From 58a876f6d1f1fc1b768c3fe5965addb4afc0c434 Mon Sep 17 00:00:00 2001 From: Jonathan Miller Date: Sun, 5 Jul 2026 17:03:09 -0500 Subject: [PATCH] docs(changelog): record component fix + backfill 02.56.07 security/integrity fixes Claude-Session: https://claude.ai/code/session_01WbGBN9VyRK61zczYWcCQ2i --- CHANGELOG.md | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2f44bc76..97f3ffc4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,10 +1,24 @@ # Changelog ## [Unreleased] -## [02.56.07] --- 2026-07-05 +### Fixed +- Component manifest `` reverted to the element-safe `MokoSuiteBackup`. The "Type - Name" display convention made Joomla derive the component element as `com_component-mokosuitebackup`, registering a duplicate component and leaving the real `com_mokosuitebackup` orphaned on the old version — the admin component appeared "stuck" and served the old UI (broken remote-destinations tab, legacy fields). (#213) ## [02.56.07] --- 2026-07-05 +### Security +- Mask the FTP password in `AjaxController::maskSecrets()`/`mergeExistingSecrets()` — stored FTP remotes no longer leak their password via `listRemotes`. (#169) +- Stop the API single-item view (`Backups/JsonapiView`) leaking the server `absolute_path`. (#187) +- SFTP uploader uses `StrictHostKeyChecking=accept-new` instead of `no`. (#182) + +### Fixed +- `DatabaseDumper` writes a real newline after `DROP TABLE` (was a literal `\n`), fixing streamed dumps. (#179) +- Profile-picker forms order by `id` instead of the dropped `ordering` column (query failed on upgraded sites). (#180) +- `uninstall.mysql.sql` now drops the snapshots table. (#181) +- CLI snapshot delete uses the real `data_file` column (was `file_path`, so files were never removed). (#184) +- Remove the duplicate pre-update backup — the content plugin no longer subscribes to `onExtensionBeforeUpdate` (owned by the system plugin). (#186) +- `DatabaseImporter` collects non-fatal statement errors (`getErrors()`/`hasErrors()`) so restores are no longer silent. (#188) + ## [02.56.05] --- 2026-07-05 ## [02.56.05] --- 2026-07-05