#1033 Critical checkout-blocking bug: authenticated customers are incorrectly processed as guests

Posted in ‘Technical Support / Bugs’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

J2Commerce

Version
J2Commerce v6

Latest post by Adam Melcher on Saturday, 12 September 2026 15:53 UTC

Krzysztof Kuznowicz

File: components/com_j2commerce/src/Controller/CheckoutController.php
Method: shippingAddress()

An authenticated customer can become permanently blocked at the “Shipping Address” step when the J2Commerce session still contains: 
uaccount = guest

 

This can occur when the customer starts checkout as a guest and then logs in, or when their Joomla identity changes while the existing J2Commerce checkout session remains active.The checkout correctly recognizes the Joomla user and displays their saved address. However, CheckoutController::shippingAddress() determines the checkout type only from the stale uaccount session value:


 $uaccount = $session->get('uaccount', '', 'j2commerce');
 $isGuest  = ($uaccount === 'guest');

It does not verify whether the current Joomla user is authenticated. As a result, the generated checkout step contains a saved address for the authenticated customer but uses the guest checkout button and guest validation handler. However, it is sent to the wrong task:

checkout.guestShippingValidate

The guest validator consequently validates the empty new-address fields and returns errors such as:


  "error": {
    "email": "Email is required",
    "first_name": "First name is required",
    "last_name": "Last name is required",
    "address_1": "Address is required",
    "zip": "Postal code is required",
    "city": "City is required",
    "phone_1": "Phone is required"
  }

Because these fields are hidden while “Use existing address” is selected, the customer sees no meaningful validation message and cannot continue to the shipping and payment step. Opening checkout in a separate browser session resolves the problem because the new session does not contain the stale uaccount=guest value.

If the current Joomla identity is authenticated, the customer must never be handled as a guest, regardless of a stale J2Commerce uaccount session value. The existing address should be processed by: shippingAddressValidate

The shippingAddress() method determines $isGuest exclusively from the J2Commerce session: $isGuest = ($uaccount === 'guest');

Required fix

Normalize the J2Commerce account state against the current Joomla identity and only consider the customer a guest when no authenticated user exists:

 

$uaccount  = $session->get('uaccount', '', 'j2commerce');
$isLoggedIn = $user && (int) $user->id > 0;
if ($isLoggedIn && $uaccount === 'guest') {
    $uaccount = 'login';
    $session->set('uaccount', 'login', 'j2commerce');
}
$isGuest = !$isLoggedIn && $uaccount === 'guest';
 

This change has been tested in the affected checkout. After applying it, the request is sent to the correct shipping-address validator and the customer can proceed successfully.

best regards,
Chris / KK

Adam Melcher

Chris,

https://github.com/j2commerce/j2commerce/pull/2341

https://github.com/j2commerce/j2commerce/pull/2343

 

Thanks again and these will be released in the upcoming 6.6.2 release shortly.

Adam

Growing Together

Help us get back to #1 in the Joomla Extension Directory by leaving us a 5-Star review here.

Stay Updated

Subscribe for free and be the first to know about the latest features, updates, and new additions.