What's New in JCTables 1.21.1 to 1.22.0

This page covers everything added or changed since JCTables 1.21.0: the security release 1.21.1, the plugin release 1.21.2, and 1.22.0, which is mostly about how tables look and what visitors can personalise. If your plugins were set up before 1.21.0, read How plugins work now first.

On this page

Quick overview

FeatureVersionWhat's newWhere to find itDefault
Plugin security rebuild1.21.0 1.21.1 1.21.2Plugins are safer: they can no longer be tricked into running things they should not. Older setups keep working, but check the plugin section.All front-end plugins—
Themes1.22.0Give your tables a whole new look in a few clicks. Pick a ready-made theme, or make your own, and choose which JCTables use it.Components → JCTables → Themes; Setup Options → ThemesDefault theme
No Access Message1.22.0Tell visitors why they can't see a table, e.g. "Please log in to see this table", instead of leaving an empty space.Each table, under No Data MessageBlank (table hidden)
Popup themes1.22.0A plugin's popup window can have its own look (for example "popup_class": "slate"), not just the page's.Plugin Config: popup_classPage theme
Remember Column Layout1.22.0Visitors can drag columns into a new order and resize them, and the table remembers how they left it.SQL Content SettingsYes
Rename Column1.22.0Visitors can rename a column heading, and the new name is remembered.Column formatter: editableTitle: true—
Allow Theme Selection1.22.0Visitors can switch the look of the table themselves, and it is remembered for next time.SQL Content SettingsNo
Allow Column Chooser1.22.0Visitors can show or hide columns to suit themselves.SQL Content SettingsNo
Remember Panel Layout1.22.0The tree, preview and detail panels stay the size the visitor left them.Setup OptionsYes
Node Icons1.22.0Use your own pictures as icons in the navigation tree.Navigation TreeviewBlank
Params editor (JSON)1.22.0Edit all of a JCTable's settings as text in one window, and copy them from one JCTable to another.Params column in the JCTables list—
JCTable Preview1.22.0See a JCTable exactly as visitors do, straight from the admin, without making a menu item first.Preview link in the JCTables list; Preview button on the edit page—
Plugin Name1.22.0Give each plugin a name so you can tell them apart on the edit page.Each plugin on the edit pageBlank
Admin translations1.22.0The admin is now available in French, Spanish, German, Italian, Portuguese and Dutch.Automatic—
Inline Edit plugin1.21.2Edit values right in the table cells.Plugins—
Data Form as a Table plugin1.21.2Show a data form as a table of rows.Plugins → Data Form—
Hidden values1.21.2Send extra values with a plugin that visitors never see.Plugin Config: hidden—
Config checking as you type1.21.2Mistakes in plugin settings are flagged as you type, before you save.Plugin Config and Tabulator fields—
Bulk Update: several fields, textarea1.21.2Change several fields on many rows in one go, with text boxes as well as drop-downs.Bulk Update plugin—
Min Selection1.21.2Make a plugin wait until enough rows are ticked.Each plugin0

How plugins work now (1.21.x)

1.21.0, 1.21.1 and 1.21.2

Versions 1.21.0 to 1.21.2 rebuilt the way front-end plugins talk to the server, to close security vulnerabilities (CVE-2026-76570; credit to Valentin Lobstein, Chocapikk). The rule behind every change is the same:

The server only trusts the plugin's own config, set by you in the admin. The visitor's browser can choose values, but it can no longer decide which table, which fields or which SQL is used.

Most sites need no changes. The table below lists what behaves differently, so you can check your plugins.

General

What changedVersionWhat it means for you
Security token required1.21.0Every front-end action that changes data (inline cell edit, delete row, Bulk Update, Insert Record, Update Record, Data Form save) must send Joomla's security token. JCTables does this for you. Custom JS that calls these tasks directly must send the token too.
Front-end data API closed1.21.0 1.21.1Data can only be read or changed through a JCTable and its plugins, by visitors allowed to see it. Calls that worked around this no longer return data.
updateTable column option removed1.21.0For inline editing of a table shown through a database view, use the Inline Edit plugin (1.21.2).
Values with quotes1.21.2Values containing quotes (e.g. O'Brien) now save correctly in every plugin.

Per plugin

PluginHow it works now
Insert Record
  • tableName always comes from the config. Master row data can no longer change it.
  • ##selectedMasterRow.xxx## placeholders are filled in only in the fields values (and hidden).
  • Fixed in 1.21.2: it failed on every request in 1.21.0 and 1.21.1.
Update Record
  • tableName and idField always come from the config.
  • Master row placeholders are filled in only in the fields values (and hidden).
  • The row is matched on idField if set, otherwise on the table's SQL ID field.
  • Fixed in 1.21.2: it failed on every request in 1.21.0 and 1.21.1.
Bulk Update
  • Only fields listed in its config (as text, textarea, date or list) can be updated. Each field's label, table and group come from the config.
  • Placeholders such as ##user.name## are filled in only in its hidden values, never in what visitors type. A visitor typing ##user.id## saves exactly that text.
  • Everything shown in the update preview is escaped.
Data Form
  • Only fields that exist in its own form HTML are saved. Extra fields sent by the browser are ignored.
  • The index field is never written.
  • The plugin must be a Data Form plugin. Column and table names are escaped.
Advanced Search
  • Works again (rebuilt in 1.21.2). The browser sends the search rules, not SQL.
  • The server builds the query only from the filters, operators and value types in the plugin's own filters config. A filter's field is used as the column if set, otherwise its id.
  • A search now applies only to the table its button belongs to.
Template preview, detail tablesMaster row values used to filter the preview and the detail tables are escaped.

Check after upgrading: an Advanced Search whose filters don't name the real column (in field or id), a Data Form whose save relied on fields not in its form HTML, or a Bulk Update field missing from its config will no longer work as before. Add the missing entries to the plugin config.

The right-click header menu

Several 1.22.0 features are used from the menu that opens when a visitor right-clicks a column header. Which items appear depends on your settings:

Menu itemAppears when
Rename columnThe column has editableTitle: true and Remember Column Layout is Yes
Choose Columns ▸Allow Column Chooser is Yes
Reset columnsRemember Column Layout is Yes
Select Theme ▸Allow Theme Selection is Yes

Themes

New in 1.22.0

A theme sets the whole look of a JCTable. It has two parts:

PartWhat it stylesChoices
Table theme (Tabulator)The data grid: headers, rows, cellsJCTables, Standard, Bootstrap 3, Bootstrap 4, Bootstrap 5, Bulma, Classic, Indigo, Materialize, Midnight, Modern, NavyBlue, Semantic UI, Simple, Site, Slate, Spreadsheet
Layout theme (EasyUI)Everything around the grid: panels, split bars, detail tabs, popups, menus, the Navigation TreeviewJCTables, Standard, Black, Bootstrap, Bootstrap 5, Classic, Gray, Indigo, Material, Metro, NavyBlue, Slate, Spreadsheet

Each choice is shown with a preview. Click the magnifier on a preview to see it full size (in the Themes list, click the preview itself). Click anywhere or press Esc to close it.

Managing themes

Go to Components → JCTables → Themes.

Choosing a theme for a JCTable

In the JCTable, go to Setup Options → Themes and pick either the default theme or a specific one.

Tip: JCTables that use the default theme all change together when you choose a different default.

Notes

No Access Message

New in 1.22.0 · Each table, under No Data Message · Default: blank

Each table has its own Access level, so a JCTable can be public while some of its tables are for registered users only. A visitor who isn't allowed to see a table used to get an empty space, with no idea why. Now you can say why.

No Access MessageA visitor without access sees
Blank (the default)Nothing: the table is hidden, as in earlier versions
Please log in to see this tableThe table, empty, with that message where the "Loading..." and "No data" messages appear
New in 1.22.0 · Plugin Config: popup_class

A plugin that opens a popup can give the popup a layout theme of its own, whatever theme the page uses. Name the theme in popup_class in the plugin's Config:

{
    "popup_class": "slate"
}
popup_classResult
"slate"The popup in the Slate layout theme: window, title bar, OK and Cancel buttons, form fields
"c1" to "c6"EasyUI's coloured title bar and border, as before
"slate my-popup"The Slate theme, plus the class my-popup for your Custom CSS
BlankThe page's layout theme

Theme names: black, bootstrap, bootstrap5, classic, default (Standard), gray, indigo, jctables, material, metro, navyblue, slate, spreadsheet, and any layout theme you add to media/com_jctables/css/easyui. Upper or lower case doesn't matter.

Notes

Remember Column Layout

New in 1.22.0 · SQL Content Settings · Default: Yes

Visitors can arrange the columns to suit themselves, and their browser remembers it.

Visitors canHow
Move columnsDrag a column header to a new position
Resize columnsDrag the edge of a column header

Your column formatter still sets everything else. The checkbox and row button columns stay in place.

Reset columns

Right-click a header → Reset columns puts the table back to how you set it up. Before resetting, it asks for confirmation and lists exactly what will be cleared, with the columns concerned:

Reset columns does not change a theme the visitor has chosen.

Rename Column

New in 1.22.0 · Requires Remember Column Layout

Let visitors give a column their own title. Add editableTitle: true to the column in the column formatter:

{title: "Customer", field: "customer_name", editableTitle: true}

Visitors then right-click the header → Rename column:

KeyAction
EnterKeep the new title
EscCancel
Empty title + EnterGo back to the original title

The new title is remembered with the column layout and cleared by Reset columns.

Allow Theme Selection

New in 1.22.0 · SQL Content Settings, below Remember Column Layout · Default: No

Lets visitors pick their own theme with right-click a header → Select Theme, which lists your published themes.

Allow Column Chooser

New in 1.22.0 · SQL Content Settings, below Allow Theme Selection · Default: No

Lets visitors show and hide columns with right-click a header → Choose Columns.

Deciding which columns are offered

Mark columns with choosable: true in the column formatter:

{title: "Phone",   field: "phone",   choosable: true},
{title: "Notes",   field: "notes",   choosable: true, visible: false},
{title: "Order #", field: "id"}
Column settingIn Choose ColumnsStarts
choosable: trueOfferedTicked (shown)
choosable: true, visible: falseOfferedUnticked (hidden until chosen)
No choosableNot offeredAs set

Existing tables: if no column has choosable: true, every column that isn't visible: false is offered. So you can switch the setting on without editing your column formatters.

A column hidden by a content plugin override stays hidden, and isn't offered.

Remember Panel Layout

New in 1.22.0 · Setup Options, below Split Height Anchor · Default: Yes

Each visitor's browser remembers how they leave the panels around the table:

RememberedNotes
Navigation Treeview widthAs dragged
Navigation Treeview collapsed or open
Split height between the master table and the preview or detail tablesKept as a percentage, so it fits other screen sizes
Record Preview widthKept as a percentage
Selected detail tab

Only what the visitor actually changes is remembered. Everything else keeps your settings.

Upgrading from a 1.22.0 test build? JCTables created with a pre-release build may still have this set to No. Open them and switch it to Yes.

Node Icons and the Navigation Treeview

New in 1.22.0 · Navigation Treeview, below Node Filter Placeholder

Use your own icons in the Navigation Treeview, one per tree level, separated by commas, top level first:

/images/region.png, /images/branch.png, /images/shop.png
LevelIcon
1st level/images/region.png
2nd level/images/branch.png
3rd level/images/shop.png
4th level and deeperUsual JCTables icon

The Navigation Treeview in 1.22.0

The treeview now uses EasyUI's own tree instead of Fancytree. It takes on the layout theme's colours and changes with Select Theme. Everything works as before:

Node titles can still contain HTML, so your tree SQL can format them. The open and close animation has been removed, so the tree responds instantly.

Custom code: Custom JS that called Fancytree, or Custom CSS aimed at .fancytree-* classes, no longer applies. The tree is now a ul.jct-tree-list with EasyUI's .tree-node and .tree-title.

Params editor (JSON)

New in 1.22.0 · Params column in the JCTables list

The link in the Params column opens all the table and plugin settings of that JCTable as JSON, in an editor with line numbers, syntax colouring and checking as you type.

Button or keyAction
Save or Ctrl+SSave the settings
Cancel or EscClose without saving
CopyCopy all the settings to the clipboard
PasteReplace all the settings with the clipboard

Tip: Copy and Paste make it easy to copy the settings of one JCTable to another.

JCTable Preview

New in 1.22.0 · Preview link in the JCTables list, next to Params · Preview button on the JCTable edit page

Click Preview to see a JCTable exactly as the site shows it, in a dialog as big as the window. You don't need a menu item or an article for it.

On the edit page, Preview shows the JCTable with its saved settings. Click Apply first to see changes you haven't saved yet.

In the dialogAction
ReloadLoad the JCTable again, e.g. after saving a change in another tab
Open in new tabShow it on its own page
×, Esc or a click outsideClose the preview

Ctrl+click (or middle-click) on Preview opens it straight in a new tab.

Who you are in the preview: the site shows the JCTable to you as its visitor, logged in on the site or as a guest. Your admin login doesn't count. To preview a JCTable whose Access level isn't Public, log in on the site in the same browser first.

Preview links are signed and last 12 hours, so nobody else can use them to open JCTables by id. After 12 hours, click Preview again.

Plugin Name

New in 1.22.0

Give each plugin a name to tell them apart on the edit page. A plugin's heading shows its name, or failing that its plugin action, and updates as you type:

NameHeading shown
My PluginPlugin 1 (My Plugin)
(blank), Inline Edit pluginPlugin 2 (Inline Edit)

The name is not shown on the site.

Admin translations

New in 1.22.0

The admin screens are now available in French (fr-FR), Spanish (es-ES), German (de-DE), Italian (it-IT), Portuguese (pt-PT) and Dutch (nl-NL). The content plugin's help is translated too.

Inline Edit plugin

New in 1.21.2

Sends inline cell edits of the listed fields to a different table. This is useful when the grid shows a database view. It replaces the updateTable column option removed in 1.21.0.

{"tableName": "orders", "indexField": "id", "fields": ["status", "notes"]}
ConfigMeaning
tableNameThe table the edits are saved to
indexFieldThe field that identifies the row
fieldsThe fields this plugin saves
hiddenOptional, see Hidden values

Columns still need an editor in the column formatter to be editable.

Data Form as a Table plugin

New in 1.21.2

As a Table plugin, Data Form opens an empty form and inserts a new record. This is handy on detail tables that have no rows yet. The table reloads after the insert.

{
  "tableName": "order_notes",
  "hidden": {"order_id": "##selectedMasterRow.id##", "user_id": "##user.id##"},
  "fields": {"description": "New note"}
}
ConfigMeaning
hiddenValues saved with the record but not on the form. These override form values with the same name.
fieldsValues filled in on the empty form, which the user can change

Blank form fields get the column's database default.

Hidden values

New in 1.21.2

hidden values are saved with the record but never shown to or changed by the user. They are ideal for audit fields:

"hidden": {"updated_by": "##user.id##", "updated_at": "##date.curdatetime##"}
PluginWhen hidden values are applied
Data FormOn insert and on edit
Inline EditWith every edit of its listed fields (user and date placeholders only)
Insert Record, Update RecordSame as fields, which keeps working
Bulk UpdateAs before

Config checking as you type

New in 1.21.2

Plugin Config, Tabulator Column Config and Custom Table Options are syntax coloured and checked as you type.

Bulk Update improvements

New in 1.21.2

Several fields at once

Click + Add another field to add more Field / New Value pairs, up to the number of fields the plugin offers, each field once.

Textarea field type

Use "type": "textarea" for a multi-line text box, for longer values such as notes. An optional "height", in pixels, sets its height (default 100).

{"field": "notes", "label": "Notes", "type": "textarea", "height": 150}

Min Selection

New in 1.21.2 · Each plugin, next to Max Selection · Default: 0

The least number of rows that must be ticked before the plugin runs. For example, set it to 1 for Bulk Update, a Table-type Update Record, Delete or Custom plugins. 0 keeps the previous behaviour.

Also improved

AreaChangeVersion
Settings storageTable and plugin settings are now stored as JSON. Tables move over when next saved, and nothing needs doing. Going back to an earlier version still works.1.22.0
Custom CSSFormer inline styles are now classes you can override: jct-popup-buttons, jct-popup-loading, jct-popup-loading-text, jct-tree-message, jct-selected-footer, jct-attribution1.22.0
Row Hover HighlightSet to No, it now keeps each theme's own row colours1.22.0
Tabulator persistenceNow works: column order, widths, visibility, sort and filters are kept, e.g. {persistence: {sort: true, filter: true, columns: true}}1.22.0
Content pluginOverrides such as table1|table_enabled="0" and table0|plugin1|button_label="..." now work. Values can use single quotes: {jctables id='1'}1.22.0
Row plugin iconsKeep their own size in every theme and site template1.22.0
Joomla 4 and 5Apply returns to the tab you were on1.22.0
Joomla 4 and 5Field help in an (i) popover, and textareas that resize wider as well as taller, as in Joomla 31.21.2
Plugin edit pagePlugins fill the full width, side by side, and widen with a textarea dragged wider1.21.2
Bulk Update on Joomla 5Popup layout fixed: Field and New Value are stacked and sized to the popup1.21.2
PHP 8.2Deprecation notices from the content plugin and the front end removed1.22.0