Guides and reference for Cybersalt's Joomla extensions

Release history for Cybersalt 0-9 and A-Z Menu. For install and usage instructions see the documentation.

📋 Cybersalt 0-9 and A-Z Menu — Changelog

v1.3.0 2026-10-20

Pro activation for updates, a new install card, the filter plugin switched on for you, and one consistent name everywhere. The menu itself works exactly as in 1.2.0.

🚀New Features

  • Pro Activation tab on the plugin. Enter the email of your cybersalt.com account and save, and the site checks your membership and receives new versions through Joomla's own update screen. The menu works with or without activation; only updates depend on it. The tab shows the status, any message from cybersalt.com, renew and sign-up links, and an installation ID with a copy button. The membership is re-checked once a day in the administrator, and straight away when you save the tab again. Clearing the email deactivates the site.
  • Install card. Installing or updating shows a Cybersalt card with what to do next: an Add the menu module button that opens a new module of the right type, a Plugin settings button, and a support link. It works in light and dark mode, and warns you if the filter plugin is switched off.
  • The filter plugin is switched on automatically on a fresh install. Updates leave it as it is, so a plugin you turned off on purpose stays off.

🔧Improvements

  • One name everywhere. The package and module are called Cybersalt 0-9 and A-Z Menu and the plugin System - Cybersalt 0-9 and A-Z Menu Filter, in all 17 languages. The old "CS 0-9 A-Z" short names are gone.
  • The package description now says Joomla 5 and 6.
  • The changelog and the full GPL licence text ship inside the package.

🐛Bug Fixes

  • Sort Order help text said it sets the order of the articles. It only reverses the order of the buttons; article order comes from the category menu item.

v1.2.0 2026-09-30

New options for the number buttons and child categories, a colour picker that pulls its swatches from your template, 17 languages, and a second security review. Recommended for all installs.

🔍Security

  • Fixed stored XSS through Custom CSS (High). The 1.1.0 filter on the Custom CSS field could be beaten with specially nested input, and its admin-only display gate meant any payload ran in Super Users' browsers. Every < in Custom CSS is now turned into the CSS escape \3C, so the value can't leave its style block by any route. The gate is gone, so Custom CSS now reaches ordinary visitors too (before, it was silently shown to Super Users only).
  • Fixed the letter filter leaking into other article modules (Medium). On a filtered page, Latest, Popular, Newsflash, Category and Articles modules were filtered as well, and with module caching on, a filtered result could be cached and shown site-wide. The filter now applies only to the category listing itself and is switched off before any template module position renders.
  • Fixed a 500 error from an array-style parameter (Low). A malformed address such as ?letter[]=a caused an error on any category page. Values that aren't plain text are now ignored by both the plugin and the module.
  • The plugin now validates its URL Parameter setting (Low). It uses the same rule the module already applied, and also rejects names Joomla routes on (id, option, view, Itemid, limitstart and so on), falling back to letter. Before this, id turned the category ID into the filter letter, and a stray space silently broke filtering.
  • The module's CSS goes through Joomla's asset manager instead of an inline <style> in the page body, so it gets the CSP nonce when the HTTP Headers plugin enforces one.
  • Tighter validation in the admin colour picker's configuration and the swatch shape, core CssIdentifier validation on the Module Class, and a cmd filter on the plugin's URL Parameter field.
  • The plugin no longer uses reflection to reach com_content's MVC factory, which also avoids a PHP 8.5 deprecation.

🚀New Features

  • Translations for the 17-language Cybersalt set: en-GB, nl-NL, de-DE, es-ES, fr-FR, it-IT, pt-BR, ru-RU, pl-PL, ja-JP, zh-CN, tr-TR, el-GR, cs-CZ, sv-SE, nb-NO and nn-NO, covering the module, plugin and package.
  • Show in Child Categories option for Limit to Categories (suggested by Bjorn). No = only the picked categories; Yes = only their child categories; Both = the picked categories and everything below them. Grandchildren and deeper count as children. The inline help spells out each choice with an example.
  • Number Buttons option, shown when Show 0-9 Link is Yes: one combined 0-9 button (as before) or ten separate 0 to 9 buttons. The plugin now accepts a single digit as a filter value.
  • Hover and Active border colours, alongside the existing normal border colour.
  • Colour picker for every colour setting (Coloris, the same picker the Energize Themes and VirtueMart Templates templates ship). It has an opacity slider and follows the admin's light or dark mode. Values stay plain hex, so existing settings carry over unchanged. Its quick-pick swatches come from the site's default template: colour settings in the template style first, then custom.css / user.css, then the main template stylesheet, most-used first. About two-thirds of the swatches are colours and the rest neutrals, with a fixed palette as the fallback.
  • Colour Picker tab for the admin picker's quick-pick swatches: size (20 to 40 px, always square), shape (circle, rounded, square, diamond) and how many swatches to offer (12 to 36). Changes apply live, without saving.

🔧Improvements

  • Package install script. It refuses to install below PHP 8.1 or Joomla 5.0, using Joomla's own translated messages. After an upgrade it removes a stale folder and clears the autoload cache. The package also stops the module and plugin from being uninstalled on their own from under it.
  • The module helper moved to the folder its namespace actually maps to, so it now autoloads normally.
  • Removed dead code for article pages, since the menu only ever renders on category listings.
  • Multi-choice settings (Number Buttons, Show in Child Categories, Swatch Shape) have their own button styling, with separate light and dark mode colours: a quiet outline when unselected and a solid, high-contrast fill when selected. The colour picker follows the admin's light or dark setting instead of only the operating system's.
  • The Button Styles tab is grouped into labelled sections: Button Colours, Hover Colours, Active Colours, Text, Border Shape, and Size and Layout.

🐛Bug Fixes

  • Pages 2 and up of a filtered list came back unfiltered on Joomla 5.2 and newer, whose pagination only carries an approved list of request parameters. The letter is now added to the pagination links explicitly.
  • Stale active button and a disappearing menu when module caching was on. Joomla's default module cache keys on the module alone, not the page address, so whichever page rendered the menu first was served on every page until the cache expired. The wrong button showed as active, the links pointed at the wrong category, and an empty render cached from a non-category page made the menu vanish. The module is never cached now. The caching options are gone from the Advanced tab, and the plugin switches caching off for modules saved under 1.1.0 that still have it on.

v1.1.0 2026-09-09

Security hardening pass plus the category-picker interface. Recommended for all installs.

🔍Security

  • Fixed stored XSS via the Custom CSS field (Medium). Any account with module-edit rights could close the style element and inject script that ran for visitors to a category page. The value is now filtered, and Custom CSS is only honoured for accounts with full admin rights.
  • Fixed CSS injection through the styling settings (Low). Every colour, size and keyword value is now checked against an allowlist, and anything else falls back to the default.
  • Hardened the letter filter. The filter value is re-validated inside the model rather than trusting the plugin alone. No injection was reachable before; this is defence in depth.
  • Bound the article lookup as an integer, escaped the menu's aria-label, and cast the module ID to an integer before output.

🐛Bug Fixes

  • Filtering returned the wrong articles when Joomla's System Cache was enabled. The cache treated ?letter=A and ?letter=B as the same page, so the first letter a guest requested was served for every other letter until the cache expired. The plugin now registers the parameter with Joomla so each letter is cached separately.
  • Would have failed on Joomla 6. The filtering models skipped some of the setup Joomla core performs. Joomla 5 filled in the gaps with deprecation notices, but Joomla 6 removes that fallback. The models are now set up the same way core does it.
  • The URL parameter could be set in two places that didn't stay in sync. Changing it on the module but not the plugin, or the other way round, left the buttons pointing at links the plugin ignored. The plugin is now the single source of truth and the module reads from it.
  • The filtering models identified themselves as the wrong component, which affected state keys and cache groups. They are now pinned to com_content.
  • Switched the filter to a faster, index-friendly database condition for both the article list and the pagination count.

🚀New Features

  • Update server. The package now registers Cybersalt's update server, so installed sites are told about future releases, including security fixes, under System → Update → Extensions.

🔧Improvements

  • Limit to Categories is now a proper multi-select category picker with removable tags, replacing the comma-separated ID text field. Existing comma-separated values keep working.

v1.0.1 2026-09-09

First working release. Version 1.0.0 could never filter anything.

🐛Bug Fixes

  • The core filtering mechanism was rewritten. 1.0.0 caused a fatal error on every filtered request.
  • Filtering now targets the model Joomla's category page actually uses.
  • The module no longer renders outside article category listings, whatever its menu assignment.

🚀New Features

  • Option to limit the menu to specific categories.
  • Each letter gets its own list cache, so switching letters can't return a stale result set or page count.

v1.0.0 2025-12

Initial build. Never functional; see 1.0.1.