389 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
gitea-actions[bot]	01335ac70f	chore(release): build 01.31.00 [skip ci]	2026-06-22 00:47:04 +00:00
jmiller	35b7e2a0b8	Merge pull request 'feat: CLI snapshots, auto-verify integrity, snapshot REST API (#55, #65, #54)' (#90) from feat/batch-55-65-54 into main	2026-06-22 00:46:52 +00:00
Jonathan Miller	c72e950a25	feat: REST API endpoints for content snapshots (#54) ... Add five endpoints matching the existing backup API pattern: - GET /snapshots — list with pagination - POST /snapshot — create (content_types, description) - POST /snapshot/:id/restore — restore (mode, content_types) - DELETE /snapshot/:id — delete record + file - GET /snapshot/:id/download — stream JSON file ACL: mokosuitebackup.snapshot.manage for write ops, core.manage for read. Routes registered in webservices plugin alongside backup routes. Closes #54	2026-06-21 19:46:07 -05:00
Jonathan Miller	5dcba6d8cb	feat: auto-verify backup integrity after creation (#65) ... After archive is created and checksum computed, automatically verify: - Archive opens without error - Contains at least one entry - database.sql present when backup type includes database - First entry is readable (spot-check) Applied to both BackupEngine and SteppedBackupEngine. Throws RuntimeException on verification failure (backup marked as failed). Closes #65	2026-06-21 19:45:46 -05:00
Jonathan Miller	0638c2cef6	feat: CLI command for content snapshots (#55) ... Add `mokosuitebackup:snapshot` command with four actions: - create: --types=articles,categories,modules --description="text" - restore: --id=N --mode=replace|merge --types=articles - list: displays table of all snapshots - delete: --id=N removes file + DB record Closes #55	2026-06-21 19:45:09 -05:00
jmiller	fc0c1b05a6	chore: sync repo-health.yml from Template-Generic [skip ci]	2026-06-22 00:35:41 +00:00
jmiller	3547667158	chore: sync pr-check.yml from Template-Generic [skip ci]	2026-06-22 00:35:40 +00:00
jmiller	b882e8ba90	chore: sync issue-branch.yml from Template-Generic [skip ci]	2026-06-22 00:35:39 +00:00
jmiller	db2beef189	chore: sync auto-release.yml from Template-Generic [skip ci]	2026-06-22 00:35:37 +00:00
jmiller	b0629f9f30	chore: sync auto-bump.yml from Template-Generic [skip ci]	2026-06-22 00:35:37 +00:00
gitea-actions[bot]	b3d955e1a8	chore: promote changelog [Unreleased] → [01.30.00]	2026-06-22 00:34:05 +00:00
gitea-actions[bot]	f5e8d0fe03	chore(release): build 01.30.00 [skip ci]	2026-06-22 00:34:02 +00:00
jmiller	5815a65a39	Merge pull request 'feat: Snapshot retention, extended snapshots, graceful remote degradation (#63, #57, #66)' (#89) from feat/batch-63-57-66 into main	2026-06-22 00:33:51 +00:00
Jonathan Miller	ad1c0cf349	fix: scope #__fields_values dump and restore to com_content.article ... The fields_values table is shared across all Joomla extensions. Previously, dump captured ALL field values and restore deleted ALL field values, destroying data for contacts, users, and other extensions. Now scoped via subquery on field_id WHERE context = 'com_content.article'.	2026-06-21 19:32:23 -05:00
Jonathan Miller	8b6e260b28	fix: graceful degradation when remote upload fails (#66) ... Remote upload failure (S3/FTP/GDrive) no longer marks the entire backup as failed. The local archive is preserved with status 'complete' and the upload failure is logged as a warning. Applies to both BackupEngine and SteppedBackupEngine. Closes #66	2026-06-21 19:09:20 -05:00
Jonathan Miller	eb7f48d3a2	feat: extend snapshots to include custom fields and tags (#57) ... When articles are included in a snapshot, now also captures: - #__tags (tag definitions) - #__fields (custom field definitions for com_content.article) - #__fields_values (custom field values) - #__fields_categories (field-to-category mappings) Restore correctly scopes deletes to avoid touching non-content fields. Closes #57	2026-06-21 19:08:53 -05:00
Jonathan Miller	974b971340	feat: snapshot retention and automatic cleanup (#63) ... Add retention settings for content snapshots (max count, max age days) in component options. System plugin runs cleanupOldSnapshots() alongside existing backup cleanup, deleting JSON files and DB records. Closes #63	2026-06-21 19:08:27 -05:00
gitea-actions[bot]	c299798542	chore: promote changelog [Unreleased] → [01.27.03] alpha beta	2026-06-21 23:57:36 +00:00
gitea-actions[bot]	612dc4acd5	chore(release): build 01.27.03 [skip ci]	2026-06-21 23:57:32 +00:00
jmiller	cdb54f6a3e	Merge pull request 'fix: Remove orphaned root-level webservices plugin files' (#87) from fix/remove-orphaned-root-files into main	2026-06-21 23:56:04 +00:00
jmiller	6fbc91527e	chore: remove unused Makefile - builds handled by CI auto-release	2026-06-21 23:55:32 +00:00
Jonathan Miller	57bfb37be1	fix: remove orphaned root-level webservices plugin files ... The root mokosuitebackup.xml and mokosuitebackup.php are stale copies from before the code was restructured into source/packages/. The webservices plugin lives at source/packages/plg_webservices_mokosuitebackup/ with its own manifest and src/ directory. The root manifest still referenced <folder>src</folder> but that directory was removed in PR #82, causing Joomla installer to fail with "File does not exist [ROOT][TMP]/.../mokosuitebackup/src".	2026-06-21 18:54:45 -05:00
Jonathan Miller	3328d7cf19	feat: backup type filter + path traversal protection (#68, #72) ... #68: Add backup type filter dropdown to backups list view - filter_backups.xml: full/database/files/differential options - BackupsModel: backup_type filter in getListQuery() - Language string: COM_MOKOJOOMBACKUP_FILTER_TYPE_ALL #72: Path traversal protection in RestoreEngine and MokoRestore - RestoreEngine::extractArchive(): validate ZIP entries before extractTo() - RestoreEngine::extractTarGz(): validate PharData entries before extractTo() - MokoRestore standalone script: same validation in generated PHP code - Rejects entries containing ../ or starting with / or \ Closes #68, closes #72	2026-06-21 18:50:07 -05:00
jmiller	c410c02487	chore: sync repo-health.yml from Template-Generic [skip ci]	2026-06-21 23:38:38 +00:00
jmiller	93879c8118	chore: sync pr-check.yml from Template-Generic [skip ci]	2026-06-21 23:38:37 +00:00
jmiller	e4329c9fc6	chore: sync auto-bump.yml from Template-Generic [skip ci]	2026-06-21 23:38:34 +00:00
gitea-actions[bot]	0fa58daa12	chore: promote changelog [Unreleased] → [01.27.00]	2026-06-21 23:24:27 +00:00
gitea-actions[bot]	f8591ed15c	chore(release): build 01.27.00 [skip ci]	2026-06-21 23:24:24 +00:00
jmiller	cbc7004d18	chore: sync repo-health.yml from Template-Generic [skip ci]	2026-06-21 23:24:11 +00:00
jmiller	a33a585b98	chore: sync pr-check.yml from Template-Generic [skip ci]	2026-06-21 23:24:10 +00:00
jmiller	2573ba8599	chore: sync issue-branch.yml from Template-Generic [skip ci]	2026-06-21 23:24:09 +00:00
jmiller	f0d506bbb1	chore: sync auto-bump.yml from Template-Generic [skip ci]	2026-06-21 23:24:06 +00:00
jmiller	a26343a76e	Merge pull request 'fix: Remaining audit findings — OOM, security, error handling (#81)' (#85) from fix/audit-remaining into main	2026-06-21 23:17:56 +00:00
Jonathan Miller	9990240d2d	fix: remaining audit findings — OOM, security, error handling (#81) ... CRITICAL: - #73: S3Uploader now streams file via CURLOPT_PUT/INFILE instead of loading entire file into RAM with file_get_contents - #74: DatabaseDumper gains dumpToFile() that streams SQL to disk; BackupEngine uses addFile() instead of addFromString() to avoid holding the entire dump in memory - #75: AkeebaImporter removes unserialize() — only uses json_decode, skips legacy serialized filter data to prevent object injection MEDIUM (also fixed): - BackupEngine: $archiveName initialized before try block (prevents undefined variable in catch) - BackupEngine: plaintext archive deleted on encryption failure - BackupEngine: temp SQL file cleaned up in both success and failure - BackupEngine: createArchiver() throws on unknown format instead of silently falling back to ZIP - TarGzArchiver: intermediate .tar cleaned up in finally block Closes #73, closes #74, closes #75 Ref #81	2026-06-21 18:16:46 -05:00
jmiller	418db394a4	Merge pull request 'chore: remove automation directory' (#82) from fix/remove-automation into main	2026-06-21 23:10:42 +00:00
jmiller	d939d8c9d7	Merge pull request 'fix: Critical and high audit findings (#81)' (#83) from fix/audit-critical-high into main	2026-06-21 23:10:19 +00:00
gitea-actions[bot]	6383e9b111	chore(version): pre-release bump to 01.27.03-dev [skip ci]	2026-06-21 23:10:10 +00:00
Jonathan Miller	2395a4eabc	fix: critical and high audit findings (#81) ... Fixes all critical and high severity issues from the codebase audit: CRITICAL: - #71: RestoreCommand passed wrong args to RestoreEngine (filepath instead of record ID) — CLI restore was completely broken - #72: JpaUnarchiver path traversal — added traversal rejection and realpath boundary check to prevent writes outside staging dir - #77: RestoreEngine staging path sanitized — $record->tag stripped of non-alphanumeric characters HIGH: - #75: (noted, AkeebaImporter unserialize needs separate refactor) - #76: BackupTable now deletes DB row before file — prevents data loss if DB delete fails - #78: API profiles endpoint now masks sensitive fields (passwords, keys, tokens) with '***' - #79: Webcron handler adds return after sendJsonResponse — prevents execution falling through on non-terminal close() - #80: BackupModel/ProfileModel loadFormData() now casts array to object — prevents TypeError on PHP 8.x form state restore PREFLIGHT HARDENING: - PreflightCheck::run() wrapped in try-catch for DB exceptions - mkdir() failure now includes actual error reason - Unresolved placeholders generate a warning instead of silent return Closes #71, closes #76, closes #77, closes #78, closes #79, closes #80 Ref #72, ref #81	2026-06-21 18:08:58 -05:00
Jonathan Miller	1ec8ec8f6d	chore: remove automation directory	2026-06-21 18:03:55 -05:00
jmiller	8df630c529	chore: sync repo-health.yml from Template-Generic [skip ci]	2026-06-21 22:56:04 +00:00
jmiller	5c8503e79e	chore: sync pr-check.yml from Template-Generic [skip ci]	2026-06-21 22:56:02 +00:00
jmiller	3a087d7859	chore: sync issue-branch.yml from Template-Generic [skip ci]	2026-06-21 22:56:01 +00:00
jmiller	58d3b812a7	chore: sync auto-bump.yml from Template-Generic [skip ci]	2026-06-21 22:55:58 +00:00
gitea-actions[bot]	ac3727f22f	chore: promote changelog [Unreleased] → [01.27.00]	2026-06-21 22:54:50 +00:00
gitea-actions[bot]	43a4e552ce	chore(release): build 01.27.00 [skip ci]	2026-06-21 22:54:47 +00:00
jmiller	a532e639ea	Merge pull request 'feat: Pre-flight checks before backup starts (#67)' (#70) from feature/67-preflight-checks into main	2026-06-21 22:54:34 +00:00
gitea-actions[bot]	f099ad8fe9	chore(version): auto-bump patch 01.26.02-dev [skip ci]	2026-06-21 22:54:29 +00:00
Jonathan Miller	dbed0d0da7	fix: address PR review — remove dead code, consistent warnings key ... - Remove dead checkRequiredExtensions() method (superseded by PreflightCheck) - Add 'warnings' key to ALL return paths in BackupEngine::run() and SteppedBackupEngine::init() to prevent undefined key access on PHP 8.x - Include preflight warnings in success, failure, and early-exit returns	2026-06-21 17:54:11 -05:00
gitea-actions[bot]	617c103055	chore(version): auto-bump patch 01.26.01-dev [skip ci]	2026-06-21 22:47:28 +00:00
Jonathan Miller	edb202071c	feat: add pre-flight checks before backup starts (#67) ... Validate backup prerequisites before creating any record, catching common issues early with clear messages instead of failing mid-backup. Pre-flight checks: - Required PHP extensions (zip, pdo, pdo_mysql, mbstring, curl) - Backup directory exists and is writable - Sufficient disk space (last backup size + 20% buffer, skipped if no previous backup exists) - No other backup already running for this profile - Excluded tables exist in database (warns on missing) - Remote storage credentials minimally configured (FTP/S3/GDrive) Errors block the backup; warnings are logged and displayed but allow the backup to proceed. Integrated into both BackupEngine::run() and SteppedBackupEngine::init() before any record is inserted. UI: AJAX init response includes warnings array, displayed in the stepped backup progress modal. Closes #67	2026-06-21 17:47:13 -05:00