Pagination URLs expose absolute server path via base_path parameter

[advansit]

Description

Product list pagination URLs include a base_path query parameter containing the absolute server filesystem path. This leaks server-internal information to the client.

Steps to reproduce

1. Create a product list with more than 20 products (default pagination limit)
2. View the shop page in a browser
3. Inspect the pagination links (page 2, next, etc.)

Expected result

Pagination URLs should not contain server filesystem paths.

Actual result

Pagination URLs contain:

/shop?base_path=/home/username/public_html/example.com/components/com_j2store&start=20

The base_path parameter exposes the absolute server path (information disclosure).

Environment

• Joomla 5.4.3
• J2Commerce (latest)
• PHP 8.1+

[j2commerce]

Thanks for reporting this issue. We will come up with a fix for the next release.