This page covers everything added or changed since JCTables 1.21.0: the security release 1.21.1, the plugin release 1.21.2, and 1.22.0, which is mostly about how tables look and what visitors can personalise. If your plugins were set up before 1.21.0, read How plugins work now first.
| Feature | Version | What's new | Where to find it | Default |
|---|---|---|---|---|
| Plugin security rebuild | 1.21.0 1.21.1 1.21.2 | Plugins are safer: they can no longer be tricked into running things they should not. Older setups keep working, but check the plugin section. | All front-end plugins | — |
| Themes | 1.22.0 | Give your tables a whole new look in a few clicks. Pick a ready-made theme, or make your own, and choose which JCTables use it. | Components → JCTables → Themes; Setup Options → Themes | Default theme |
| No Access Message | 1.22.0 | Tell visitors why they can't see a table, e.g. "Please log in to see this table", instead of leaving an empty space. | Each table, under No Data Message | Blank (table hidden) |
| Popup themes | 1.22.0 | A plugin's popup window can have its own look (for example "popup_class": "slate"), not just the page's. | Plugin Config: popup_class | Page theme |
| Remember Column Layout | 1.22.0 | Visitors can drag columns into a new order and resize them, and the table remembers how they left it. | SQL Content Settings | Yes |
| Rename Column | 1.22.0 | Visitors can rename a column heading, and the new name is remembered. | Column formatter: editableTitle: true | — |
| Allow Theme Selection | 1.22.0 | Visitors can switch the look of the table themselves, and it is remembered for next time. | SQL Content Settings | No |
| Allow Column Chooser | 1.22.0 | Visitors can show or hide columns to suit themselves. | SQL Content Settings | No |
| Remember Panel Layout | 1.22.0 | The tree, preview and detail panels stay the size the visitor left them. | Setup Options | Yes |
| Node Icons | 1.22.0 | Use your own pictures as icons in the navigation tree. | Navigation Treeview | Blank |
| Params editor (JSON) | 1.22.0 | Edit all of a JCTable's settings as text in one window, and copy them from one JCTable to another. | Params column in the JCTables list | — |
| JCTable Preview | 1.22.0 | See a JCTable exactly as visitors do, straight from the admin, without making a menu item first. | Preview link in the JCTables list; Preview button on the edit page | — |
| Plugin Name | 1.22.0 | Give each plugin a name so you can tell them apart on the edit page. | Each plugin on the edit page | Blank |
| Admin translations | 1.22.0 | The admin is now available in French, Spanish, German, Italian, Portuguese and Dutch. | Automatic | — |
| Inline Edit plugin | 1.21.2 | Edit values right in the table cells. | Plugins | — |
| Data Form as a Table plugin | 1.21.2 | Show a data form as a table of rows. | Plugins → Data Form | — |
| Hidden values | 1.21.2 | Send extra values with a plugin that visitors never see. | Plugin Config: hidden | — |
| Config checking as you type | 1.21.2 | Mistakes in plugin settings are flagged as you type, before you save. | Plugin Config and Tabulator fields | — |
| Bulk Update: several fields, textarea | 1.21.2 | Change several fields on many rows in one go, with text boxes as well as drop-downs. | Bulk Update plugin | — |
| Min Selection | 1.21.2 | Make a plugin wait until enough rows are ticked. | Each plugin | 0 |
Versions 1.21.0 to 1.21.2 rebuilt the way front-end plugins talk to the server, to close security vulnerabilities (CVE-2026-76570; credit to Valentin Lobstein, Chocapikk). The rule behind every change is the same:
The server only trusts the plugin's own config, set by you in the admin. The visitor's browser can choose values, but it can no longer decide which table, which fields or which SQL is used.
Most sites need no changes. The table below lists what behaves differently, so you can check your plugins.
| What changed | Version | What it means for you |
|---|---|---|
| Security token required | 1.21.0 | Every front-end action that changes data (inline cell edit, delete row, Bulk Update, Insert Record, Update Record, Data Form save) must send Joomla's security token. JCTables does this for you. Custom JS that calls these tasks directly must send the token too. |
| Front-end data API closed | 1.21.0 1.21.1 | Data can only be read or changed through a JCTable and its plugins, by visitors allowed to see it. Calls that worked around this no longer return data. |
updateTable column option removed | 1.21.0 | For inline editing of a table shown through a database view, use the Inline Edit plugin (1.21.2). |
| Values with quotes | 1.21.2 | Values containing quotes (e.g. O'Brien) now save correctly in every plugin. |
| Plugin | How it works now |
|---|---|
| Insert Record |
|
| Update Record |
|
| Bulk Update |
|
| Data Form |
|
| Advanced Search |
|
| Template preview, detail tables | Master row values used to filter the preview and the detail tables are escaped. |
Check after upgrading: an Advanced Search whose filters don't name the real column (in field or id), a Data Form whose save relied on fields not in its form HTML, or a Bulk Update field missing from its config will no longer work as before. Add the missing entries to the plugin config.
Several 1.22.0 features are used from the menu that opens when a visitor right-clicks a column header. Which items appear depends on your settings:
| Menu item | Appears when |
|---|---|
| Rename column | The column has editableTitle: true and Remember Column Layout is Yes |
| Choose Columns ▸ | Allow Column Chooser is Yes |
| Reset columns | Remember Column Layout is Yes |
| Select Theme ▸ | Allow Theme Selection is Yes |
A theme sets the whole look of a JCTable. It has two parts:
| Part | What it styles | Choices |
|---|---|---|
| Table theme (Tabulator) | The data grid: headers, rows, cells | JCTables, Standard, Bootstrap 3, Bootstrap 4, Bootstrap 5, Bulma, Classic, Indigo, Materialize, Midnight, Modern, NavyBlue, Semantic UI, Simple, Site, Slate, Spreadsheet |
| Layout theme (EasyUI) | Everything around the grid: panels, split bars, detail tabs, popups, menus, the Navigation Treeview | JCTables, Standard, Black, Bootstrap, Bootstrap 5, Classic, Gray, Indigo, Material, Metro, NavyBlue, Slate, Spreadsheet |
Each choice is shown with a preview. Click the magnifier on a preview to see it full size (in the Themes list, click the preview itself). Click anywhere or press Esc to close it.
Go to Components → JCTables → Themes.
media/com_jctables/css are offered as choices too.In the JCTable, go to Setup Options → Themes and pick either the default theme or a specific one.
Tip: JCTables that use the default theme all change together when you choose a different default.
Each table has its own Access level, so a JCTable can be public while some of its tables are for registered users only. A visitor who isn't allowed to see a table used to get an empty space, with no idea why. Now you can say why.
| No Access Message | A visitor without access sees |
|---|---|
| Blank (the default) | Nothing: the table is hidden, as in earlier versions |
Please log in to see this table | The table, empty, with that message where the "Loading..." and "No data" messages appear |
Please <a href="/login">log in</a> to see the users.A plugin that opens a popup can give the popup a layout theme of its own, whatever theme the page uses. Name the theme in popup_class in the plugin's Config:
{
"popup_class": "slate"
}
popup_class | Result |
|---|---|
"slate" | The popup in the Slate layout theme: window, title bar, OK and Cancel buttons, form fields |
"c1" to "c6" | EasyUI's coloured title bar and border, as before |
"slate my-popup" | The Slate theme, plus the class my-popup for your Custom CSS |
| Blank | The page's layout theme |
Theme names: black, bootstrap, bootstrap5, classic, default (Standard), gray, indigo, jctables, material, metro, navyblue, slate, spreadsheet, and any layout theme you add to media/com_jctables/css/easyui. Upper or lower case doesn't matter.
jct-popup-<theme>, e.g. jct-popup-slate, which Custom CSS can use.Visitors can arrange the columns to suit themselves, and their browser remembers it.
| Visitors can | How |
|---|---|
| Move columns | Drag a column header to a new position |
| Resize columns | Drag the edge of a column header |
Your column formatter still sets everything else. The checkbox and row button columns stay in place.
Right-click a header → Reset columns puts the table back to how you set it up. Before resetting, it asks for confirmation and lists exactly what will be cleared, with the columns concerned:
Reset columns does not change a theme the visitor has chosen.
Let visitors give a column their own title. Add editableTitle: true to the column in the column formatter:
{title: "Customer", field: "customer_name", editableTitle: true}
Visitors then right-click the header → Rename column:
| Key | Action |
|---|---|
| Enter | Keep the new title |
| Esc | Cancel |
| Empty title + Enter | Go back to the original title |
The new title is remembered with the column layout and cleared by Reset columns.
Lets visitors pick their own theme with right-click a header → Select Theme, which lists your published themes.
Lets visitors show and hide columns with right-click a header → Choose Columns.
Mark columns with choosable: true in the column formatter:
{title: "Phone", field: "phone", choosable: true},
{title: "Notes", field: "notes", choosable: true, visible: false},
{title: "Order #", field: "id"}
| Column setting | In Choose Columns | Starts |
|---|---|---|
choosable: true | Offered | Ticked (shown) |
choosable: true, visible: false | Offered | Unticked (hidden until chosen) |
No choosable | Not offered | As set |
Existing tables: if no column has choosable: true, every column that isn't visible: false is offered. So you can switch the setting on without editing your column formatters.
A column hidden by a content plugin override stays hidden, and isn't offered.
Each visitor's browser remembers how they leave the panels around the table:
| Remembered | Notes |
|---|---|
| Navigation Treeview width | As dragged |
| Navigation Treeview collapsed or open | |
| Split height between the master table and the preview or detail tables | Kept as a percentage, so it fits other screen sizes |
| Record Preview width | Kept as a percentage |
| Selected detail tab |
Only what the visitor actually changes is remembered. Everything else keeps your settings.
Upgrading from a 1.22.0 test build? JCTables created with a pre-release build may still have this set to No. Open them and switch it to Yes.
Use your own icons in the Navigation Treeview, one per tree level, separated by commas, top level first:
/images/region.png, /images/branch.png, /images/shop.png
| Level | Icon |
|---|---|
| 1st level | /images/region.png |
| 2nd level | /images/branch.png |
| 3rd level | /images/shop.png |
| 4th level and deeper | Usual JCTables icon |
/images/region.png, , /images/shop.png) keeps the usual icon for that level.The treeview now uses EasyUI's own tree instead of Fancytree. It takes on the layout theme's colours and changes with Select Theme. Everything works as before:
##treenode## placeholdersNode titles can still contain HTML, so your tree SQL can format them. The open and close animation has been removed, so the tree responds instantly.
Custom code: Custom JS that called Fancytree, or Custom CSS aimed at .fancytree-* classes, no longer applies. The tree is now a ul.jct-tree-list with EasyUI's .tree-node and .tree-title.
The link in the Params column opens all the table and plugin settings of that JCTable as JSON, in an editor with line numbers, syntax colouring and checking as you type.
| Button or key | Action |
|---|---|
| Save or Ctrl+S | Save the settings |
| Cancel or Esc | Close without saving |
| Copy | Copy all the settings to the clipboard |
| Paste | Replace all the settings with the clipboard |
Tip: Copy and Paste make it easy to copy the settings of one JCTable to another.
Click Preview to see a JCTable exactly as the site shows it, in a dialog as big as the window. You don't need a menu item or an article for it.
On the edit page, Preview shows the JCTable with its saved settings. Click Apply first to see changes you haven't saved yet.
| In the dialog | Action |
|---|---|
| Reload | Load the JCTable again, e.g. after saving a change in another tab |
| Open in new tab | Show it on its own page |
| ×, Esc or a click outside | Close the preview |
Ctrl+click (or middle-click) on Preview opens it straight in a new tab.
Who you are in the preview: the site shows the JCTable to you as its visitor, logged in on the site or as a guest. Your admin login doesn't count. To preview a JCTable whose Access level isn't Public, log in on the site in the same browser first.
Preview links are signed and last 12 hours, so nobody else can use them to open JCTables by id. After 12 hours, click Preview again.
Give each plugin a name to tell them apart on the edit page. A plugin's heading shows its name, or failing that its plugin action, and updates as you type:
| Name | Heading shown |
|---|---|
| My Plugin | Plugin 1 (My Plugin) |
| (blank), Inline Edit plugin | Plugin 2 (Inline Edit) |
The name is not shown on the site.
The admin screens are now available in French (fr-FR), Spanish (es-ES), German (de-DE), Italian (it-IT), Portuguese (pt-PT) and Dutch (nl-NL). The content plugin's help is translated too.
Sends inline cell edits of the listed fields to a different table. This is useful when the grid shows a database view. It replaces the updateTable column option removed in 1.21.0.
{"tableName": "orders", "indexField": "id", "fields": ["status", "notes"]}
| Config | Meaning |
|---|---|
tableName | The table the edits are saved to |
indexField | The field that identifies the row |
fields | The fields this plugin saves |
hidden | Optional, see Hidden values |
Columns still need an editor in the column formatter to be editable.
As a Table plugin, Data Form opens an empty form and inserts a new record. This is handy on detail tables that have no rows yet. The table reloads after the insert.
{
"tableName": "order_notes",
"hidden": {"order_id": "##selectedMasterRow.id##", "user_id": "##user.id##"},
"fields": {"description": "New note"}
}
| Config | Meaning |
|---|---|
hidden | Values saved with the record but not on the form. These override form values with the same name. |
fields | Values filled in on the empty form, which the user can change |
Blank form fields get the column's database default.
hidden values are saved with the record but never shown to or changed by the user. They are ideal for audit fields:
"hidden": {"updated_by": "##user.id##", "updated_at": "##date.curdatetime##"}
| Plugin | When hidden values are applied |
|---|---|
| Data Form | On insert and on edit |
| Inline Edit | With every edit of its listed fields (user and date placeholders only) |
| Insert Record, Update Record | Same as fields, which keeps working |
| Bulk Update | As before |
Plugin Config, Tabulator Column Config and Custom Table Options are syntax coloured and checked as you type.
Click + Add another field to add more Field / New Value pairs, up to the number of fields the plugin offers, each field once.
Use "type": "textarea" for a multi-line text box, for longer values such as notes. An optional "height", in pixels, sets its height (default 100).
{"field": "notes", "label": "Notes", "type": "textarea", "height": 150}
The least number of rows that must be ticked before the plugin runs. For example, set it to 1 for Bulk Update, a Table-type Update Record, Delete or Custom plugins. 0 keeps the previous behaviour.
| Area | Change | Version |
|---|---|---|
| Settings storage | Table and plugin settings are now stored as JSON. Tables move over when next saved, and nothing needs doing. Going back to an earlier version still works. | 1.22.0 |
| Custom CSS | Former inline styles are now classes you can override: jct-popup-buttons, jct-popup-loading, jct-popup-loading-text, jct-tree-message, jct-selected-footer, jct-attribution | 1.22.0 |
| Row Hover Highlight | Set to No, it now keeps each theme's own row colours | 1.22.0 |
| Tabulator persistence | Now works: column order, widths, visibility, sort and filters are kept, e.g. {persistence: {sort: true, filter: true, columns: true}} | 1.22.0 |
| Content plugin | Overrides such as table1|table_enabled="0" and table0|plugin1|button_label="..." now work. Values can use single quotes: {jctables id='1'} | 1.22.0 |
| Row plugin icons | Keep their own size in every theme and site template | 1.22.0 |
| Joomla 4 and 5 | Apply returns to the tab you were on | 1.22.0 |
| Joomla 4 and 5 | Field help in an (i) popover, and textareas that resize wider as well as taller, as in Joomla 3 | 1.21.2 |
| Plugin edit page | Plugins fill the full width, side by side, and widen with a textarea dragged wider | 1.21.2 |
| Bulk Update on Joomla 5 | Popup layout fixed: Field and New Value are stacked and sized to the popup | 1.21.2 |
| PHP 8.2 | Deprecation notices from the content plugin and the front end removed | 1.22.0 |