A powerful, admin-configurable product finder for Magento 2 that guides customers through a step-by-step product selection process. Features a drag-and-drop profile builder, configurable product support, dynamic filtering, responsive frontend, and advanced price filtering.
Fix: Resolved GitHub CodeQL js/xss-through-dom warning within the frontend Product Finder.
Fix: Added strict validation for attribute set profile image URLs before assigning them to frontend <img> elements.
Fix: Restricted profile images to same-origin HTTP(S) URLs within /media/merlin_productfinder/, preventing untrusted URLs from being rendered.
Change: Refactored frontend image rendering to validate image URLs before assigning the src property.
Fix: Invalid image URLs are now safely ignored, preventing unsafe DOM injection while preserving existing functionality.
Fix: Replaced malformed em-dash characters in progressive AJAX status messages with Unicode escape sequences to prevent character encoding issues.
- Resolved GitHub CodeQL warning
js/xss-through-domaffecting profile image previews within the admin Profile Builder (view/adminhtml/web/js/profiles.js). - Added strict validation for profile image URLs before assigning them to the preview
<img>element. - Profile image previews now only accept same-origin HTTP(S) URLs within
/media/merlin_productfinder/. - Applied the same validation to both existing profile images and newly uploaded images before rendering them in the admin UI.
- Switched profile image preview updates from jQuery
.attr('src', ...)to.prop('src', ...)after URL validation. - Improved upload error handling to provide clearer feedback when invalid image URLs are returned.
- Internal JavaScript hardening only.
- No functional or configuration changes for administrators.
- Resolved CodeQL warning
js/incomplete-sanitizationwithin the admin Profile Builder (view/adminhtml/web/js/profiles.js). - Removed dynamic CSS selector generation for attribute set lookups.
- Attribute set names are now resolved using direct DOM value comparison instead of escaped selector strings, eliminating the need for manual sanitisation and improving code robustness.
- Internal JavaScript refactoring only.
- No changes to functionality, configuration, or the administrator user experience.
- Resolved an issue introduced during configurable product support that prevented the finder form from rendering correctly.
- Restored normal operation of the profile builder and frontend filtering.
- Full configurable product support.
- Compatible filtering for configurable and simple products within finder results.
- Corrected dependency injection type error in the Results controller constructor.
- The module Enable/Disable configuration now correctly controls frontend output.
- Product Finder widget and routes are no longer accessible when the module is disabled.
- Corrected
widget.xmlvalidation issues. - General widget configuration cleanup and compatibility improvements.
- Removed unsupported
show_in_wysiwygelement to restore Magento XML validation compatibility.
- Improved the "Save Profile JSON" instructions to make the profile building workflow clearer for administrators.
- Support for multiselect product attributes.
- Default content for both Custom HTML Above Form and Custom HTML Below Form configuration fields.
- Corrected currency symbol encoding issues.
- Resolved JavaScript encoding mismatches and malformed string literals.
- Restored attribute set image uploads within the Profile Builder.
- Completely redesigned drag-and-drop Profile Builder.
- Visual attribute builder for creating product finder steps without editing JSON manually.
- Attribute set image support integrated into the new builder.
- Side-by-side Available Attributes and Profile Steps interface.
- Complete redesign of the frontend user experience.
- Modernised responsive results page.
- Simplified configuration interface.
- Legacy profile builder controls.
- Legacy section ordering configuration.
- Obsolete attribute mapping interface.
- Price slider now respects Special Prices and automatically falls back to regular prices when required.
- Compact responsive price slider integrated directly into the Product Finder.
- Improved compatibility with progressive filtering and in-stock product selection.
- Optional image for each Attribute Set, displayed between the first and second questions on the frontend.
- Corrected mobile layout where discounted prices could be clipped on certain devices.
- Improved mobile product grid.
- Display two products per row on mobile devices.
- Prevented special prices from overflowing product cards.
- Refreshed Product Finder and Results pages with a modern responsive interface.
- Added progressive AJAX filtering so each selection only displays valid remaining options.
- Prevented customers from selecting attribute combinations with no matching products.
- Corrected button placement issues.
- Finder cache creation and flush tools within the Magento Admin.
- Corrected profile JSON saving when multiple profiles were created.
- Attribute Set labels now correctly use the actual Attribute Set name instead of generic identifiers.
-
Improved product pricing display with:
- Struck-through original price
- Prominent special price
- Automatic percentage discount badge
- Attribute Sets now display alphabetically throughout the frontend.
- Intelligent caching layer for Attribute Set options.
- Automatic cache invalidation whenever products or stock are updated.
- Finder now only displays options belonging to in-stock products.
- Product Finder now progresses naturally by revealing each subsequent step after completion of the previous one.
- Enable or disable the Product Finder.
- Drag-and-drop section ordering.
- Product attribute mapping through Magento Admin.
- Configurable Attribute Set selection.
- Custom HTML above and below the finder.
- Dynamic product filtering.
- Optional layered navigation.
- Widget support for CMS Pages, Blocks and Layouts.
- Responsive frontend.
- Price filtering.
- Extensible architecture.
| Route | Description |
|---|---|
/product-finder/ |
Product Finder |
/product-finder/index/results |
Results Page |
bin/magento module:enable Merlin_ProductFinder
bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento cache:flushStores → Configuration → Catalog → Merlin Product Finder
- Enable / Disable module
- Show Layered Navigation
- Allowed Attribute Sets
- Top Categories
- Create Attribute Set Profiles
- Drag-and-drop Profile Builder
- Attribute Set Images
- Custom HTML Above Form
- Custom HTML Below Form
- Price Slider
- Sorting
- Pagination
- Layered Navigation
- Supports both Simple and Configurable products.
- Supports Dropdown and Multiselect attributes.
- Product filtering automatically excludes unavailable attribute combinations.
- Fully responsive frontend.
- Designed for Magento 2.4.5+.
- Compatible with modern Magento coding standards and GitHub CodeQL scanning.