22 Commits

Author	SHA1	Message	Date
jmiller	6cef8fa9f7	Merge remote-tracking branch 'origin/main' into fix/remote-storage-cleanup ... # Conflicts: # SECURITY.md # source/packages/MokoSuiteClient # source/packages/com_mokosuitebackup/mokosuitebackup.xml # source/packages/mod_mokosuitebackup_cpanel/mod_mokosuitebackup_cpanel.xml # source/packages/plg_actionlog_mokosuitebackup/mokosuitebackup.xml # source/packages/plg_console_mokosuitebackup/mokosuitebackup.xml # source/packages/plg_content_mokosuitebackup/mokosuitebackup.xml # source/packages/plg_quickicon_mokosuitebackup/mokosuitebackup.xml # source/packages/plg_system_mokosuitebackup/mokosuitebackup.xml # source/packages/plg_task_mokosuitebackup/mokosuitebackup.xml # source/packages/plg_webservices_mokosuitebackup/mokosuitebackup.xml # source/pkg_mokosuitebackup.xml # source/script.php	2026-07-04 15:34:41 -05:00
jmiller	10248b284a	fix: enforce per-profile retention and repair Purge Old Backups button ... Two related backup-management fixes. Retention (records/days to keep): - The retention fieldset was defined in profile.xml but never rendered in the profile editor, so retention_days/retention_count were invisible. Render the retention fieldset on the Archive tab. - retention_days/retention_count were read by nothing, so they pruned no backups. Add RetentionManager::prune(), called from completeRecord() in both BackupEngine and SteppedBackupEngine after a backup finishes. Policy: delete a completed/warning backup when EITHER it is older than retention_days OR it falls outside the newest retention_count copies (0 = unlimited for that rule). Deleting a record also removes its archive and log file. - Correct misleading language/schema text ("use global default" — no such global backup-retention setting exists) to "0 = unlimited". Purge Old Backups button: - The modal only opened via a fragile selector match on the toolbar button's inline onclick, which Joomla 6's Atum toolbar does not render, so the button did nothing. Wrap Joomla.submitbutton to open the modal for the backups.purgeModal task, keeping the selector as a fallback.	2026-07-04 15:25:43 -05:00
jmiller	68605ffc05	refactor(remote): remove legacy single-remote storage in favor of remotes table ... Drops the per-profile remote_storage column and all legacy FTP/SFTP/S3/ Google Drive credential columns. Remote destinations are now sourced exclusively from #__mokosuitebackup_remotes (multi-remote), which is created at install time — so the backward-compat fallback branches in BackupEngine, SteppedBackupEngine and loadRemoteDestinations are removed. - sql: drop 26 legacy columns (install.mysql.sql + 02.52.25.sql migration) - forms/profile.xml: remove legacy remote fields and ftp/gdrive/s3 fieldsets - tmpl/profile/edit.php: drop legacy UI, add save-first prompt, use getOrCreateInstance for the modal, read item.params (was item.config) - PreflightCheck: validate credentials from the remotes table; curl warning now applies to ntfy only - SteppedSession: drop remoteStorage property - language: add backup-record delete-count strings - script.php: simplify postflight license-key prompt	2026-07-04 13:22:44 -05:00
jmiller	aefa46e0c4	fix: use warning status when backup succeeds but remote upload fails ... Previously a successful backup with a failed remote upload was marked as "complete", hiding the upload failure. Now these records get a "warning" status with a yellow badge so operators can see at a glance which backups didn't reach their remote destination. Warning-status records are treated as usable backups throughout: - Downloadable, browsable, and restorable (the archive is intact) - Counted in dashboard stats, storage totals, and success streaks - Included in purge operations and differential base lookups - Shown with yellow "warning" badge in list, detail, and cpanel module - Filterable via the status dropdown on Backup Records Claude-Session: https://claude.ai/code/session_01MbEjBtsSjPuTWhqqrMS2wG	2026-06-30 14:14:06 -05:00
jmiller	3a6bb1c783	fix: remote upload prefix mismatch and restore security file visibility ... Remote uploaders (SFTP, FTP, S3, Google Drive) expect type-prefixed property names (sftp_host, ftp_port, etc.) but createUploaderFromParams passes unprefixed keys from the remotes table params JSON. Add prefix mapping in createUploaderFromParams to bridge the naming gap. Rename .mokorestore-security.php to mokorestore-security.php (no leading dot) so the file is visible in file managers and not blocked by web server dotfile rules. Also clean it up in actionCleanup. Closes #13 Claude-Session: https://claude.ai/code/session_01MbEjBtsSjPuTWhqqrMS2wG	2026-06-30 12:50:02 -05:00
jmiller	c508fcc8d5	fix: align remotes table schema, add restore_script_name column, profile ordering ... - install.mysql.sql: rename `config` → `params` and drop `keep_local` from remotes table to match update file 01.41.00 and RemoteTable.php code (fixes Joomla database maintenance "one problem") - install.mysql.sql: fix idx_enabled index to use composite (profile_id, enabled) - install.mysql.sql: add restore_script_name column to profiles table - 01.43.22.sql: ALTER TABLE to add restore_script_name for existing installs - DashboardModel: order profile dropdown by ID instead of ordering column - SteppedBackupEngine: add stack trace logging around MokoRestore standalone generation to debug str_replace FATAL on SFTP profiles	2026-06-26 21:18:47 -05:00
jmiller	07fb4dcc24	fix: remove run/backup buttons, move actions to detail view, custom restore script name, version bump 01.43.11-dev ... - Remove Run Backup / Backup Now buttons from profiles list, profile edit toolbar, and backup records view - Move download, browse archive, and view log from backup list rows into individual backup record detail view - Add download button to backup detail toolbar - Link profile column in backup records list to profile edit - Complete restore script filename customization across BackupEngine, SteppedBackupEngine, and MokoRestore - Remove ordering field from profiles, default sort by ID ascending - Fix untranslated JFIELD language keys - Bump all manifests to 01.43.11-dev	2026-06-25 10:54:35 -05:00
Jonathan Miller	dae30161ae	feat: multi-remote storage — multiple destinations per profile (#97) ... New #__mokosuitebackup_remotes table stores remote destinations with JSON params per type (SFTP/S3/GDrive/FTP). Each profile can have multiple enabled destinations — the engine uploads to all of them. Database: - New table with profile_id FK, type, enabled, params JSON, ordering - Migration auto-converts existing profile remote columns to new table - RemoteTable, RemoteModel, RemotesModel classes Engine: - BackupEngine: loadRemoteDestinations() + createUploaderFromParams() iterates all enabled remotes, falls back to legacy columns - SteppedBackupEngine: one upload step per remote destination, persisted via session.remoteDestinations + remoteIndex - Local copy only deleted when ALL uploads succeed UI: - Profile edit: "Remote Destinations" linked table with AJAX CRUD - Add/edit modal with type selector showing dynamic fields - Toggle enabled/disabled, delete with confirmation - Legacy fields hidden when remotes configured, shown as fallback - Secrets masked in responses, merged from DB on save Closes #97	2026-06-23 16:53:08 -05:00
Jonathan Miller	899a33bc58	feat: purge, CPanel module, 7z format, SFTP browser (#119, #105, #122, #98) ... #119: Manual purge — toolbar button opens modal with date picker, AJAX count preview, confirmation before bulk delete. #105: CPanel admin dashboard module (mod_mokosuitebackup_cpanel) — backup status, quick action buttons per profile, next scheduled, stats, and quick links. Registered in package manifest. #122: 7z archive format via system 7za/7z CLI binary with optional password encryption. New SevenZipArchiver engine class. #98: SFTP remote file browser — custom SftpPathField with "Browse Remote" button, modal directory listing via SSH ls, click to navigate, double-click to select. Also: CHANGELOG updated, wiki Home updated, #121 verified (encryption field already visible in Archive Settings tab). Closes #119, closes #105, closes #122, closes #98, closes #121	2026-06-23 13:05:42 -05:00
Jonathan Miller	de632e9c5c	feat: uppercase all placeholders + EXAMPLE prefix in resolution display ... All placeholders changed from lowercase to UPPERCASE: [host] → [HOST], [site_name] → [SITE_NAME], [date] → [DATE], [datetime] → [DATETIME], [profile_id] → [PROFILE_ID], etc. [HOME] and [DEFAULT_DIR] were already uppercase — now consistent. SQL migration 01.39.01 updates existing profile data in the database. Resolution display prefixed with "EXAMPLE:" to clarify these are example values resolved at backup time. 13 files updated across engines, fields, forms, templates, and SQL.	2026-06-23 11:52:52 -05:00
Jonathan Miller	f66100f74f	feat: SFTP remote storage with key file auth + CLI restore options ... SFTP support: - SftpUploader uses system scp/ssh binaries with key file auth - Private key stored as MEDIUMTEXT in profile table (sftp_key_data) - Key written to temp file (0600) at upload time, deleted after - Profile form: host, port, username, password, key textarea, passphrase, remote path — all with showon="remote_storage:sftp" - SQL migration for 7 new SFTP columns - Wired into BackupEngine, SteppedBackupEngine, PreflightCheck - API credential masking includes SFTP fields CLI restore options: - --files-only: restore files without touching database - --db-only: restore database without touching files - --no-preserve-config: overwrite configuration.php - --password: decryption password for encrypted archives	2026-06-23 08:21:10 -05:00
Jonathan Miller	5dcba6d8cb	feat: auto-verify backup integrity after creation (#65) ... After archive is created and checksum computed, automatically verify: - Archive opens without error - Contains at least one entry - database.sql present when backup type includes database - First entry is readable (spot-check) Applied to both BackupEngine and SteppedBackupEngine. Throws RuntimeException on verification failure (backup marked as failed). Closes #65	2026-06-21 19:45:46 -05:00
Jonathan Miller	8b6e260b28	fix: graceful degradation when remote upload fails (#66) ... Remote upload failure (S3/FTP/GDrive) no longer marks the entire backup as failed. The local archive is preserved with status 'complete' and the upload failure is logged as a warning. Applies to both BackupEngine and SteppedBackupEngine. Closes #66	2026-06-21 19:09:20 -05:00
Jonathan Miller	dbed0d0da7	fix: address PR review — remove dead code, consistent warnings key ... - Remove dead checkRequiredExtensions() method (superseded by PreflightCheck) - Add 'warnings' key to ALL return paths in BackupEngine::run() and SteppedBackupEngine::init() to prevent undefined key access on PHP 8.x - Include preflight warnings in success, failure, and early-exit returns	2026-06-21 17:54:11 -05:00
Jonathan Miller	edb202071c	feat: add pre-flight checks before backup starts (#67) ... Validate backup prerequisites before creating any record, catching common issues early with clear messages instead of failing mid-backup. Pre-flight checks: - Required PHP extensions (zip, pdo, pdo_mysql, mbstring, curl) - Backup directory exists and is writable - Sufficient disk space (last backup size + 20% buffer, skipped if no previous backup exists) - No other backup already running for this profile - Excluded tables exist in database (warns on missing) - Remote storage credentials minimally configured (FTP/S3/GDrive) Errors block the backup; warnings are logged and displayed but allow the backup to proceed. Integrated into both BackupEngine::run() and SteppedBackupEngine::init() before any record is inserted. UI: AJAX init response includes warnings array, displayed in the stepped backup progress modal. Closes #67	2026-06-21 17:47:13 -05:00
Jonathan Miller	55954ba081	fix: remaining review items — prefix in trailing SQL, dead code, indent ... - DatabaseImporter: apply #__ prefix replacement on trailing statement (was missing for SQL not terminated by semicolon) - SteppedBackupEngine: remove unused DatabaseDumper instantiation - SteppedBackupEngine: fix misaligned indentation in stepDatabase()	2026-06-18 10:59:47 -05:00
Jonathan Miller	a4c03d0032	fix: critical review — infinite recursion, SQL injection, FK prefix ... Critical: - Fix infinite recursion in getValidatedPrefix() — was calling itself instead of extracting from $data array - Fix SQL injection in actionResetAdmin() — prefix not validated, now uses getValidatedPrefix() High: - Fix prefix abstraction to cover FK REFERENCES — str_replace now targets backtick+prefix pattern to catch all table references in CREATE TABLE output, not just the current table name Medium: - Security gate file write check — skip verification gracefully if file cannot be written (don't lock user out) - Stepped notification catch \Throwable instead of \Exception	2026-06-18 10:56:02 -05:00
Jonathan Miller	b2874f32f2	feat: abstract DB prefix, stepped checksum, restore security gate ... Database prefix abstraction: - DatabaseDumper uses #__ placeholder instead of live prefix in all SQL output (DROP TABLE, CREATE TABLE, INSERT INTO) - SteppedBackupEngine::dumpSingleTable() same #__ replacement - DatabaseImporter replaces #__ with current site prefix on import - MokoRestore replaces #__ with user-specified prefix on import - Backups are now portable across sites with different prefixes Stepped backup checksum: - completeRecord() now computes and stores SHA-256 checksum MokoRestore security gate: - Writes .mokorestore-security.php with random 8-char code to site root - User must read code from filesystem and enter it in browser - Proves filesystem access before any restore actions are allowed - Security file auto-deleted after successful verification - All AJAX actions blocked until verification completes	2026-06-18 10:42:10 -05:00
Jonathan Miller	36ec6dd5a3	fix: notifications for AJAX backups, download CSRF token ... SteppedBackupEngine now sends email + ntfy notifications on both success (completeRecord) and failure (failRecord). Previously only BackupEngine (synchronous CLI/toolbar path) sent notifications. Download link in backups template now includes the CSRF token in the URL query string, fixing "security token did not match" error when clicking download buttons.	2026-06-18 10:19:43 -05:00
Jonathan Miller	3a6354e648	refactor: store config as .bak, rebuild on restore ... Instead of storing a sanitized configuration.php in the archive, save it as configuration.php.bak with credentials stripped. No configuration.php exists in the archive — it's rebuilt from the .bak template + user-provided credentials during restore. Backup side: - configuration.php stored as configuration.php.bak (sanitized) - No configuration.php in the archive (prevents accidental use) MokoRestore side: - Reads .bak as base template (preserves non-sensitive settings: debug, cache, SEF, editor, timezone, etc.) - Replaces all sanitized fields with user input - Clears proxy/Redis/TLS placeholders to empty strings - Deletes .bak after successful rebuild - Falls back to configuration.php for legacy backups FileRestorer: - Added configuration.php.bak to skip list	2026-06-14 15:30:17 -05:00
Jonathan Miller	2f490c3208	feat: sanitize configuration.php in backups ... Strip sensitive credentials from configuration.php before adding it to the backup archive. Replaced fields use [SANITIZED:field] placeholders: - Database: host, user, password, db - Security: secret - SMTP: smtpuser, smtppass, smtphost - Proxy: proxy_user, proxy_pass - Redis: redis_server_auth, session_redis_server_auth - DB TLS: dbsslkey, dbsslcert, dbsslca Non-sensitive fields (sitename, debug, cache, SEF, paths, etc.) are preserved as-is for inspection and partial restores. MokoRestore detects sanitized placeholders and leaves those form fields blank so the user must enter fresh credentials (like the Joomla installer). In-Joomla restore is unaffected because RestoreEngine preserves the current site's configuration.php. Applied to both BackupEngine (synchronous) and SteppedBackupEngine (AJAX-based) code paths.	2026-06-14 14:42:54 -05:00
Jonathan Miller	ace33b60fe	feat: rename mokojoombackup → mokosuitebackup, add [HOME] placeholder for backup directory ... Renames all sub-extensions from mokojoombackup to mokosuitebackup (package, component, 7 plugins, language files, manifests). Adds [HOME] placeholder to BackupDirectory and PlaceholderResolver so users can set backup_dir to [HOME]/backups (outside web root). Fixes folder browser "access denied" on PHP-FPM shared hosting where getenv('HOME') returns empty by adding POSIX and JPATH_ROOT fallback detection.	2026-06-11 12:24:27 -05:00