MokoConsulting/MokoSuiteBackup
1
0
Fork 0
Code Issues 5 Pull Requests Packages Releases 3 Wiki Activity

fix: address code review — Apache 2.4 htaccess, browseDir traversal, SQL cast
Joomla: Extension CI / Tests (PHP 8.2) (pull_request) Has been cancelled
Details
Joomla: Extension CI / Tests (PHP 8.3) (pull_request) Has been cancelled
Details
Joomla: Extension CI / PHPStan Analysis (pull_request) Has been cancelled
Details
Universal: PR Check / Build RC Package (pull_request) Has been cancelled
Details
Universal: PR Check / Report Issues (pull_request) Has been cancelled
Details
Generic: Repo Health / Scripts governance (pull_request) Has been cancelled
Details
Generic: Repo Health / Repository health (pull_request) Has been cancelled
Details
Generic: Repo Health / Report Issues (pull_request) Has been cancelled
Details
Universal: PR Check / Branch Policy (pull_request) Has been cancelled
Details
Generic: Repo Health / Site Health (pull_request) Has been cancelled
Details
Generic: Repo Health / Access control (pull_request) Has been cancelled
Details
Joomla: Extension CI / Release Readiness Check (pull_request) Has been cancelled
Details
Joomla: Extension CI / Lint & Validate (pull_request) Has been cancelled
Details
Universal: Secret Scanning / Gitleaks Secret Scan (pull_request) Has been cancelled
Details
Universal: PR Check / Validate PR (pull_request) Has been cancelled
Details
Branch Cleanup / Delete merged branch (pull_request) Has been cancelled
Details
Universal: Pre-Release / Build Pre-Release (${{ inputs.stability || 'development' }}) (pull_request_target) Has been cancelled
Details
Universal: Build & Release / Build & Release Pipeline (pull_request) Has been cancelled
Details
Universal: Build & Release / Promote to RC (pull_request) Has been cancelled
Details
Generic: Repo Health / Site Health (push) Has been cancelled
Details
Generic: Repo Health / Access control (push) Has been cancelled
Details
Universal: Auto Version Bump / Version Bump (push) Has been cancelled
Details
Generic: Repo Health / Scripts governance (push) Has been cancelled
Details
Generic: Repo Health / Repository health (push) Has been cancelled
Details
Generic: Repo Health / Report Issues (push) Has been cancelled
Details

Browse Source 
- Update .htaccess content to support both Apache 2.4 (Require all denied)
  and Apache 2.2 (Order deny,allow) in all four locations
- Guard browseDir parent navigation to prevent escaping allowed boundaries
- Add explicit (int) cast on viewLog SQL query for defense-in-depth
This commit is contained in:
Jonathan Miller
2026-06-07 09:17:20 -05:00
parent e72a007041
commit 41b481dbfe
5 changed files with 17 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
source/packages/com_mokojoombackup/src/Controller/AjaxController.php
+13 -2
View File
@@ -136,10 +136,21 @@ class AjaxController extends BaseController
$parent = dirname($path);
// Ensure parent is still within allowed boundaries
$parentAllowed = false;
if ($parent !== $path) {
if ($jRoot !== false && strpos($parent, $jRoot) === 0) {
$parentAllowed = true;
} elseif ($homeDir !== '' && strpos($parent, $homeDir) === 0) {
$parentAllowed = true;
}
}
$response = [
'error' => false,
'current' => $path,
'parent' => ($parent !== $path) ? $parent : null,
'parent' => $parentAllowed ? $parent : null,
'dirs' => $dirs,
];
@@ -174,7 +185,7 @@ class AjaxController extends BaseController
$query = $db->getQuery(true)
->select($db->quoteName(['absolute_path', 'log']))
->from($db->quoteName('#__mokojoombackup_records'))
->where($db->quoteName('id') . ' = ' . $id);
->where($db->quoteName('id') . ' = ' . (int) $id);
$db->setQuery($query);
$record = $db->loadObject();
source/packages/com_mokojoombackup/src/Engine/BackupEngine.php
+1 -1
View File
@@ -530,7 +530,7 @@ class BackupEngine
$htaccess = $dir . '/.htaccess';
if (!is_file($htaccess)) {
if (@file_put_contents($htaccess, "Order deny,allow\nDeny from all\n") === false) {
if (@file_put_contents($htaccess, "# Apache 2.4+\n<IfModule mod_authz_core.c>\n Require all denied\n</IfModule>\n# Apache 2.2\n<IfModule !mod_authz_core.c>\n Order deny,allow\n Deny from all\n</IfModule>\n") === false) {
error_log('MokoJoomBackup: Could not create .htaccess in backup directory: ' . $dir);
}
}
source/packages/com_mokojoombackup/src/Engine/SteppedBackupEngine.php
+1 -1
View File
@@ -572,7 +572,7 @@ class SteppedBackupEngine
$htaccess = $dir . '/.htaccess';
if (!is_file($htaccess)) {
if (@file_put_contents($htaccess, "Order deny,allow\nDeny from all\n") === false) {
if (@file_put_contents($htaccess, "# Apache 2.4+\n<IfModule mod_authz_core.c>\n Require all denied\n</IfModule>\n# Apache 2.2\n<IfModule !mod_authz_core.c>\n Order deny,allow\n Deny from all\n</IfModule>\n") === false) {
error_log('MokoJoomBackup: Could not create .htaccess in backup directory: ' . $dir);
}
}
source/packages/com_mokojoombackup/src/Table/ProfileTable.php
+1 -1
View File
@@ -65,7 +65,7 @@ class ProfileTable extends Table
$htaccess = $resolved . '/.htaccess';
if (!is_file($htaccess)) {
if (@file_put_contents($htaccess, "Order deny,allow\nDeny from all\n") === false) {
if (@file_put_contents($htaccess, "# Apache 2.4+\n<IfModule mod_authz_core.c>\n Require all denied\n</IfModule>\n# Apache 2.2\n<IfModule !mod_authz_core.c>\n Order deny,allow\n Deny from all\n</IfModule>\n") === false) {
error_log('MokoJoomBackup: Could not create .htaccess in: ' . $resolved);
}
}
source/script.php
+1 -1
View File
@@ -198,7 +198,7 @@ class Pkg_MokoJoomBackupInstallerScript
mkdir($backupDir, 0755, true);
// Protect backup directory with .htaccess
file_put_contents($backupDir . '/.htaccess', "Order deny,allow\nDeny from all\n");
file_put_contents($backupDir . '/.htaccess', "# Apache 2.4+\n<IfModule mod_authz_core.c>\n Require all denied\n</IfModule>\n# Apache 2.2\n<IfModule !mod_authz_core.c>\n Order deny,allow\n Deny from all\n</IfModule>\n");
file_put_contents($backupDir . '/index.html', '<!DOCTYPE html><title></title>');
}
}