Critical checkout-blocking bug: authenticated customers are incorrectly processed as guests

File: components/com_j2commerce/src/Controller/CheckoutController.php
Method: shippingAddress()



An authenticated customer can become permanently blocked at the “Shipping Address” step when the J2Commerce session still contains: 
uaccount = guest

This can occur when the customer starts checkout as a guest and then logs in, or when their Joomla identity changes while the existing J2Commerce checkout session remains active.The checkout correctly recognizes the Joomla user and displays their saved address. However, CheckoutController::shippingAddress() determines the checkout type only from the stale uaccount session value:

 $uaccount = $session->get('uaccount', '', 'j2commerce');
 $isGuest  = ($uaccount === 'guest');

It does not verify whether the current Joomla user is authenticated. As a result, the generated checkout step contains a saved address for the authenticated customer but uses the guest checkout button and guest validation handler. However, it is sent to the wrong task:

checkout.guestShippingValidate

The guest validator consequently validates the empty new-address fields and returns errors such as:

  "error": {
    "email": "Email is required",
    "first_name": "First name is required",
    "last_name": "Last name is required",
    "address_1": "Address is required",
    "zip": "Postal code is required",
    "city": "City is required",
    "phone_1": "Phone is required"
  }

Because these fields are hidden while “Use existing address” is selected, the customer sees no meaningful validation message and cannot continue to the shipping and payment step. Opening checkout in a separate browser session resolves the problem because the new session does not contain the stale uaccount=guest value.

If the current Joomla identity is authenticated, the customer must never be handled as a guest, regardless of a stale J2Commerce uaccount session value. The existing address should be processed by: shippingAddressValidate

The shippingAddress() method determines $isGuest exclusively from the J2Commerce session: $isGuest = ($uaccount === 'guest');



Required fix

Normalize the J2Commerce account state against the current Joomla identity and only consider the customer a guest when no authenticated user exists:

$uaccount  = $session->get('uaccount', '', 'j2commerce');
$isLoggedIn = $user && (int) $user->id > 0;
if ($isLoggedIn && $uaccount === 'guest') {
    $uaccount = 'login';
    $session->set('uaccount', 'login', 'j2commerce');
}
$isGuest = !$isLoggedIn && $uaccount === 'guest';

This change has been tested in the affected checkout. After applying it, the request is sent to the correct shipping-address validator and the customer can proceed successfully.

best regards,
Chris / KK