77 Commits

Author	SHA1	Message	Date
jmiller	6cef8fa9f7	Merge remote-tracking branch 'origin/main' into fix/remote-storage-cleanup ... # Conflicts: # SECURITY.md # source/packages/MokoSuiteClient # source/packages/com_mokosuitebackup/mokosuitebackup.xml # source/packages/mod_mokosuitebackup_cpanel/mod_mokosuitebackup_cpanel.xml # source/packages/plg_actionlog_mokosuitebackup/mokosuitebackup.xml # source/packages/plg_console_mokosuitebackup/mokosuitebackup.xml # source/packages/plg_content_mokosuitebackup/mokosuitebackup.xml # source/packages/plg_quickicon_mokosuitebackup/mokosuitebackup.xml # source/packages/plg_system_mokosuitebackup/mokosuitebackup.xml # source/packages/plg_task_mokosuitebackup/mokosuitebackup.xml # source/packages/plg_webservices_mokosuitebackup/mokosuitebackup.xml # source/pkg_mokosuitebackup.xml # source/script.php	2026-07-04 15:34:41 -05:00
jmiller	10248b284a	fix: enforce per-profile retention and repair Purge Old Backups button ... Two related backup-management fixes. Retention (records/days to keep): - The retention fieldset was defined in profile.xml but never rendered in the profile editor, so retention_days/retention_count were invisible. Render the retention fieldset on the Archive tab. - retention_days/retention_count were read by nothing, so they pruned no backups. Add RetentionManager::prune(), called from completeRecord() in both BackupEngine and SteppedBackupEngine after a backup finishes. Policy: delete a completed/warning backup when EITHER it is older than retention_days OR it falls outside the newest retention_count copies (0 = unlimited for that rule). Deleting a record also removes its archive and log file. - Correct misleading language/schema text ("use global default" — no such global backup-retention setting exists) to "0 = unlimited". Purge Old Backups button: - The modal only opened via a fragile selector match on the toolbar button's inline onclick, which Joomla 6's Atum toolbar does not render, so the button did nothing. Wrap Joomla.submitbutton to open the modal for the backups.purgeModal task, keeping the selector as a fallback.	2026-07-04 15:25:43 -05:00
jmiller	46daabc34f	fix(remote-cleanup): resolve dropped-column references found in review ... Follow-up to the legacy remote-storage removal — three consumers still referenced columns this branch drops: - 02.52.25.sql: use plain DROP COLUMN instead of DROP COLUMN IF EXISTS. IF EXISTS on DROP COLUMN is a MariaDB-only extension and errors on Oracle MySQL 8.x (which Joomla also supports); the columns always exist here, so the guard is unnecessary and the migration is now portable. - AkeebaImporter::mapToMokoProfile(): stop inserting the 19 dropped remote_storage/ftp_*/gdrive_*/s3_* columns (would fatal with "Unknown column" on Akeeba import). Remote settings now live in the remotes table and are re-added on the profile Remote tab after import. - AjaxController::browseSftpDir() + SftpPathField: remove. These were the legacy single-SFTP path picker, orphaned when the SftpPath form field was removed; they read now-dropped sftp_* columns. Claude-Session: https://claude.ai/code/session_01WbGBN9VyRK61zczYWcCQ2i	2026-07-04 15:17:54 -05:00
jmiller	a808789acb	feat: add COM_MOKOJOOMBACKUP_SHORT and apply short name to views and admin menu ... - Add COM_MOKOJOOMBACKUP_SHORT="Backup" to the component .ini and .sys.ini (en-GB + en-US) so both view titles and the admin sidebar menu resolve it. - Prefix every admin view's toolbar title with the short brand via the constant (e.g. "Backup: Dashboard", "Backup: Records"), and tighten the view title strings that redundantly led with "Backup"/"MokoSuiteBackup". - Admin sidebar top-level menu now shows the short name. Hardcoded as "Backup" in the manifest per the package-xml convention (no language strings in package XML).	2026-07-04 14:20:54 -05:00
jmiller	68605ffc05	refactor(remote): remove legacy single-remote storage in favor of remotes table ... Drops the per-profile remote_storage column and all legacy FTP/SFTP/S3/ Google Drive credential columns. Remote destinations are now sourced exclusively from #__mokosuitebackup_remotes (multi-remote), which is created at install time — so the backward-compat fallback branches in BackupEngine, SteppedBackupEngine and loadRemoteDestinations are removed. - sql: drop 26 legacy columns (install.mysql.sql + 02.52.25.sql migration) - forms/profile.xml: remove legacy remote fields and ftp/gdrive/s3 fieldsets - tmpl/profile/edit.php: drop legacy UI, add save-first prompt, use getOrCreateInstance for the modal, read item.params (was item.config) - PreflightCheck: validate credentials from the remotes table; curl warning now applies to ntfy only - SteppedSession: drop remoteStorage property - language: add backup-record delete-count strings - script.php: simplify postflight license-key prompt	2026-07-04 13:22:44 -05:00
jmiller	aefa46e0c4	fix: use warning status when backup succeeds but remote upload fails ... Previously a successful backup with a failed remote upload was marked as "complete", hiding the upload failure. Now these records get a "warning" status with a yellow badge so operators can see at a glance which backups didn't reach their remote destination. Warning-status records are treated as usable backups throughout: - Downloadable, browsable, and restorable (the archive is intact) - Counted in dashboard stats, storage totals, and success streaks - Included in purge operations and differential base lookups - Shown with yellow "warning" badge in list, detail, and cpanel module - Filterable via the status dropdown on Backup Records Claude-Session: https://claude.ai/code/session_01MbEjBtsSjPuTWhqqrMS2wG	2026-06-30 14:14:06 -05:00
jmiller	b26a21820b	fix: auto-cancel stalled backups after 30 min timeout ... PreflightCheck now auto-cancels "running" backup records that have exceeded 30 minutes, treating them as stalled. Partial archive files are cleaned up. The auto-cancelled records are surfaced as warnings so the user knows what happened. Records younger than 30 minutes are assumed to be legitimately running and still block new backups for the same profile. Claude-Session: https://claude.ai/code/session_01MbEjBtsSjPuTWhqqrMS2wG	2026-06-30 13:50:18 -05:00
jmiller	1eb1c18bdf	fix: add cancel stalled backup action with ACL permission ... Backups stuck in "running" status block all future backups for the same profile via the preflight check. Previously the only fix was a manual DB update. Adds a toolbar button and AJAX endpoint to cancel stalled backups: - New ACL permission: mokosuitebackup.backup.cancel - BackupsController::cancelStalled() for toolbar (multi-select) - AjaxController::cancelBackup() for AJAX/API use - Sets status to "fail", cleans up partial archive files - Updated preflight error message to mention the cancel action - Language keys for en-GB and en-US Claude-Session: https://claude.ai/code/session_01MbEjBtsSjPuTWhqqrMS2wG	2026-06-30 13:48:51 -05:00
jmiller	4093267984	fix: add verbose error_log throughout restore script ... Every action handler now logs entry, key parameters, outcomes, and failures to PHP error_log. Security file creation logs directory permissions, PHP user, and the specific error when file_put_contents fails. Database import logs SQL file size, statement counts, and individual errors. Cleanup logs each file removal success/failure. Claude-Session: https://claude.ai/code/session_01MbEjBtsSjPuTWhqqrMS2wG	2026-06-30 12:59:59 -05:00
jmiller	20ce945e73	fix: recreate security file if missing while verification is pending ... The security file was only written inside the code-generation block (first page load). If the file was deleted or failed to write, it was never recreated because the session already held the code. Now file writing is a separate check that runs whenever verification is pending and the file is missing. Claude-Session: https://claude.ai/code/session_01MbEjBtsSjPuTWhqqrMS2wG	2026-06-30 12:53:36 -05:00
jmiller	3a6bb1c783	fix: remote upload prefix mismatch and restore security file visibility ... Remote uploaders (SFTP, FTP, S3, Google Drive) expect type-prefixed property names (sftp_host, ftp_port, etc.) but createUploaderFromParams passes unprefixed keys from the remotes table params JSON. Add prefix mapping in createUploaderFromParams to bridge the naming gap. Rename .mokorestore-security.php to mokorestore-security.php (no leading dot) so the file is visible in file managers and not blocked by web server dotfile rules. Also clean it up in actionCleanup. Closes #13 Claude-Session: https://claude.ai/code/session_01MbEjBtsSjPuTWhqqrMS2wG	2026-06-30 12:50:02 -05:00
jmiller	1b481f2e2c	fix: remove ordering column from profiles table ... The ordering column was unused in the profiles UI — profiles sort by ID. Drops the column via migration, removes all references from model, config query, importer, and install SQL. Claude-Session: https://claude.ai/code/session_01MbEjBtsSjPuTWhqqrMS2wG	2026-06-28 13:45:01 -05:00
jmiller	288baf41d3	fix: remove duplicate version tags from 8 manifests, align AjaxController to params column ... CI version_bump was creating duplicate <version> lines in all sub-extension manifests. Also AjaxController still referenced the old `config` column and removed `keep_local` column on the remotes table. Claude-Session: https://claude.ai/code/session_01MbEjBtsSjPuTWhqqrMS2wG	2026-06-26 21:19:21 -05:00
jmiller	c508fcc8d5	fix: align remotes table schema, add restore_script_name column, profile ordering ... - install.mysql.sql: rename `config` → `params` and drop `keep_local` from remotes table to match update file 01.41.00 and RemoteTable.php code (fixes Joomla database maintenance "one problem") - install.mysql.sql: fix idx_enabled index to use composite (profile_id, enabled) - install.mysql.sql: add restore_script_name column to profiles table - 01.43.22.sql: ALTER TABLE to add restore_script_name for existing installs - DashboardModel: order profile dropdown by ID instead of ordering column - SteppedBackupEngine: add stack trace logging around MokoRestore standalone generation to debug str_replace FATAL on SFTP profiles	2026-06-26 21:18:47 -05:00
jmiller	93f0fa0a47	fix: SSH key indicator detection and missing delete language key ... - SshKeyField: detect base64-encoded keys from DB so the "Key loaded" badge displays correctly after initial upload - Add COM_MOKOJOOMBACKUP_BACKUPS_N_ITEMS_DELETED language keys for Joomla's AdminController delete feedback message	2026-06-25 12:17:45 -05:00
jmiller	07fb4dcc24	fix: remove run/backup buttons, move actions to detail view, custom restore script name, version bump 01.43.11-dev ... - Remove Run Backup / Backup Now buttons from profiles list, profile edit toolbar, and backup records view - Move download, browse archive, and view log from backup list rows into individual backup record detail view - Add download button to backup detail toolbar - Link profile column in backup records list to profile edit - Complete restore script filename customization across BackupEngine, SteppedBackupEngine, and MokoRestore - Remove ordering field from profiles, default sort by ID ascending - Fix untranslated JFIELD language keys - Bump all manifests to 01.43.11-dev	2026-06-25 10:54:35 -05:00
jmiller	836d1bc8b7	fix(mokorestore): add Joomla detection warning, multi-zip selector, and standalone backup scan ... - Preflight now detects existing Joomla installation (configuration.php / Version.php) and shows a yellow warning — does not block, but alerts the user - Standalone mode: backup archive check scans for all ZIPs instead of hardcoded name - Multi-zip selector integrated into extract step with radio buttons - Selected backup file passed through to extract action - Added warn-style CSS class (yellow) for preflight warnings	2026-06-25 10:00:07 -05:00
jmiller	3742477aef	fix: convert inline modals to Bootstrap 5, fix language keys, ntfy default, and MokoRestore error handling ... - Convert 10 inline CSS modals to Bootstrap 5 (backups: 7, snapshots: 3) - Replace style.display show/hide with Bootstrap Modal API - Fix JFIELD_ORDERING_LABEL_ASC → JFIELD_ORDERING_ASC in profile filter - Add COM_MOKOJOOMBACKUP_CONFIGURATION key for Options page title - Change ntfy default server to ntfy.mokoconsulting.tech - Add profile ID to dropdown labels across backups, dashboard, cpanel module - Add error handling to MokoRestore post() and runPreflight() to prevent UI stalling - Remove outdated SSH auth pattern references from field descriptions	2026-06-25 08:35:40 -05:00
Jonathan Miller	ff7418721d	fix: review findings — key desc, missing changelog, [HOST] domain resolution ... - Language: "encrypted" → "base64-encoded" for SSH key description - CHANGELOG: added 3 missing bug fix entries (fields_values scope, CSRF token on Run Backup, SFTP showon/required) - [HOST] placeholder: resolve domain from Joomla live_site config when HTTP_HOST is unavailable (CLI), instead of falling back to system hostname (joomla.invalid). Applied to both PlaceholderResolver and FolderPickerField.	2026-06-23 17:20:05 -05:00
Jonathan Miller	dae30161ae	feat: multi-remote storage — multiple destinations per profile (#97) ... New #__mokosuitebackup_remotes table stores remote destinations with JSON params per type (SFTP/S3/GDrive/FTP). Each profile can have multiple enabled destinations — the engine uploads to all of them. Database: - New table with profile_id FK, type, enabled, params JSON, ordering - Migration auto-converts existing profile remote columns to new table - RemoteTable, RemoteModel, RemotesModel classes Engine: - BackupEngine: loadRemoteDestinations() + createUploaderFromParams() iterates all enabled remotes, falls back to legacy columns - SteppedBackupEngine: one upload step per remote destination, persisted via session.remoteDestinations + remoteIndex - Local copy only deleted when ALL uploads succeed UI: - Profile edit: "Remote Destinations" linked table with AJAX CRUD - Add/edit modal with type selector showing dynamic fields - Toggle enabled/disabled, delete with confirmation - Legacy fields hidden when remotes configured, shown as fallback - Secrets masked in responses, merged from DB on save Closes #97	2026-06-23 16:53:08 -05:00
Jonathan Miller	8e5913d706	fix: enforce correct ACL permissions across all controllers (#137) ... 13 ACL fixes across 5 files: - BackupsController: purge() uses backup.purge (was core.delete) - SnapshotsController: delete() uses snapshot.manage (was core.delete) - AjaxController: restoreInit/Step use backup.restore (was backup.run), browseArchive uses backup.browse (was core.manage), countPurge uses backup.purge (was core.delete), compareBackups uses backup.compare (was core.manage) - API SnapshotsController: displayList/download use snapshot.manage (was core.manage) - HtmlView: verify gated by core.manage, compare by backup.compare, purge separated from delete with backup.purge Closes #137	2026-06-23 14:16:54 -05:00
Jonathan Miller	899a33bc58	feat: purge, CPanel module, 7z format, SFTP browser (#119, #105, #122, #98) ... #119: Manual purge — toolbar button opens modal with date picker, AJAX count preview, confirmation before bulk delete. #105: CPanel admin dashboard module (mod_mokosuitebackup_cpanel) — backup status, quick action buttons per profile, next scheduled, stats, and quick links. Registered in package manifest. #122: 7z archive format via system 7za/7z CLI binary with optional password encryption. New SevenZipArchiver engine class. #98: SFTP remote file browser — custom SftpPathField with "Browse Remote" button, modal directory listing via SSH ls, click to navigate, double-click to select. Also: CHANGELOG updated, wiki Home updated, #121 verified (encryption field already visible in Archive Settings tab). Closes #119, closes #105, closes #122, closes #98, closes #121	2026-06-23 13:05:42 -05:00
Jonathan Miller	7e404b0246	fix: MokoRestore review findings + update README ... Review fixes: - data-only mode uses REPLACE INTO (was INSERT INTO, broke on dupes) - temporary password is random 16-char hex (was hardcoded "changeme") README rewritten with all features: snapshots, SFTP, MokoRestore wizard, sanitization, dashboard, CLI, API.	2026-06-23 12:49:17 -05:00
Jonathan Miller	0dc0eb1bef	feat: MokoRestore post-restore resets + per-table conflict resolution (#131, #132) ... #131: Post-restore actions step in MokoRestore wizard: - Reset all passwords to temporary "changeme" with requireReset flag - Reset article hit counters to zero - Clear content versions (#__history) - Clear sessions (#__session) - Clear cache tables and filesystem cache - Auto-detect sanitized password hashes and prompt for reset #132: Per-table conflict resolution during database import: - New "Tables" step shows all tables from database.sql - Per-table dropdown: Replace / Skip / Merge / Data Only - Preset buttons: All Replace, All Skip, Everything except users - Skip mode skips all statements for that table - Merge mode uses INSERT IGNORE instead of INSERT INTO - Data Only skips DROP/CREATE, inserts data only Wizard now has 9 steps: Pre-check → Extract → Tables → Database → Config → Admin → Post-Restore → Provisioning → Complete Closes #131, closes #132	2026-06-23 12:33:18 -05:00
Jonathan Miller	5698c074da	feat: data sanitization — passwords, emails, sessions (#129) ... New "Data Sanitization" fieldset on profile form with four options: - Sanitize User Passwords: replaces all bcrypt hashes with invalid sentinel - Preserve Super Admin: keeps Super Users group passwords intact - Sanitize User Emails: replaces with user123@sanitized.example.com - Clear Session Data: excludes #__session table data (default: on) DatabaseDumper sanitizes rows inline during dump — both in-memory and file-streaming paths. Super admin detection uses group_id=8 from #__user_usergroup_map with static caching. Use cases: sharing backups, creating demo/staging sites, GDPR compliance. Partial #129 (Part 2 — restore script password reset — tracked separately)	2026-06-23 12:06:19 -05:00
Jonathan Miller	12c832d7fe	feat: comprehensive help modal for backup directory field ... Expanded the help modal with: - Absolute paths: starts with / or drive letter, used as-is - Relative paths: ./backups, ../backups, ../../backups with table showing URL-style conventions and resolved examples - Placeholder paths: detailed descriptions of each placeholder with current server values - Recommended configurations table: single site, multi-site, date-organized, per-profile, shared hosting - Security warnings for web-root-accessible paths - Help button uses JS click handler with Bootstrap 5 fallback (fixes non-working tooltip icon)	2026-06-23 11:58:20 -05:00
Jonathan Miller	de632e9c5c	feat: uppercase all placeholders + EXAMPLE prefix in resolution display ... All placeholders changed from lowercase to UPPERCASE: [host] → [HOST], [site_name] → [SITE_NAME], [date] → [DATE], [datetime] → [DATETIME], [profile_id] → [PROFILE_ID], etc. [HOME] and [DEFAULT_DIR] were already uppercase — now consistent. SQL migration 01.39.01 updates existing profile data in the database. Resolution display prefixed with "EXAMPLE:" to clarify these are example values resolved at backup time. 13 files updated across engines, fields, forms, templates, and SQL.	2026-06-23 11:52:52 -05:00
Jonathan Miller	e415e701cd	fix: resolve [site_name] and other placeholders in checkDir AJAX ... BackupDirectory::resolve() only handles [HOME] and [DEFAULT_DIR]. The checkDir AJAX endpoint now uses PlaceholderResolver to also resolve [site_name], [host], [profile_id], [date], etc. before checking if the directory exists. This makes the "Resolves to" display accurate for all placeholder types.	2026-06-23 11:49:21 -05:00
Jonathan Miller	fc41e1801a	fix: placeholder resolution display + CSRF token on Run Backup button ... FolderPickerField: shows resolved placeholder values below input as badges (e.g. [HOME]=/home/user, [host]=example.com), plus full resolved path. Updates live as user types. BackupsController::start(): accept CSRF token from both GET and POST so the "Run Backup Now" link button on profile edit works without triggering "security token did not match" error.	2026-06-23 11:35:48 -05:00
Jonathan Miller	e62dba8f40	feat: standalone restore script — separate file that scans for ZIPs (#107) ... New MokoRestore mode: 'standalone' generates restore.php as a separate file that scans its directory for ZIP backup archives and lets the user choose which one to restore. Unlike 'wrapped' mode which bundles restore.php inside the backup ZIP, standalone mode keeps both files separate — ideal for remote servers where you SCP the backup. Changes: - MokoRestore::generateStandalone() — writes restore.php with ZIP scanner - Profile form: include_mokorestore now a dropdown (none/wrapped/standalone) - BackupEngine: standalone mode writes restore.php + uploads to remote - Restore script uses safe DOM methods (no innerHTML with user data) Closes #107	2026-06-23 11:20:23 -05:00
Jonathan Miller	64ffbb9d61	feat: profiles UI, snapshot detail, progress warning, action logs (#100, #104, #108, #110) ... #100: Run Backup button on profiles list (per-row) and edit toolbar, backup count badge linking to filtered backups view, View Backups toolbar button on profile edit. #101: Profile → filtered backup list link (included in #100). #104: Snapshot browse modal now shows tabbed view (Articles, Categories, Modules) with item counts. AjaxController returns all content types. Categories show indented hierarchy. #108: "Do not navigate away or close this window" warning banner added to both backup and restore progress modals. #110: Joomla Action Logs integration — RestoreEngine, SnapshotEngine, and SnapshotRestoreEngine now dispatch events that the actionlog plugin logs to #__action_logs. Closes #100, closes #101, closes #104, closes #108, closes #110	2026-06-23 11:03:13 -05:00
Jonathan Miller	456e744d81	feat: clickable placeholder pills for backup dir and archive name fields ... Both Backup Directory and Archive Name Format fields now show clickable placeholder tags below the input. Clicking a tag inserts the placeholder at the current cursor position using selectionStart/End. - FolderPickerField: pills for [HOME], [DEFAULT_DIR], [host], [site_name], [date], [profile_id], [profile_name], [type] - PlaceholderTextField: new custom field type used by archive_name_format, configurable placeholders via XML attribute - Cursor position preserved after insert, input event dispatched for live status updates	2026-06-23 10:47:45 -05:00
Jonathan Miller	d6b3e8cff0	feat: SFTP key file upload, auth type dropdown, security hardening ... SFTP UX improvements: - SshKeyField: file upload button (FileReader → base64 → hidden field), key never displayed as readable text, __KEEP_EXISTING__ sentinel preserves DB value on re-save without re-uploading - Auth type dropdown: password / key file / key file + passphrase with conditional field visibility via showon - Required field markers on host, username, path, password - Remove insecure FTP option from remote storage dropdown Security: - Private key stored base64-encoded in database - SftpUploader decodes base64 before writing temp file - ProfileTable::store() handles sentinel to prevent key leakage - Key content never rendered in HTML form output	2026-06-23 08:51:49 -05:00
Jonathan Miller	f66100f74f	feat: SFTP remote storage with key file auth + CLI restore options ... SFTP support: - SftpUploader uses system scp/ssh binaries with key file auth - Private key stored as MEDIUMTEXT in profile table (sftp_key_data) - Key written to temp file (0600) at upload time, deleted after - Profile form: host, port, username, password, key textarea, passphrase, remote path — all with showon="remote_storage:sftp" - SQL migration for 7 new SFTP columns - Wired into BackupEngine, SteppedBackupEngine, PreflightCheck - API credential masking includes SFTP fields CLI restore options: - --files-only: restore files without touching database - --db-only: restore database without touching files - --no-preserve-config: overwrite configuration.php - --password: decryption password for encrypted archives	2026-06-23 08:21:10 -05:00
Jonathan Miller	ee21f7a373	feat: dashboard snapshot widget, backup trend chart, storage breakdown (#61) ... Add three new dashboard widgets: - Snapshot widget: latest snapshot info, type badges, item counts, link to snapshots view, total count - Backup trend: CSS bar chart showing daily backup sizes over 30 days, red bars for days with failures, tooltips with details - Storage breakdown: horizontal bars showing space used per profile with color coding and backup counts Closes #61	2026-06-23 07:22:04 -05:00
Jonathan Miller	8c66fd3260	feat: backup comparison — diff two backup records (#64) ... Select two backups and compare side-by-side: - AjaxController::compareBackups() returns metadata + deltas - Compare toolbar button (requires 2 checkboxes) - Modal shows size, files, tables, duration differences Closes #64	2026-06-23 04:39:00 -05:00
Jonathan Miller	8a4ebe1bde	feat: selective article restore from snapshot (#58) ... Browse articles inside a snapshot and restore individual items: - SnapshotRestoreEngine::restoreSelectedArticles() merges by ID - AjaxController::browseSnapshot() returns article list as JSON - SnapshotsController::restoreSelected() handles selective restore - Browse modal with checkboxes + Restore Selected button Closes #58	2026-06-22 22:18:48 -05:00
Jonathan Miller	01bed8942c	feat: AJAX stepped restore engine for large sites (#62) ... Break restore into phases (extract, files, database, config, cleanup) executed via AJAX steps to avoid PHP timeout on shared hosting. - SteppedRestoreEngine with session persistence - AjaxController restoreInit/restoreStep endpoints - Restore modal uses AJAX progress instead of synchronous submit - Files copied in batches of 200, SQL in batches of 500 Closes #62	2026-06-22 09:27:18 -05:00
Jonathan Miller	391047d8e5	feat: email/ntfy notifications for restore operations (#60) ... Send notifications when site restores and snapshot create/restore complete. Uses sendRestoreNotification() with type-specific subjects. All calls wrapped in try-catch to never break the actual operation. Closes #60	2026-06-22 09:27:16 -05:00
Jonathan Miller	5dcba6d8cb	feat: auto-verify backup integrity after creation (#65) ... After archive is created and checksum computed, automatically verify: - Archive opens without error - Contains at least one entry - database.sql present when backup type includes database - First entry is readable (spot-check) Applied to both BackupEngine and SteppedBackupEngine. Throws RuntimeException on verification failure (backup marked as failed). Closes #65	2026-06-21 19:45:46 -05:00
Jonathan Miller	ad1c0cf349	fix: scope #__fields_values dump and restore to com_content.article ... The fields_values table is shared across all Joomla extensions. Previously, dump captured ALL field values and restore deleted ALL field values, destroying data for contacts, users, and other extensions. Now scoped via subquery on field_id WHERE context = 'com_content.article'.	2026-06-21 19:32:23 -05:00
Jonathan Miller	8b6e260b28	fix: graceful degradation when remote upload fails (#66) ... Remote upload failure (S3/FTP/GDrive) no longer marks the entire backup as failed. The local archive is preserved with status 'complete' and the upload failure is logged as a warning. Applies to both BackupEngine and SteppedBackupEngine. Closes #66	2026-06-21 19:09:20 -05:00
Jonathan Miller	eb7f48d3a2	feat: extend snapshots to include custom fields and tags (#57) ... When articles are included in a snapshot, now also captures: - #__tags (tag definitions) - #__fields (custom field definitions for com_content.article) - #__fields_values (custom field values) - #__fields_categories (field-to-category mappings) Restore correctly scopes deletes to avoid touching non-content fields. Closes #57	2026-06-21 19:08:53 -05:00
Jonathan Miller	3328d7cf19	feat: backup type filter + path traversal protection (#68, #72) ... #68: Add backup type filter dropdown to backups list view - filter_backups.xml: full/database/files/differential options - BackupsModel: backup_type filter in getListQuery() - Language string: COM_MOKOJOOMBACKUP_FILTER_TYPE_ALL #72: Path traversal protection in RestoreEngine and MokoRestore - RestoreEngine::extractArchive(): validate ZIP entries before extractTo() - RestoreEngine::extractTarGz(): validate PharData entries before extractTo() - MokoRestore standalone script: same validation in generated PHP code - Rejects entries containing ../ or starting with / or \ Closes #68, closes #72	2026-06-21 18:50:07 -05:00
Jonathan Miller	9990240d2d	fix: remaining audit findings — OOM, security, error handling (#81) ... CRITICAL: - #73: S3Uploader now streams file via CURLOPT_PUT/INFILE instead of loading entire file into RAM with file_get_contents - #74: DatabaseDumper gains dumpToFile() that streams SQL to disk; BackupEngine uses addFile() instead of addFromString() to avoid holding the entire dump in memory - #75: AkeebaImporter removes unserialize() — only uses json_decode, skips legacy serialized filter data to prevent object injection MEDIUM (also fixed): - BackupEngine: $archiveName initialized before try block (prevents undefined variable in catch) - BackupEngine: plaintext archive deleted on encryption failure - BackupEngine: temp SQL file cleaned up in both success and failure - BackupEngine: createArchiver() throws on unknown format instead of silently falling back to ZIP - TarGzArchiver: intermediate .tar cleaned up in finally block Closes #73, closes #74, closes #75 Ref #81	2026-06-21 18:16:46 -05:00
Jonathan Miller	2395a4eabc	fix: critical and high audit findings (#81) ... Fixes all critical and high severity issues from the codebase audit: CRITICAL: - #71: RestoreCommand passed wrong args to RestoreEngine (filepath instead of record ID) — CLI restore was completely broken - #72: JpaUnarchiver path traversal — added traversal rejection and realpath boundary check to prevent writes outside staging dir - #77: RestoreEngine staging path sanitized — $record->tag stripped of non-alphanumeric characters HIGH: - #75: (noted, AkeebaImporter unserialize needs separate refactor) - #76: BackupTable now deletes DB row before file — prevents data loss if DB delete fails - #78: API profiles endpoint now masks sensitive fields (passwords, keys, tokens) with '***' - #79: Webcron handler adds return after sendJsonResponse — prevents execution falling through on non-terminal close() - #80: BackupModel/ProfileModel loadFormData() now casts array to object — prevents TypeError on PHP 8.x form state restore PREFLIGHT HARDENING: - PreflightCheck::run() wrapped in try-catch for DB exceptions - mkdir() failure now includes actual error reason - Unresolved placeholders generate a warning instead of silent return Closes #71, closes #76, closes #77, closes #78, closes #79, closes #80 Ref #72, ref #81	2026-06-21 18:08:58 -05:00
Jonathan Miller	dbed0d0da7	fix: address PR review — remove dead code, consistent warnings key ... - Remove dead checkRequiredExtensions() method (superseded by PreflightCheck) - Add 'warnings' key to ALL return paths in BackupEngine::run() and SteppedBackupEngine::init() to prevent undefined key access on PHP 8.x - Include preflight warnings in success, failure, and early-exit returns	2026-06-21 17:54:11 -05:00
Jonathan Miller	edb202071c	feat: add pre-flight checks before backup starts (#67) ... Validate backup prerequisites before creating any record, catching common issues early with clear messages instead of failing mid-backup. Pre-flight checks: - Required PHP extensions (zip, pdo, pdo_mysql, mbstring, curl) - Backup directory exists and is writable - Sufficient disk space (last backup size + 20% buffer, skipped if no previous backup exists) - No other backup already running for this profile - Excluded tables exist in database (warns on missing) - Remote storage credentials minimally configured (FTP/S3/GDrive) Errors block the backup; warnings are logged and displayed but allow the backup to proceed. Integrated into both BackupEngine::run() and SteppedBackupEngine::init() before any record is inserted. UI: AJAX init response includes warnings array, displayed in the stepped backup progress modal. Closes #67	2026-06-21 17:47:13 -05:00
Jonathan Miller	d5421738b7	fix: address PR review findings — error handling and safety ... Fixes from code review and silent failure audit: - SnapshotRestoreEngine: catch only duplicate key errors (MySQL 1062) in merge mode, re-throw all other exceptions instead of swallowing - SnapshotRestoreEngine: add json_last_error() check for better error messages on corrupt snapshot files - SnapshotRestoreEngine: log warnings when set_time_limit/ini_set fail - SnapshotEngine: use strlen($json) instead of filesize() to avoid race conditions; catch \Exception instead of \Throwable - SnapshotsController: remove @unlink suppression, add try-catch around delete loop with partial failure reporting - script.php: add user-facing warning when webcron secret generation fails (was silently swallowed, inconsistent with other catch blocks)	2026-06-21 17:21:55 -05:00
Jonathan Miller	854383a899	fix: scope module DELETE to snapshot IDs in replace mode ... The truncateFiltered() method ran unfiltered DELETE FROM #__modules in replace mode, which would wipe ALL site modules (admin toolbar, login, menus) — not just the ones in the snapshot. Now scoped to only delete modules whose IDs exist in the snapshot data. Also scopes #__modules_menu delete to snapshot module IDs, and adds defense-in-depth validation of restore_mode in the controller.	2026-06-21 15:50:41 -05:00