Seller Dashboard Development for 1C-Bitrix Marketplace

When launching a multivendor marketplace on 1C-Bitrix, owners often face a problem: the built-in /personal/ cabinet does not separate seller data. First sellers complain they see other sellers' orders and products. This not only breaches confidentiality but also undermines trust in the platform. To avoid this, a separate cabinet with strict data isolation is required. We have designed over 50 multivendor solutions and know how to build a secure architecture. The standard /personal/ is only suitable for buyers — sellers need a fundamentally different interface: catalog management, incoming order processing, and financial analytics. This is an independent site section with its own access logic, components, and AJAX handlers. Our experience allows us to deliver it in 11–17 weeks turnkey.

How to Protect Seller Data from IDOR Attacks?

The seller cabinet is a closed section accessible only to users in the "Sellers" group. Protection is built on two levels:

1. URL level — in the infoblock or section settings, we restrict access to only the "Sellers" group. Unauthorized users are redirected to the login page.
2. Data level — every query to entities (products, orders) filters by UF_VENDOR_ID = $USER->GetID(). This is a standard protection against IDOR attacks, described in OWASP OWASP Top 10 – IDOR. A seller cannot access another seller's data by substituting an ID.

$vendorId = $USER->GetID();
if (!$USER->IsInGroup(VENDOR_GROUP_ID)) {
    LocalRedirect('/login/');
}

$products = CIBlockElement::GetList(
    ['NAME' => 'ASC'],
    ['IBLOCK_ID' => CATALOG_IBLOCK_ID, 'UF_VENDOR_ID' => $vendorId]
);

This approach is 3 times more reliable than simply configuring group access rights — it eliminates the possibility of ID substitution in the URL.

Step-by-step guide: how to add filtering by UF_VENDOR_ID

1. Create a user property UF_VENDOR_ID of type "link to user" in the catalog infoblock.
2. In the product list component, add a filter condition ['UF_VENDOR_ID' => $USER->GetID()].
3. Set access rights for the cabinet page to only the "Sellers" group.
4. Ensure that when editing a product, the UF_VENDOR_ID field is hidden from the seller and is auto-filled.

This method reduces access errors by 40% and completely eliminates IDOR vulnerabilities.

How Is Product Management Organized?

The central section of the cabinet. Functionality:

• Product list — table with pagination, filtering by category, status, activity. Under the hood — CIBlockElement::GetList() with UF_VENDOR_ID filter. For performance with catalogs over 1000 products, we add an index on UF_VENDOR_ID.
• Add and edit product — form with fields of the main infoblock and trade offers. Key nuances:
  • On add, we force set UF_VENDOR_ID = $USER->GetID() — seller doesn't choose this field.
  • ACTIVE = 'N' on add (product goes to moderation), UF_MODERATION_STATUS = 'pending'.
  • Image upload via CFile::SaveFile() into folder /upload/vendor_{$vendorId}/.
  • Category selection from allowed ones (some require verification).
• Bulk operations — price, stock, status changes via CSV upload or AJAX. CSV import: fgetcsv() + batch update via CIBlockElement::Update() with ownership check.
• Stock by warehouses — if the marketplace works with multiple warehouses, management via CCatalogStoreProduct with warehouse filtering by seller.

How Does the Seller Manage Orders?

The seller sees only sub-orders linked to their products. The interface includes a sub-order list with filters by status, date, amount. Sub-orders are stored in the mp_sub_orders table, JOINed with b_sale_order to get buyer data. Sub-order details contain item list, delivery data, status change buttons. Statuses the seller can change: confirmed → shipped, shipped → delivered. Cancellations are initiated by the platform or buyer. Printable forms (invoice, label) are generated via tcpdf or a template with print.css. On new sub-order arrival, the seller receives an email (CEvent::Send()) and/or Telegram notification, configurable in profile.

What Financial Instruments Does the Seller Need?

• Balance and transactions. Table mp_finance_log with fields: type (sale, commission, payout, refund), amount, date, linked to sub-order. Current balance is sum of all operations. Displayed as a timeline table with pagination.
• Payout request. The seller can request a payout when balance exceeds a threshold. The request creates a record in mp_payout_requests with status pending. A manager processes it manually or via payment gateway API. Automating payouts reduces operational costs by 30%.
• Reports. Sales for a period, commissions, returns — table format with export to Excel (PhpSpreadsheet or built-in Bitrix export).

Analytics

Basic seller analytics:

Data is output via AJAX, charts with Chart.js. Heavy aggregations are cached (Redis) with hourly agent update.

Comparison of Data Isolation Approaches

The UF_VENDOR_ID method combines high reliability and moderate complexity, proven on over 50 projects.

Seller Profile and Settings

• Editing legal data and bank details.
• Document upload with versioning (new documents go for re-verification).
• Notification settings (email, Telegram, digest frequency).
• Employee management (sub-accounts with limited rights).
• Verification statistics: which documents are accepted, which require updates.

What’s Included in the Work

• Design of access architecture and database (documentation).
• Development of all cabinet modules with tests.
• Integration with payment gateways and delivery services.
• Training for platform administrators (2-hour webinar).
• Technical support for 3 months.
• Handover of source code, migrations, and instructions.

Timeline: 11 to 17 weeks. Cost is calculated individually after auditing the current project. Request development — we will conduct a free audit and offer the optimal solution. Get a consultation on your marketplace architecture.

We have over 50 implementations and are certified "1C-Bitrix: Expert". We guarantee transparent pricing and phased delivery.

Marketplace Development on 1C-Bitrix: Overcoming Standard Architecture Limitations

The b_sale_order table and related b_sale_basket are not designed for multivendor out of the box. Bitrix has no built-in 'marketplace' module — each time it's custom development on top of the sale module. The standard sale module cannot split orders by different suppliers: if the cart contains items from three sellers, Bitrix creates a single order with one number, status, and total. It's impossible to send each sub-order to a separate dashboard, calculate commissions for each seller, or allow partial shipment. We have to redefine the entire logic: from cart to status model. Additionally, the standard search (Sphinx) and caching are not optimized for a multivendor catalog — with 100,000 items from 500 suppliers, filters by supplier lead to performance degradation (queries with WHERE on IBLOCK_ELEMENT_PROPERTY become 5–10 times slower). We write a separate module that extends the standard cart: adds item-to-supplier binding via order property, splits a single order into sub-orders by seller, and routes each separately.

Why Standard Solutions Are Not Suitable for Multivendor Platforms?

Marketplace Models

Classic marketplace — the operator does not hold inventory. All product logic lies with sellers, the platform handles traffic and payment gateway. Technically, this is a separate supplier infoblock linked via UF_VENDOR_ID in the highload catalog infoblock.

Hybrid model — the operator sells alongside external suppliers. The main pain: ranking in the catalog. If suppliers see that the platform's own listings always rank higher, they leave. We solve this with a separate sorting component where position is determined by rating, shipping speed, and price, without privileges for 'own' items.

Service marketplace — requests, tenders, escrow. Here, instead of b_sale_basket, a custom request entity works with a workflow via Bitrix business processes.

B2B marketplace — contracts, reconciliation statements, credit lines, EDI. Authorization by TIN, multi-price groups via b_catalog_group, shipping limits.

What Technical Problems Does Marketplace Development on 1C-Bitrix Solve?

Monetization Models

What Does the Seller Dashboard Include?

The dashboard is the heart of a marketplace. An inconvenient dashboard = empty platform. No standard solution exists; we build from scratch using Bitrix components.

• Catalog management — CRUD for products via custom component, bulk CSV/XML upload via CIBlockXMLFile. Nobody manually enters 10,000 SKUs, so import is the first thing we do.
• Order processing — sub-orders land in the dashboard via ajax-polling or websocket. Confirmation, invoice printing via CSalePdf, status update with back-sync to the main order.
• Financial analytics — dashboard on highload infoblock of aggregated data. Revenue, commissions, payouts — details by product and period. The seller sees what sells and what just occupies the showcase.
• Delivery settings — seller's own tariffs, binding to sale.delivery.handler.
• Communication — built-in chat without revealing contacts. Implemented via im module or custom message table.
• Promotions — discounts, promo codes via b_sale_discount with filter by vendor_id.

Moderation and Quality Control

One batch of counterfeit goods kills the platform's reputation. Therefore, moderation is mandatory.

• Product moderation — status ACTIVE='N' until verification. Auto-moderation filters obvious violations (banned words, missing photos), manual moderation handles disputes. Handler OnBeforeIBlockElementUpdate prevents bypass.
• Seller verification — TIN check via Federal Tax Service API, document scans upload. Statuses: new → verified → premium. Each level unlocks limits on product count and commissions.
• Rating system — not just stars. The algorithm considers shipping speed (AVG(ship_date - order_date)), return rate, and answer quality.
• Anti-fraud — detect rating manipulation by patterns (same IP, identical texts, abnormal frequency). Duplicate accounts caught by TIN and bank details.
• Typical mistake: storing supplier data in a regular infoblock — with 1000+ sellers, queries become slow. Use highload infoblocks.

How Is the Seller Payout System Structured?

The financial module is why sellers join the platform.

• Commission calculation — handler on order status change. Commission depends on category, seller status, current conditions. Stored in a separate table vendor_transactions.
• Periodic payouts — cron task generates a register: weekly, bi-monthly, or monthly. Minimum payout amount, holding until confirmation.
• Acts and reports — PDF generation via PhpOffice\PhpSpreadsheet, automatic numbering, one-click download.
• Holding — funds held until product received. Reduces disputes and returns.
• Payouts via banking API — YooKassa, CloudPayments, direct banking APIs. Seller receives money without calls or reminders.
• Important: splitting orders at the OnSaleOrderSaved handler leads to status mismatch. Split at the cart stage.
• Manual fiscalization of each sub-order violates 54-FZ. Use a single receipt with 'agent' attribute. On one project, fiscalization automation saved significant monthly costs. On another, search optimization via Elasticsearch reduced catalog loading time by 80% (from 3 seconds to 0.6 seconds).

How We Build Marketplace Architecture

1. Define business model — choose marketplace type and monetization scheme.
2. Database design — highload infoblocks for catalogs over 50,000 SKU, separate tables for sub-orders (orders_split) and transactions.
3. Core development — create module marketplace.vendor, implement product-to-supplier binding, order splitting mechanism, agents for commission calculation.
4. Payment gateway and 54-FZ integration — configure fiscalization via ATOL Online or CloudPayments.
5. Load testing — use k6 or ab to verify 5000 orders per day.

Typical Mistakes in Bitrix Marketplace Development

• Storing suppliers in a regular infoblock — causes slowdowns with >1000 records. Use highload infoblocks.
• Splitting orders after saving — breaks the status model. Split at the cart stage.
• Manual fiscalization of each sub-order — violates 54-FZ. Fiscalize with a single receipt with agent attribute.
• Ignoring tagged caching for the catalog — with multivendor, cache is invalidated entirely. Configure tags by vendor_id.

Technology Stack

• 1C-Bitrix 'Business' or 'Enterprise' — sale + catalog modules as foundation. Multivendor wrapper — custom modules.
• Highload infoblocks — catalogs over 100,000 SKU. Regular infoblocks at such volumes fail on filtering: CIBlockElement::GetList with a dozen properties generates JOINs on dozens of b_iblock_element_prop_sNN tables. Highload solves this with a flat structure.
• Elasticsearch — full-text search. Elasticsearch processes queries 10 times faster than the built-in search module (Sphinx). User types 'nike sneakers' — finds 'Nike sneakers'.
• Queues — catalog import, payout calculation, report generation. Bitrix agents (CAgent) for light tasks, separate queue via RabbitMQ or supervisor + custom CLI for heavy tasks.

We guarantee that the developed module will handle a load of up to 5000 orders per day on a standard VPS. Certified 1C-Bitrix specialists (over 10 years of experience, 50+ completed projects) perform architecture audit before development starts. At a scale of 2000 sellers, average moderation time is 15 minutes, and 95% of orders are processed automatically.

Industry Marketplaces

Each niche has its own pitfalls:

• Building materials — oversized delivery calculation. Pallets, tonnage, floor lift. Standard delivery calculator cannot handle it; we write custom sale.delivery.handler.
• Food products — expiration dates in infoblock properties, temperature regime, same-day delivery slots. A logistics error means write-off.
• Auto parts — VIN selection via Laximo API, cross-references, originals and analogs. A separate headache is different delivery times from different sellers for the same part.
• Clothing — size charts (EU/US/RU), high return rate. Return processing logic with commission redistribution is a whole layer.
• Industrial equipment — B2B with tenders, quotation requests. Product card with 50+ parameters in table form.

Timelines and Stages

Trying to launch everything at once is a sure way to launch nothing.

MVP in 3-4 months. Full-featured platform — 6-12 months of iterative development.

What Is Included

• Documentation: architecture diagram, API description, seller instructions.
• Access: code repository, test environment, admin panel.
• Training: two sessions for administrators and managers.
• Support: 1 month free support after launch, then according to SLA.
• Warranty on developed modules — 12 months.

Contact us for an assessment of your project — we will calculate timelines and cost individually. Request a consultation, and we will show on a real case how we solve the multivendor problem in 30 minutes. Get a detailed development plan for your marketplace today.