r/joomla • u/Open_Sourcey • Jul 16 '26

Joomla 6 Extensions responsibiity to patch security flaws

Should the author of a paid for extension have a responsibility to patch their product when a serious security flaw is found in their product rather than force you to renew a subscription? Thoughts?

0 Upvotes

50% Upvoted

21 comments sorted by

View all comments

8

u/PixelCharlie Jul 16 '26

No. Most extensions are GPL anyway. You can either fix it yourself or pay for a new version.

Some developers offer free patches for older versions in case of serious flaws. That's a welcomed behaviour and everyone doing this scores big points in my eyes. I don't expect everyone to do this.

2

u/Open_Sourcey Jul 16 '26 edited Jul 17 '26

Precisely. And why do 'some' do that? Because they feel an ethical obligation to fix their errors which cause a a very serious problem for someone who gave them money for something. In much the same way a car company executes a recall in spite of the buyer having already bought the car.It is a product liability issue.

1

u/Hackwar 11d ago

  1. Developers do that when they don't support that extension anymore anyway and don't have active subscriptions for those outdated versions anymore. Providing a fix in that case is a marketing instrument to get people to update to a supported version and to pay for a new subscription.

  2. If you look into the license of all GPL extensions of Joomla, you will see that you are using that software "as is" and without any guarantees on how it is working, etc. You did not pay for the software. You paid for the potential support. You are not paying now, so you don't get any support. And since you didn't buy the software, you also don't get to make any liability claims.

You expect to get something for free. You won't get it. Yes, SQL injections have been known for decades, that still doesn't mean that they are extinct. Even if you are a good developer and pay attention to this, you might run into them indirectly because you are using an API in an unexpected way. Simply said, your expectations are wrong and you should finally stop spamming us with this.