Permanent order receipts #

This page is for shop owners who want customers to reach their order receipt at any time. Every order can have a receipt with an address that never expires. A customer can bookmark it, print it, download it, or open it from the link in the order e-mail on any device, with or without an account.

Before, shop/orderview/<id> was the only link. For an order placed without an account it stopped working once the browser session expired, and its address said nothing about who may see it.

Turn it on #

1. Put this in settings/override/shop.ini.append.php:

   <?php /* #?ini charset="utf-8"?
   
   [OrderViewSettings]
   OrderLinkView=orderreceipt
   
   */ ?>

2. Clear the INI and template caches:

   php bin/php/ezcache.php --clear-tag=ini --allow-root-user
   php bin/php/ezcache.php --clear-tag=template --allow-root-user

3. Place a test order. The page after checkout, the order lists and customer order view in the standard design, and the order confirmation e-mail now link to shop/orderreceipt/<token>.

These places take their link from the order (eZOrder link_url), which is the receipt or shop/orderview as the setting says. The administration keeps linking orders to shop/orderview, where orders are managed.

The address #

https://example.com/shop/orderreceipt/<token>

The token is signed: it carries the order id, its creation time and its customer, signed with bcrypt at a low cost over a SHA-256 of a secret and the payload. The salt is derived from the same secret, so each order has exactly one receipt address, forever, and nothing is stored in the database. The misspelled shop/orderreciept/<token> redirects permanently to the canonical spelling. eZOrder gains receipt_url.

Who can open a receipt #

The page offers Print (the receipt alone, whatever the site design around it) and Download (a self-contained receipt-<number>.html). The footer says the link should be kept private.

The first version (24 September) required signing in, so a customer who clicked the link in the e-mail landed on a sign-in page. On 26 September the token itself became the key, and the setting AnonymousOrderLinkView was removed, because every order now links to its receipt when you ask for it.

Settings #

A checkout fix made on the way #

Cancel on the confirm order step used to come back with "You have no products in your basket", because checkout attaches the basket to its temporary order and the basket lookup could then not find it. eZBasket::currentBasket() now:

• takes the session's basket while its order is still temporary;
• gives a basket back (items and all) once its temporary order has been cancelled away;
• never returns a basket whose order is complete;
• matches no stored basket for a request without a session id.

The confirm order view no longer runs the confirm operation again on an order that was already placed (Back button, bookmark, second tab). It goes to the order view, or to the basket when no order waits.

Related pages #

• Store dashboard and order statuses, order list sorting
• Shop basket view name
• Behaviour changes, 16 to 30 September 2026
• Changelog 6.0.15
• Chronicle, 16 to 30 September 2026