5 Commits

Author	SHA1	Message	Date
Jonathan Miller	2395a4eabc	fix: critical and high audit findings (#81) ... Fixes all critical and high severity issues from the codebase audit: CRITICAL: - #71: RestoreCommand passed wrong args to RestoreEngine (filepath instead of record ID) — CLI restore was completely broken - #72: JpaUnarchiver path traversal — added traversal rejection and realpath boundary check to prevent writes outside staging dir - #77: RestoreEngine staging path sanitized — $record->tag stripped of non-alphanumeric characters HIGH: - #75: (noted, AkeebaImporter unserialize needs separate refactor) - #76: BackupTable now deletes DB row before file — prevents data loss if DB delete fails - #78: API profiles endpoint now masks sensitive fields (passwords, keys, tokens) with '***' - #79: Webcron handler adds return after sendJsonResponse — prevents execution falling through on non-terminal close() - #80: BackupModel/ProfileModel loadFormData() now casts array to object — prevents TypeError on PHP 8.x form state restore PREFLIGHT HARDENING: - PreflightCheck::run() wrapped in try-catch for DB exceptions - mkdir() failure now includes actual error reason - Unresolved placeholders generate a warning instead of silent return Closes #71, closes #76, closes #77, closes #78, closes #79, closes #80 Ref #72, ref #81	2026-06-21 18:08:58 -05:00
Jonathan Miller	c466839a40	fix: final review — SQL injection, input escaping, undefined var ... Critical/High: - Fix undefined $configFile → $configPath in from-scratch config path - Escape all user input with addcslashes before interpolating into configuration.php (both regex-replace and HEREDOC paths) - Add getValidatedPrefix() helper — validates db_prefix format before use in SQL table names across all restore functions - fixPackageClientId() now warns user via enqueueMessage on failure - sanitizeConfiguration() logs error on file read failure Medium: - Content-Disposition header uses RFC 6266 rawurlencode (both admin and API download controllers) - Remove @unlink suppression, log warning on failure - viewLog() catch block now logs exception context - writeDefaultHtaccess() checks copy/write, returns status to caller - actionConfig() checks file_put_contents return value	2026-06-15 01:10:04 -05:00
Jonathan Miller	c381829fc5	fix: ACL review — missing checks, HTTP status codes, memory safety ... - Add ACL check (core.manage) to verify() — was completely unguarded - Add checkToken('get') to download() for CSRF protection - Wrap all setMessage() calls in Text::_() for proper translation - Add HTTP 403 status to all AJAX token/ACL denial responses - Add $status param to sendJson() helper - Wrap viewLog() DB query in try-catch, return JSON error on failure - Fix viewLog() file_get_contents to detect read errors vs missing - Replace API download() file_get_contents + base64 with streaming readfile() to prevent memory exhaustion on large backups - Gate backup profile selector in template behind backup.run permission	2026-06-13 07:42:23 -05:00
Jonathan Miller	ff5f0108b9	feat: wire up ACL permission checks across all controllers and views ... Enforce granular permissions defined in access.xml: Controllers (server-side enforcement): - BackupsController: start() → backup.run, download() → backup.download, restore() → backup.restore - AjaxController: init()/step() → backup.run, browseDir()/viewLog() → core.manage - API BackupsController: backup() → backup.run, download() → backup.download, profiles() → core.manage - ProfilesController: importAkeeba() → core.create Views (toolbar button visibility): - Backups: conditionally show Start, Restore, Delete, Preferences - Profiles: conditionally show Add, Edit, Import, Delete, Preferences - Profile edit: conditionally show Save/Apply based on create/edit Templates: - Backups list: hide download button when backup.download denied	2026-06-13 07:23:57 -05:00
Jonathan Miller	ace33b60fe	feat: rename mokojoombackup → mokosuitebackup, add [HOME] placeholder for backup directory ... Renames all sub-extensions from mokojoombackup to mokosuitebackup (package, component, 7 plugins, language files, manifests). Adds [HOME] placeholder to BackupDirectory and PlaceholderResolver so users can set backup_dir to [HOME]/backups (outside web root). Fixes folder browser "access denied" on PHP-FPM shared hosting where getenv('HOME') returns empty by adding POSIX and JPATH_ROOT fallback detection.	2026-06-11 12:24:27 -05:00