OXID eShop version 4.9.5 (CE + PE) & 5.2.5 (EE)

General hints for this package

  • Runs on PHP 5.3, 5.4, 5.5 and 5.6 versions.


For update instructions please see


No template changes in this patch.

Fixed Bugs

  • Prevent order recalculation for changes in order data that do not affect billing and prices. (Bug fix #5113)
  • Redirect 302 shall be 301 if title changes (Bug fix #5471 by @adriankirchner)
  • Added a language parameter to the URL if the browser language is different to the shop default language (Bug fix #5775 by @Max Boesing)
  • Amount of product variant stock value gets subtracted twice. (Bug fix #6050)

Bugtrack change log: https://bugs.oxid-esales.com/changelog_page.php?version_id=303

New Features

No new features in this patch.

Important information for developers

Enterprise Edition only: maintained version of Varnish updated to 4.0.3.

  • The file default.vcl now contains the configuration for Varnish 4.0.3 or higher
  • The file default_varnish_3.vcl contains the configuration for Varnish 3
  • OXID eShop works with both Varnish versions
  • Only the Varnish configuration file was changed and should be updated on existing installations
  • As Varnish version 3 is end of life, we will not support Varnish 3 any longer in the future

Please note: the name of the Varnish configuration file is configurable in Varnish, so please contact your hosting provider in order to find out the correct file name or provide the new configuration file to the hosting provider and request to update the provisioning setup.

In Varnish version 4.0.0, we found out that cookies were deleted because regular expressions were not interpreted as expected. This led to the following critical misbehaviour:

  • Products couldn’t be added to basket
  • Users were not able to log in

However, this seems to be fixed in Varnish 4.0.3. That’s why we support the Varnish 4 series from release 4.0.3 or higher. If you are affected by this issue and cannot upgrade to a newer Varnish version, try this workaround:

Edit line 463 in configuration file (default.vcl in most cases) from

set beresp.http.Set-Cookie = regsuball(beresp.http.Set-Cookie, "(, |^)[^@][^,|$]+", "");


set beresp.http.Set-Cookie = regsuball(beresp.http.Set-Cookie, "(, |^)[^@]", "");

Note: We did not test this workaround with Varnish 4.0.1 nor 4.0.2, so make sure to double check before rolling out to your production environment.