As this article says, the extension update system is now compulsory for all extensions in JED. I searched the web but did not find any satisfactory information about implementing it for my premium extensions. So here is my proposed solution-

  1. In extension's any class constructor add download id (or whatever) value (like dlid=12345678901) in extra_query column in #__update_sites table. This process depends on your own like you may take dlid input from extension's setting page and add it to the above table column via class constructor or any other ways.

  2. The Joomla update system will add this extra_query parameter at the end of your defined download URL(if I am wrong tell me!). If you set the download url in your update site xml file like this - http://www.yourwebsite.com/index.php?option=com_yourcom&task=comsubctrl.updateverify then the full download url will be - http://www.yourwebsite.com/index.php?option=com_yourcom&task=comsubctrl.updateverify&dlid=12345678901

  3. Now when the Joomla update system sends the request by the above url to your update website then your site's component's subcontroller's (comsubctrl) method updateverify() will verify the validity of dlid and then respond with the premium extension zip file. Then after getting the zip file in response, the Joomla update system installs that zip as a new updated extension.

These are my basic ways to handle updating premium extensions directly from the Joomla update manager. So kindly suggest corrections, alternatives or easier and more secure ways to do that. I hope this is gonna be a great post for implementing update system for everybody including myself.

  • Hi any experts here am i going right direction?. It's very important because we are dealing with commercial extensions so that hackers don't get access for free.
    – dev-m
    Commented Feb 20, 2017 at 22:30
  • hello no one interested in that important topic??
    – dev-m
    Commented Feb 24, 2017 at 11:48
  • As for now adding extra parameter to the update URL is the best way but I would also think about connecting the ID or any other parameter you gonna use with IP address. So basically customer will create the access key in your selling software and use it in the component. That way if he shares the key with other people or use it beyond what is in the license you can detect it easily. Commented Apr 13, 2017 at 18:30
  • you mean something like access key is related with the domain/IP address so that it can't be used in multiple site? need some elaboration from you, I will do something like that else access key can use anyone. Actually it's permitted to use same soft in some websites of the same buyer.
    – dev-m
    Commented Apr 13, 2017 at 21:12

1 Answer 1


You can develop a Joomla plugin in the 'installer' group. In this plugin user the Joomla event onInstallerBeforePackageDownload to modify the url of the request made to your server by the Joomla Update request and pass a key or other identification you may use to authorize the download.

Here is below an example of a component 'ABC' that uses an update server. The component xml would then include the following :

    <server type="extension" priority="1" name="Component ABC Updater"><![CDATA[http://www.mywebsite.com/updateserver.xml]]></server>

Create a new installer plugin that will handle the request to your site First create a plugin xml definition

<?xml version="1.0" encoding="utf-8"?><extension version="2.5" minimum_version="2.5.19" type="plugin" group="installer" method="upgrade">
<name>Installer - Your Website</name>
    <filename plugin="daycounts">daycounts.php</filename>

And the php file associated with it :


defined('_JEXEC') or die;

 * Handle commercial extension update authorization
 * @package     Joomla.Plugin
 * @since       2.5
class plgInstallerDaycounts extends JPlugin
    private $_hathor,$_installfrom;

     * Handle adding credentials to package download request
     * @param   string  $url        url from which package is going to be downloaded
     * @param   array   $headers    headers to be sent along the download request (key => value format)
     * @return  boolean true if credentials have been added to request or not our business, false otherwise (credentials not set by user)
     * @since   2.5
    public function onInstallerBeforePackageDownload(&$url, &$headers)
        $uri = JUri::getInstance($url);

        // I don't care about download URLs not coming from our site
        // Note: as the Download ID is common for all extensions, this plugin will be triggered for all
        // extensions with a download URL on our site
        $host = $uri->getHost();
        if (!in_array($host, array('www.yourwebsite.com', 'yourwebsite.com'))) {
            return true;

        //Read the component settings and read the download code that the customer entered 
        $params = JComponentHelper::getParams('com_abc');
        $download_code = $params->get('downloadcode','');
        // Append the Download ID to the download URL
        if (!empty($download_code))
            $uri->setVar('download_code', $download_code);
            $uri->setVar('noredirect', 1);
            $url = $uri->toString();
        } else {
            JFactory::getApplication()->enqueueMessage('Please enter your download code in the component settings','error');

        return true;
  • A extra_query column already added to the core table, forgot from which joomla version. I know of that plugin but it will be a additional plugin headache.
    – dev-m
    Commented Mar 4, 2017 at 9:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.