Joomla Users, ACL & session changes: Joomla 3 → 4, 5 and 6
20 issues in this guide
Identity, ACL, and session code full of JUser, JAccess, JSession, and JAuthentication will fatal when aliases drop. This guide groups 20 entries: JAccess, JAccess::getActions(), JAccessExceptionNotallowed, JAccessRule, JAccessRules, JAuthentication, JAuthenticationResponse, JFactory::getSession(), JFactory::getUser(), JRule, and 10 more. The replacement pattern is Joomla\CMS\User\User and UserHelper, Access::getActionsFromFile / getActionsFromData instead of removed getActions() shapes, $app->getIdentity() and $app->getSession() instead of JFactory getters, and Session remove() instead of clear('namespace') habits that no longer match. Password APIs move to hashPassword / verifyPassword. Remember-me cookie internals stay inside the cookie authentication plugin. Hop mix: 7 at Joomla 3 → 4; 13 at Joomla 5 → 6. Test with the BC plugin off on Joomla 5 so every Class "JUser" / "JAccess" / "JSession" hit is visible before Joomla 6. Catalog replacements in this guide include JAccess → Joomla\CMS\Access\Access; JAccess::getActions() → Access::getActionsFromFile() / getActionsFromData(); JAccessExceptionNotallowed → Joomla\CMS\Access\Exception\NotAllowed; JAccessRule → Joomla\CMS\Access\Rule. Open each h2 anchor for the full before/after, fix list, and error strings shipped in the reference data.
JACCESS-CLASS-001
JAccess
JAccess class name
JAccess is a Joomla 3 global class. Joomla 4 still has an alias. Joomla 5 needs the Behaviour – Backward Compatibility plugin. Native Joomla 6 does not load that alias — you get Class "JAccess" not found.
JAccess → Joomla\CMS\Access\Access
Dies at Joomla 5 → 6What you will see
- Class "JAccess" not found
- Class 'JAccess' not found
- Failed to open stream: JAccess
Symptoms people search
white screen after disabling compatibility plugin · class not found on Joomla 6 · works on Joomla 5 until I turn off backward compatibility
Replace this code
Swap JAccess for Joomla\CMS\Access\Access.
Joomla 3
Remove or stop calling this
JAccess::getInstance();
// or new JAccess()Joomla 4 / 6
Use this instead
use Joomla\CMS\Access\Access;
// Call the namespaced class. Do not keep the J prefix.How to fix it
- 1Add a use statement for Joomla\CMS\Access\Access.
- 2Replace every JAccess with the short class name from that use line.
- 3Disable Behaviour – Backward Compatibility on a Joomla 5 staging site. If it fatals, this class is still in the code.
Also known as
JAccess · Joomla\CMS\Access\Access · class alias · J prefix
JACCESS-GETACTIONS-001
JAccess::getActions()
JAccess::getActions()
getActions() was removed in Joomla 4. Load actions from access.xml.
JAccess::getActions() → Access::getActionsFromFile() / getActionsFromData()
Dies at Joomla 3 → 4What you will see
- Call to undefined method Joomla\CMS\Access\Access::getActions
Symptoms people search
ACL actions empty · getActions undefined
Replace this code
Swap JAccess::getActions() for Access::getActionsFromFile() / getActionsFromData().
Joomla 3
Remove or stop calling this
$actions = JAccess::getActions('com_lms');Joomla 4 / 6
Use this instead
use Joomla\CMS\Access\Access;
$actions = Access::getActionsFromFile(JPATH_ADMINISTRATOR . '/components/com_lms/access.xml');How to fix it
- 1Switch to getActionsFromFile or getActionsFromData.
Also known as
getActions · access.xml
JACCESSEX-CLASS-001
JAccessExceptionNotallowed
JAccessExceptionNotallowed class name
JAccessExceptionNotallowed is a Joomla 3 global class. Joomla 4 still has an alias. Joomla 5 needs the Behaviour – Backward Compatibility plugin. Native Joomla 6 does not load that alias — you get Class "JAccessExceptionNotallowed" not found.
JAccessExceptionNotallowed → Joomla\CMS\Access\Exception\NotAllowed
Dies at Joomla 5 → 6What you will see
- Class "JAccessExceptionNotallowed" not found
- Class 'JAccessExceptionNotallowed' not found
- Failed to open stream: JAccessExceptionNotallowed
Symptoms people search
white screen after disabling compatibility plugin · class not found on Joomla 6 · works on Joomla 5 until I turn off backward compatibility
Replace this code
Swap JAccessExceptionNotallowed for Joomla\CMS\Access\Exception\NotAllowed.
Joomla 3
Remove or stop calling this
JAccessExceptionNotallowed::getInstance();
// or new JAccessExceptionNotallowed()Joomla 4 / 6
Use this instead
use Joomla\CMS\Access\Exception\NotAllowed;
// Call the namespaced class. Do not keep the J prefix.How to fix it
- 1Add a use statement for Joomla\CMS\Access\Exception\NotAllowed.
- 2Replace every JAccessExceptionNotallowed with the short class name from that use line.
- 3Disable Behaviour – Backward Compatibility on a Joomla 5 staging site. If it fatals, this class is still in the code.
Also known as
JAccessExceptionNotallowed · Joomla\CMS\Access\Exception\NotAllowed · class alias · J prefix
JACCESSRULE-CLASS-001
JAccessRule
JAccessRule class name
JAccessRule is a Joomla 3 global class. Joomla 4 still has an alias. Joomla 5 needs the Behaviour – Backward Compatibility plugin. Native Joomla 6 does not load that alias — you get Class "JAccessRule" not found.
JAccessRule → Joomla\CMS\Access\Rule
Dies at Joomla 5 → 6What you will see
- Class "JAccessRule" not found
- Class 'JAccessRule' not found
- Failed to open stream: JAccessRule
Symptoms people search
white screen after disabling compatibility plugin · class not found on Joomla 6 · works on Joomla 5 until I turn off backward compatibility
Replace this code
Swap JAccessRule for Joomla\CMS\Access\Rule.
Joomla 3
Remove or stop calling this
JAccessRule::getInstance();
// or new JAccessRule()Joomla 4 / 6
Use this instead
use Joomla\CMS\Access\Rule;
// Call the namespaced class. Do not keep the J prefix.How to fix it
- 1Add a use statement for Joomla\CMS\Access\Rule.
- 2Replace every JAccessRule with the short class name from that use line.
- 3Disable Behaviour – Backward Compatibility on a Joomla 5 staging site. If it fatals, this class is still in the code.
Also known as
JAccessRule · Joomla\CMS\Access\Rule · class alias · J prefix · JRule
JACCESSRULES-CLASS-001
JAccessRules
JAccessRules class name
JAccessRules is a Joomla 3 global class. Joomla 4 still has an alias. Joomla 5 needs the Behaviour – Backward Compatibility plugin. Native Joomla 6 does not load that alias — you get Class "JAccessRules" not found.
JAccessRules → Joomla\CMS\Access\Rules
Dies at Joomla 5 → 6What you will see
- Class "JAccessRules" not found
- Class 'JAccessRules' not found
- Failed to open stream: JAccessRules
Symptoms people search
white screen after disabling compatibility plugin · class not found on Joomla 6 · works on Joomla 5 until I turn off backward compatibility
Replace this code
Swap JAccessRules for Joomla\CMS\Access\Rules.
Joomla 3
Remove or stop calling this
JAccessRules::getInstance();
// or new JAccessRules()Joomla 4 / 6
Use this instead
use Joomla\CMS\Access\Rules;
// Call the namespaced class. Do not keep the J prefix.How to fix it
- 1Add a use statement for Joomla\CMS\Access\Rules.
- 2Replace every JAccessRules with the short class name from that use line.
- 3Disable Behaviour – Backward Compatibility on a Joomla 5 staging site. If it fatals, this class is still in the code.
Also known as
JAccessRules · Joomla\CMS\Access\Rules · class alias · J prefix · JRules
JAUTHENTICATION-CLASS-001
JAuthentication
JAuthentication class name
JAuthentication is a Joomla 3 global class. Joomla 4 still has an alias. Joomla 5 needs the Behaviour – Backward Compatibility plugin. Native Joomla 6 does not load that alias — you get Class "JAuthentication" not found.
JAuthentication → Joomla\CMS\Authentication\Authentication
Dies at Joomla 5 → 6What you will see
- Class "JAuthentication" not found
- Class 'JAuthentication' not found
- Failed to open stream: JAuthentication
Symptoms people search
white screen after disabling compatibility plugin · class not found on Joomla 6 · works on Joomla 5 until I turn off backward compatibility
Replace this code
Swap JAuthentication for Joomla\CMS\Authentication\Authentication.
Joomla 3
Remove or stop calling this
JAuthentication::getInstance();
// or new JAuthentication()Joomla 4 / 6
Use this instead
use Joomla\CMS\Authentication\Authentication;
// Call the namespaced class. Do not keep the J prefix.How to fix it
- 1Add a use statement for Joomla\CMS\Authentication\Authentication.
- 2Replace every JAuthentication with the short class name from that use line.
- 3Disable Behaviour – Backward Compatibility on a Joomla 5 staging site. If it fatals, this class is still in the code.
Also known as
JAuthentication · Joomla\CMS\Authentication\Authentication · class alias · J prefix
JAUTHENTICATIONRESPONSE-CLASS-001
JAuthenticationResponse
JAuthenticationResponse class name
JAuthenticationResponse is a Joomla 3 global class. Joomla 4 still has an alias. Joomla 5 needs the Behaviour – Backward Compatibility plugin. Native Joomla 6 does not load that alias — you get Class "JAuthenticationResponse" not found.
JAuthenticationResponse → Joomla\CMS\Authentication\AuthenticationResponse
Dies at Joomla 5 → 6What you will see
- Class "JAuthenticationResponse" not found
- Class 'JAuthenticationResponse' not found
- Failed to open stream: JAuthenticationResponse
Symptoms people search
white screen after disabling compatibility plugin · class not found on Joomla 6 · works on Joomla 5 until I turn off backward compatibility
Replace this code
Swap JAuthenticationResponse for Joomla\CMS\Authentication\AuthenticationResponse.
Joomla 3
Remove or stop calling this
JAuthenticationResponse::getInstance();
// or new JAuthenticationResponse()Joomla 4 / 6
Use this instead
use Joomla\CMS\Authentication\AuthenticationResponse;
// Call the namespaced class. Do not keep the J prefix.How to fix it
- 1Add a use statement for Joomla\CMS\Authentication\AuthenticationResponse.
- 2Replace every JAuthenticationResponse with the short class name from that use line.
- 3Disable Behaviour – Backward Compatibility on a Joomla 5 staging site. If it fatals, this class is still in the code.
Also known as
JAuthenticationResponse · Joomla\CMS\Authentication\AuthenticationResponse · class alias · J prefix
JFACTORY-GETSESSION-001
JFactory::getSession()
Factory::getSession()
Session is an application service, not a Factory shortcut.
JFactory::getSession() → $app->getSession()
Dies at Joomla 5 → 6What you will see
- Factory::getSession is deprecated
Symptoms people search
session lost after upgrade · clear() wiped whole session
Replace this code
Swap JFactory::getSession() for $app->getSession().
Joomla 3
Remove or stop calling this
$session = JFactory::getSession();
$session->set('foo', 1);Joomla 4 / 6
Use this instead
$session = Factory::getApplication()->getSession();How to fix it
- 1Use $app->getSession().
- 2Replace Session::clear($key) with remove($key) — clear() now clears everything.
Also known as
getSession
JFACTORY-GETUSER-001
JFactory::getUser()
Factory::getUser()
Factory::getUser() is deprecated. The current user lives on the application.
JFactory::getUser() → $app->getIdentity() or UserFactoryInterface
Dies at Joomla 5 → 6What you will see
- Factory::getUser is deprecated
Symptoms people search
deprecation getUser
Replace this code
Swap JFactory::getUser() for $app->getIdentity() or UserFactoryInterface.
Joomla 3
Remove or stop calling this
$user = JFactory::getUser();Joomla 4 / 6
Use this instead
$user = Factory::getApplication()->getIdentity();How to fix it
- 1Replace getUser() with getIdentity() for the current user.
- 2To load another user by id, use the user factory.
Also known as
getUser · getIdentity
JRULE-CLASS-001
JRule
JRule class name
JRule is a Joomla 3 global class. Joomla 4 still has an alias. Joomla 5 needs the Behaviour – Backward Compatibility plugin. Native Joomla 6 does not load that alias — you get Class "JRule" not found.
JRule → Joomla\CMS\Access\Rule
Dies at Joomla 5 → 6What you will see
- Class "JRule" not found
- Class 'JRule' not found
- Failed to open stream: JRule
Symptoms people search
white screen after disabling compatibility plugin · class not found on Joomla 6 · works on Joomla 5 until I turn off backward compatibility
Replace this code
Swap JRule for Joomla\CMS\Access\Rule.
Joomla 3
Remove or stop calling this
JRule::getInstance();
// or new JRule()Joomla 4 / 6
Use this instead
use Joomla\CMS\Access\Rule;
// Call the namespaced class. Do not keep the J prefix.How to fix it
- 1Add a use statement for Joomla\CMS\Access\Rule.
- 2Replace every JRule with the short class name from that use line.
- 3Disable Behaviour – Backward Compatibility on a Joomla 5 staging site. If it fatals, this class is still in the code.
Also known as
JRule · Joomla\CMS\Access\Rule · class alias · J prefix · JAccessRule
JRULES-CLASS-001
JRules
JRules class name
JRules is a Joomla 3 global class. Joomla 4 still has an alias. Joomla 5 needs the Behaviour – Backward Compatibility plugin. Native Joomla 6 does not load that alias — you get Class "JRules" not found.
JRules → Joomla\CMS\Access\Rules
Dies at Joomla 5 → 6What you will see
- Class "JRules" not found
- Class 'JRules' not found
- Failed to open stream: JRules
Symptoms people search
white screen after disabling compatibility plugin · class not found on Joomla 6 · works on Joomla 5 until I turn off backward compatibility
Replace this code
Swap JRules for Joomla\CMS\Access\Rules.
Joomla 3
Remove or stop calling this
JRules::getInstance();
// or new JRules()Joomla 4 / 6
Use this instead
use Joomla\CMS\Access\Rules;
// Call the namespaced class. Do not keep the J prefix.How to fix it
- 1Add a use statement for Joomla\CMS\Access\Rules.
- 2Replace every JRules with the short class name from that use line.
- 3Disable Behaviour – Backward Compatibility on a Joomla 5 staging site. If it fatals, this class is still in the code.
Also known as
JRules · Joomla\CMS\Access\Rules · class alias · J prefix
JSESSION-CLASS-001
JSession
JSession class name
JSession is a Joomla 3 global class. Joomla 4 still has an alias. Joomla 5 needs the Behaviour – Backward Compatibility plugin. Native Joomla 6 does not load that alias — you get Class "JSession" not found.
JSession → Joomla\CMS\Session\Session
Dies at Joomla 5 → 6What you will see
- Class "JSession" not found
- Class 'JSession' not found
- Failed to open stream: JSession
Symptoms people search
white screen after disabling compatibility plugin · class not found on Joomla 6 · works on Joomla 5 until I turn off backward compatibility
Replace this code
Swap JSession for Joomla\CMS\Session\Session.
Joomla 3
Remove or stop calling this
JSession::getInstance();
// or new JSession()Joomla 4 / 6
Use this instead
use Joomla\CMS\Session\Session;
// Call the namespaced class. Do not keep the J prefix.How to fix it
- 1Add a use statement for Joomla\CMS\Session\Session.
- 2Replace every JSession with the short class name from that use line.
- 3Disable Behaviour – Backward Compatibility on a Joomla 5 staging site. If it fatals, this class is still in the code.
Also known as
JSession · Joomla\CMS\Session\Session · class alias · J prefix
JSESSION-CLEAR-001
$session->clear('mynamespace')
JSession::clear($key) now clears everything
In Joomla 4, clear() is not “clear this key”. Namespaced get/set is also deprecated. People think they logged out one value and they wiped the session.
$session->clear('mynamespace') → $session->remove($key)
Dies at Joomla 3 → 4Symptoms people search
users logged out randomly · cart emptied · session namespace
Replace this code
Swap $session->clear('mynamespace') for $session->remove($key).
Joomla 3
Remove or stop calling this
$session->clear('com_lms');
$session->get('foo', null, 'com_lms');Joomla 4 / 6
Use this instead
$session->remove('com_lms.foo');
// Do not pass a namespace argument to get/set.How to fix it
- 1Use remove() for one key.
- 2Prefix keys yourself instead of the old namespace argument.
Also known as
Session::clear · session namespace
JSESSION-GETINSTANCE-001
JSession::getInstance()
JSession::getInstance()
You do not construct the session. The application owns it.
JSession::getInstance() → $app->getSession()
Dies at Joomla 3 → 4What you will see
- JSession::getInstance is deprecated
Symptoms people search
getInstance session
Replace this code
Swap JSession::getInstance() for $app->getSession().
Joomla 3
Remove or stop calling this
$session = JSession::getInstance('none', $options);Joomla 4 / 6
Use this instead
$session = Factory::getApplication()->getSession();How to fix it
- 1Delete getInstance.
- 2Use $app->getSession().
Also known as
JSession::getInstance
JSESSIONSTORAGE-001
JSessionStorageDatabase
JSessionStorage*
Custom J3 session storage classes were removed.
JSessionStorageDatabase → Session HandlerInterface implementations
Dies at Joomla 3 → 4What you will see
- Class "JSessionStorage" not found
Symptoms people search
session handler fatal
Replace this code
Swap JSessionStorageDatabase for Session HandlerInterface implementations.
Joomla 3
Remove or stop calling this
class JSessionStorageRedis extends JSessionStorage {}Joomla 4 / 6
Use this instead
Implement SessionHandlerInterface / Psr\Session. Do not extend JSessionStorage.How to fix it
- 1Register a modern session handler in configuration or a service provider.
Also known as
JSessionStorage · JSessionStorageDatabase
There is no 1:1 swap for this one. The architecture changed. If you cannot rewrite it, Infyways can.
JUSER-CLASS-001
JUser
JUser class name
JUser is a Joomla 3 global class. Joomla 4 still has an alias. Joomla 5 needs the Behaviour – Backward Compatibility plugin. Native Joomla 6 does not load that alias — you get Class "JUser" not found.
JUser → Joomla\CMS\User\User
Dies at Joomla 5 → 6What you will see
- Class "JUser" not found
- Class 'JUser' not found
- Failed to open stream: JUser
Symptoms people search
white screen after disabling compatibility plugin · class not found on Joomla 6 · works on Joomla 5 until I turn off backward compatibility
Replace this code
Swap JUser for Joomla\CMS\User\User.
Joomla 3
Remove or stop calling this
JUser::getInstance();
// or new JUser()Joomla 4 / 6
Use this instead
use Joomla\CMS\User\User;
// Call the namespaced class. Do not keep the J prefix.How to fix it
- 1Add a use statement for Joomla\CMS\User\User.
- 2Replace every JUser with the short class name from that use line.
- 3Disable Behaviour – Backward Compatibility on a Joomla 5 staging site. If it fatals, this class is still in the code.
Also known as
JUser · Joomla\CMS\User\User · class alias · J prefix
JUSER-GETPARAMETERS-001
JUser::getParameters()
JUser::getParameters()
getParameters() was removed. User params are getParam/setParam.
JUser::getParameters() → getParam($key) / setParam()
Dies at Joomla 3 → 4What you will see
- Call to undefined method Joomla\CMS\User\User::getParameters
Symptoms people search
user timezone fatal · getParameters
Replace this code
Swap JUser::getParameters() for getParam($key) / setParam().
Joomla 3
Remove or stop calling this
$params = $user->getParameters();
$tz = $params->get('timezone');Joomla 4 / 6
Use this instead
$tz = $user->getParam('timezone');How to fix it
- 1Replace getParameters()->get with getParam.
Also known as
getParameters
JUSERHELPER-CLASS-001
JUserHelper
JUserHelper class name
JUserHelper is a Joomla 3 global class. Joomla 4 still has an alias. Joomla 5 needs the Behaviour – Backward Compatibility plugin. Native Joomla 6 does not load that alias — you get Class "JUserHelper" not found.
JUserHelper → Joomla\CMS\User\UserHelper
Dies at Joomla 5 → 6What you will see
- Class "JUserHelper" not found
- Class 'JUserHelper' not found
- Failed to open stream: JUserHelper
Symptoms people search
white screen after disabling compatibility plugin · class not found on Joomla 6 · works on Joomla 5 until I turn off backward compatibility
Replace this code
Swap JUserHelper for Joomla\CMS\User\UserHelper.
Joomla 3
Remove or stop calling this
JUserHelper::getInstance();
// or new JUserHelper()Joomla 4 / 6
Use this instead
use Joomla\CMS\User\UserHelper;
// Call the namespaced class. Do not keep the J prefix.How to fix it
- 1Add a use statement for Joomla\CMS\User\UserHelper.
- 2Replace every JUserHelper with the short class name from that use line.
- 3Disable Behaviour – Backward Compatibility on a Joomla 5 staging site. If it fatals, this class is still in the code.
Also known as
JUserHelper · Joomla\CMS\User\UserHelper · class alias · J prefix
JUSERHELPER-PASSWORD-001
JUserHelper::getCryptedPassword()
JUserHelper::getCryptedPassword / getSalt
The old salt + crypt helpers are gone. Use password_hash via UserHelper.
JUserHelper::getCryptedPassword() → UserHelper::hashPassword() / verifyPassword()
Dies at Joomla 3 → 4What you will see
- Call to undefined method ...::getCryptedPassword
- Call to undefined method ...::getSalt
Symptoms people search
login hash mismatch · getCryptedPassword
Replace this code
Swap JUserHelper::getCryptedPassword() for UserHelper::hashPassword() / verifyPassword().
Joomla 3
Remove or stop calling this
$hash = JUserHelper::getCryptedPassword($plain, $salt);Joomla 4 / 6
Use this instead
use Joomla\CMS\User\UserHelper;
$hash = UserHelper::hashPassword($plain);How to fix it
- 1hashPassword for new hashes.
- 2verifyPassword for checks.
- 3Never store unsalted MD5.
Also known as
getCryptedPassword · getSalt · hashPassword
There is no 1:1 swap for this one. The architecture changed. If you cannot rewrite it, Infyways can.
USERHELPER-REMEMBER-001
JUserHelper::getRememberCookieData()
JUserHelper remember-cookie helpers
Remember-cookie helpers were removed from UserHelper in Joomla 4.
JUserHelper::getRememberCookieData() → Cookie authentication plugin — do not call the helpers
Dies at Joomla 3 → 4What you will see
- Call to undefined method ...::getRememberCookieData
- Call to undefined method ...::invalidateCookie
Symptoms people search
remember me fatal · invalidateCookie
Replace this code
Swap JUserHelper::getRememberCookieData() for Cookie authentication plugin — do not call the helpers.
Joomla 3
Remove or stop calling this
JUserHelper::invalidateCookie($userId, $cookieName);Joomla 4 / 6
Use this instead
// Remember-me is the cookie auth plugin. Do not call removed UserHelper cookie methods.How to fix it
- 1Delete those calls.
- 2Use the authentication cookie plugin / User API.
Also known as
getRememberCookieData · invalidateCookie · remember cookie
There is no 1:1 swap for this one. The architecture changed. If you cannot rewrite it, Infyways can.