component
• Resolved campaign sharing issues
• Fixed currency selection in the Simple Donation form
• Enhanced payment process with improvements to Stripe Checkout and Paypal Standard Checkout

v6.0 - Released on June 2025

• Full Adoption of Latest Joomla Methods
• Experience the All - New Multi-Step Donation Form
• Discover the All - New Joom Donation Dashboard: Designed for Every User
• Effortless Database Backup & Import
• Enhanced Email Layouts & Effortless Migration in Joom Donation 6.0
• Backend Layouts Improved in Joom Donation 6.0
• Payment Descriptions for Gateways
• Donation Form Upgrades in Joom Donation 6.0!
• Enhanced Frontend Campaign Management for Owners
• Donation History Layout Improved

• Add a new QR code feature for donation campaigns, making it easier to share campaigns
• Add a new feature to share donation campaigns with friends and family through a sharing form
• Enhance the donors list display with Ajax method for faster loading, no page refresh, and improved mobile responsiveness
• Improve Donation history layout
• Improve PDF Invoices feature
• Improve modules
• Improve Joom Donation Acymailing plugin
• Update Omnipay Payment library
• Fix issues in previous versions

• Improve Donation layout (Pre-defined amounts) and credit form
• Add option to make invoices are read only
• Update Stripe, Stripe Checkout payment gateways
• Update style of custom fields Checkbox and Radio boxes
• Fix previous issues

• Improve Campaigns grid layout
• Improve Donation statistic layout
• Add option to cancel recurring donation from Backend side
• Fix issues in previous versions