SFTP UX improvements:
- SshKeyField: file upload button (FileReader → base64 → hidden field),
key never displayed as readable text, __KEEP_EXISTING__ sentinel
preserves DB value on re-save without re-uploading
- Auth type dropdown: password / key file / key file + passphrase
with conditional field visibility via showon
- Required field markers on host, username, path, password
- Remove insecure FTP option from remote storage dropdown
Security:
- Private key stored base64-encoded in database
- SftpUploader decodes base64 before writing temp file
- ProfileTable::store() handles sentinel to prevent key leakage
- Key content never rendered in HTML form output
- Default backup_dir is now ../backups (relative to JPATH_ROOT),
which resolves outside public_html on most hosting setups
- Added BackupDirectory::normalizePath() to resolve ../ segments
without requiring the path to exist on disk
- Added BackupDirectory::portablize() to auto-detect absolute paths
and replace them with portable placeholders ([HOME], ../backups)
- ProfileTable::check() auto-normalizes backup_dir on save
- Install postflight auto-migrates old in-webroot defaults to ../backups
- Dashboard warning now checks resolved path instead of string matching
- .htaccess protection only applied when directory is inside web root
Renames all sub-extensions from mokojoombackup to mokosuitebackup
(package, component, 7 plugins, language files, manifests).
Adds [HOME] placeholder to BackupDirectory and PlaceholderResolver
so users can set backup_dir to [HOME]/backups (outside web root).
Fixes folder browser "access denied" on PHP-FPM shared hosting
where getenv('HOME') returns empty by adding POSIX and JPATH_ROOT
fallback detection.