7 Commits

Author	SHA1	Message	Date
Jonathan Miller	899a33bc58	feat: purge, CPanel module, 7z format, SFTP browser (#119, #105, #122, #98) ... #119: Manual purge — toolbar button opens modal with date picker, AJAX count preview, confirmation before bulk delete. #105: CPanel admin dashboard module (mod_mokosuitebackup_cpanel) — backup status, quick action buttons per profile, next scheduled, stats, and quick links. Registered in package manifest. #122: 7z archive format via system 7za/7z CLI binary with optional password encryption. New SevenZipArchiver engine class. #98: SFTP remote file browser — custom SftpPathField with "Browse Remote" button, modal directory listing via SSH ls, click to navigate, double-click to select. Also: CHANGELOG updated, wiki Home updated, #121 verified (encryption field already visible in Archive Settings tab). Closes #119, closes #105, closes #122, closes #98, closes #121	2026-06-23 13:05:42 -05:00
Jonathan Miller	fc41e1801a	fix: placeholder resolution display + CSRF token on Run Backup button ... FolderPickerField: shows resolved placeholder values below input as badges (e.g. [HOME]=/home/user, [host]=example.com), plus full resolved path. Updates live as user types. BackupsController::start(): accept CSRF token from both GET and POST so the "Run Backup Now" link button on profile edit works without triggering "security token did not match" error.	2026-06-23 11:35:48 -05:00
Jonathan Miller	edb202071c	feat: add pre-flight checks before backup starts (#67) ... Validate backup prerequisites before creating any record, catching common issues early with clear messages instead of failing mid-backup. Pre-flight checks: - Required PHP extensions (zip, pdo, pdo_mysql, mbstring, curl) - Backup directory exists and is writable - Sufficient disk space (last backup size + 20% buffer, skipped if no previous backup exists) - No other backup already running for this profile - Excluded tables exist in database (warns on missing) - Remote storage credentials minimally configured (FTP/S3/GDrive) Errors block the backup; warnings are logged and displayed but allow the backup to proceed. Integrated into both BackupEngine::run() and SteppedBackupEngine::init() before any record is inserted. UI: AJAX init response includes warnings array, displayed in the stepped backup progress modal. Closes #67	2026-06-21 17:47:13 -05:00
Jonathan Miller	c466839a40	fix: final review — SQL injection, input escaping, undefined var ... Critical/High: - Fix undefined $configFile → $configPath in from-scratch config path - Escape all user input with addcslashes before interpolating into configuration.php (both regex-replace and HEREDOC paths) - Add getValidatedPrefix() helper — validates db_prefix format before use in SQL table names across all restore functions - fixPackageClientId() now warns user via enqueueMessage on failure - sanitizeConfiguration() logs error on file read failure Medium: - Content-Disposition header uses RFC 6266 rawurlencode (both admin and API download controllers) - Remove @unlink suppression, log warning on failure - viewLog() catch block now logs exception context - writeDefaultHtaccess() checks copy/write, returns status to caller - actionConfig() checks file_put_contents return value	2026-06-15 01:10:04 -05:00
Jonathan Miller	c381829fc5	fix: ACL review — missing checks, HTTP status codes, memory safety ... - Add ACL check (core.manage) to verify() — was completely unguarded - Add checkToken('get') to download() for CSRF protection - Wrap all setMessage() calls in Text::_() for proper translation - Add HTTP 403 status to all AJAX token/ACL denial responses - Add $status param to sendJson() helper - Wrap viewLog() DB query in try-catch, return JSON error on failure - Fix viewLog() file_get_contents to detect read errors vs missing - Replace API download() file_get_contents + base64 with streaming readfile() to prevent memory exhaustion on large backups - Gate backup profile selector in template behind backup.run permission	2026-06-13 07:42:23 -05:00
Jonathan Miller	ff5f0108b9	feat: wire up ACL permission checks across all controllers and views ... Enforce granular permissions defined in access.xml: Controllers (server-side enforcement): - BackupsController: start() → backup.run, download() → backup.download, restore() → backup.restore - AjaxController: init()/step() → backup.run, browseDir()/viewLog() → core.manage - API BackupsController: backup() → backup.run, download() → backup.download, profiles() → core.manage - ProfilesController: importAkeeba() → core.create Views (toolbar button visibility): - Backups: conditionally show Start, Restore, Delete, Preferences - Profiles: conditionally show Add, Edit, Import, Delete, Preferences - Profile edit: conditionally show Save/Apply based on create/edit Templates: - Backups list: hide download button when backup.download denied	2026-06-13 07:23:57 -05:00
Jonathan Miller	ace33b60fe	feat: rename mokojoombackup → mokosuitebackup, add [HOME] placeholder for backup directory ... Renames all sub-extensions from mokojoombackup to mokosuitebackup (package, component, 7 plugins, language files, manifests). Adds [HOME] placeholder to BackupDirectory and PlaceholderResolver so users can set backup_dir to [HOME]/backups (outside web root). Fixes folder browser "access denied" on PHP-FPM shared hosting where getenv('HOME') returns empty by adding POSIX and JPATH_ROOT fallback detection.	2026-06-11 12:24:27 -05:00