Send notifications when site restores and snapshot create/restore
complete. Uses sendRestoreNotification() with type-specific subjects.
All calls wrapped in try-catch to never break the actual operation.
Closes#60
Add mokosuitebackup.snapshot task type for com_scheduler with params
for content_types and description_format ([date]/[datetime] placeholders).
Closes#56
Add five endpoints matching the existing backup API pattern:
- GET /snapshots — list with pagination
- POST /snapshot — create (content_types, description)
- POST /snapshot/:id/restore — restore (mode, content_types)
- DELETE /snapshot/:id — delete record + file
- GET /snapshot/:id/download — stream JSON file
ACL: mokosuitebackup.snapshot.manage for write ops, core.manage for read.
Routes registered in webservices plugin alongside backup routes.
Closes#54
After archive is created and checksum computed, automatically verify:
- Archive opens without error
- Contains at least one entry
- database.sql present when backup type includes database
- First entry is readable (spot-check)
Applied to both BackupEngine and SteppedBackupEngine. Throws
RuntimeException on verification failure (backup marked as failed).
Closes#65
The fields_values table is shared across all Joomla extensions.
Previously, dump captured ALL field values and restore deleted ALL
field values, destroying data for contacts, users, and other
extensions. Now scoped via subquery on field_id WHERE context =
'com_content.article'.
Remote upload failure (S3/FTP/GDrive) no longer marks the entire
backup as failed. The local archive is preserved with status
'complete' and the upload failure is logged as a warning. Applies
to both BackupEngine and SteppedBackupEngine.
Closes#66
When articles are included in a snapshot, now also captures:
- #__tags (tag definitions)
- #__fields (custom field definitions for com_content.article)
- #__fields_values (custom field values)
- #__fields_categories (field-to-category mappings)
Restore correctly scopes deletes to avoid touching non-content fields.
Closes#57
Add retention settings for content snapshots (max count, max age days)
in component options. System plugin runs cleanupOldSnapshots() alongside
existing backup cleanup, deleting JSON files and DB records.
Closes#63
#68: Add backup type filter dropdown to backups list view
- filter_backups.xml: full/database/files/differential options
- BackupsModel: backup_type filter in getListQuery()
- Language string: COM_MOKOJOOMBACKUP_FILTER_TYPE_ALL
#72: Path traversal protection in RestoreEngine and MokoRestore
- RestoreEngine::extractArchive(): validate ZIP entries before extractTo()
- RestoreEngine::extractTarGz(): validate PharData entries before extractTo()
- MokoRestore standalone script: same validation in generated PHP code
- Rejects entries containing ../ or starting with / or \
Closes#68, closes#72
CRITICAL:
- #73: S3Uploader now streams file via CURLOPT_PUT/INFILE instead of
loading entire file into RAM with file_get_contents
- #74: DatabaseDumper gains dumpToFile() that streams SQL to disk;
BackupEngine uses addFile() instead of addFromString() to avoid
holding the entire dump in memory
- #75: AkeebaImporter removes unserialize() — only uses json_decode,
skips legacy serialized filter data to prevent object injection
MEDIUM (also fixed):
- BackupEngine: $archiveName initialized before try block (prevents
undefined variable in catch)
- BackupEngine: plaintext archive deleted on encryption failure
- BackupEngine: temp SQL file cleaned up in both success and failure
- BackupEngine: createArchiver() throws on unknown format instead of
silently falling back to ZIP
- TarGzArchiver: intermediate .tar cleaned up in finally block
Closes#73, closes#74, closes#75
Ref #81
Fixes all critical and high severity issues from the codebase audit:
CRITICAL:
- #71: RestoreCommand passed wrong args to RestoreEngine (filepath
instead of record ID) — CLI restore was completely broken
- #72: JpaUnarchiver path traversal — added traversal rejection and
realpath boundary check to prevent writes outside staging dir
- #77: RestoreEngine staging path sanitized — $record->tag stripped
of non-alphanumeric characters
HIGH:
- #75: (noted, AkeebaImporter unserialize needs separate refactor)
- #76: BackupTable now deletes DB row before file — prevents data
loss if DB delete fails
- #78: API profiles endpoint now masks sensitive fields (passwords,
keys, tokens) with '***'
- #79: Webcron handler adds return after sendJsonResponse — prevents
execution falling through on non-terminal close()
- #80: BackupModel/ProfileModel loadFormData() now casts array to
object — prevents TypeError on PHP 8.x form state restore
PREFLIGHT HARDENING:
- PreflightCheck::run() wrapped in try-catch for DB exceptions
- mkdir() failure now includes actual error reason
- Unresolved placeholders generate a warning instead of silent return
Closes#71, closes#76, closes#77, closes#78, closes#79, closes#80
Ref #72, ref #81
- Remove dead checkRequiredExtensions() method (superseded by PreflightCheck)
- Add 'warnings' key to ALL return paths in BackupEngine::run() and
SteppedBackupEngine::init() to prevent undefined key access on PHP 8.x
- Include preflight warnings in success, failure, and early-exit returns
Validate backup prerequisites before creating any record, catching
common issues early with clear messages instead of failing mid-backup.
Pre-flight checks:
- Required PHP extensions (zip, pdo, pdo_mysql, mbstring, curl)
- Backup directory exists and is writable
- Sufficient disk space (last backup size + 20% buffer, skipped if
no previous backup exists)
- No other backup already running for this profile
- Excluded tables exist in database (warns on missing)
- Remote storage credentials minimally configured (FTP/S3/GDrive)
Errors block the backup; warnings are logged and displayed but allow
the backup to proceed. Integrated into both BackupEngine::run() and
SteppedBackupEngine::init() before any record is inserted.
UI: AJAX init response includes warnings array, displayed in the
stepped backup progress modal.
Closes#67
Fixes from code review and silent failure audit:
- SnapshotRestoreEngine: catch only duplicate key errors (MySQL 1062)
in merge mode, re-throw all other exceptions instead of swallowing
- SnapshotRestoreEngine: add json_last_error() check for better error
messages on corrupt snapshot files
- SnapshotRestoreEngine: log warnings when set_time_limit/ini_set fail
- SnapshotEngine: use strlen($json) instead of filesize() to avoid
race conditions; catch \Exception instead of \Throwable
- SnapshotsController: remove @unlink suppression, add try-catch
around delete loop with partial failure reporting
- script.php: add user-facing warning when webcron secret generation
fails (was silently swallowed, inconsistent with other catch blocks)
The truncateFiltered() method ran unfiltered DELETE FROM #__modules
in replace mode, which would wipe ALL site modules (admin toolbar,
login, menus) — not just the ones in the snapshot. Now scoped to
only delete modules whose IDs exist in the snapshot data.
Also scopes #__modules_menu delete to snapshot module IDs, and adds
defense-in-depth validation of restore_mode in the controller.
Add content snapshot system for lightweight article/category/module
versioning independent of full backups. Snapshots store as JSON files
with replace or merge restore modes, wrapped in DB transactions.
- SnapshotEngine: dumps articles, categories, modules + related tables
(workflow_associations, tag maps, frontpage) to JSON
- SnapshotRestoreEngine: replace (clean slate) or merge (upsert) mode
- Full MVC: controller, models, view, template with create/restore modals
- New ACL permission: mokosuitebackup.snapshot.manage
- Submenu entry with camera icon, upgrade SQL for snapshots table
Improve full-site restore UI with confirmation modal offering options
for files, database, preserve config, and encryption password.
Config improvements:
- WebcronSecretField: CSPRNG generator, strength meter, rejects weak
patterns (password, admin, secret), enforces min 16 chars
- IpWhitelistField: table-based management, current IP detection with
one-click "Add my IP" button
- Default profile shows "Title (#ID)" format
- Default backup dir uses [DEFAULT_DIR] placeholder
- Install script generates random 32-char webcron secret
- Dashboard quick actions: full-width dropdown with button below
Static helper class for external consumers (bridge plugins, MCP servers)
to query backup status without bootstrapping the full component.
Methods:
- isInstalled(): check if MokoSuiteBackup is installed and enabled
- getLatestRecord(): get the most recent completed/failed backup
- getStatusSummary(): full heartbeat payload with latest status,
all-time/7-day totals, and consecutive success streak
Critical:
- Fix infinite recursion in getValidatedPrefix() — was calling itself
instead of extracting from $data array
- Fix SQL injection in actionResetAdmin() — prefix not validated,
now uses getValidatedPrefix()
High:
- Fix prefix abstraction to cover FK REFERENCES — str_replace now
targets backtick+prefix pattern to catch all table references in
CREATE TABLE output, not just the current table name
Medium:
- Security gate file write check — skip verification gracefully if
file cannot be written (don't lock user out)
- Stepped notification catch \Throwable instead of \Exception
Database prefix abstraction:
- DatabaseDumper uses #__ placeholder instead of live prefix in all
SQL output (DROP TABLE, CREATE TABLE, INSERT INTO)
- SteppedBackupEngine::dumpSingleTable() same #__ replacement
- DatabaseImporter replaces #__ with current site prefix on import
- MokoRestore replaces #__ with user-specified prefix on import
- Backups are now portable across sites with different prefixes
Stepped backup checksum:
- completeRecord() now computes and stores SHA-256 checksum
MokoRestore security gate:
- Writes .mokorestore-security.php with random 8-char code to site root
- User must read code from filesystem and enter it in browser
- Proves filesystem access before any restore actions are allowed
- Security file auto-deleted after successful verification
- All AJAX actions blocked until verification completes
Critical:
- Wrap cleanupOldBackups() in try-catch to prevent admin panel crash
- Add missing fields (total_size, files_count, etc.) to failure record
so failure notifications actually send
High:
- Log unlink failures in deleteBackupRecord() instead of silent return
- Wrap DB delete in try-catch so one failed record doesn't abort loop
- Check for ext-curl before calling curl_init() in sendNtfy()
Medium:
- Change runPreActionBackup catch from \Exception to \Throwable
- Log warning for skipped files during archive encryption
- Truncate ntfy response body in error logs (200 chars max)
SteppedBackupEngine now sends email + ntfy notifications on both
success (completeRecord) and failure (failRecord). Previously only
BackupEngine (synchronous CLI/toolbar path) sent notifications.
Download link in backups template now includes the CSRF token in
the URL query string, fixing "security token did not match" error
when clicking download buttons.
The update object passed to NotificationSender only had fields
being updated in the DB (total_size, checksum, etc). It was missing
backup_type, archivename, description, origin, and backupstart —
which are set on the initial insert and don't change. This caused
ntfy notifications to show empty Type and Archive fields.
BackupEngine: check ext-zip, ext-pdo, ext-pdo_mysql, ext-mbstring
before running (was only zip + mbstring).
Installer preflight: warn about missing extensions (zip, pdo,
pdo_mysql, mbstring, curl) during install/update. Warns but does
not block installation so the component can still be configured.
MokoRestore already checks ext-zip, ext-pdo_mysql, ext-mbstring,
ext-json in its preflight step.
composer.json already declares all six extensions as requirements
(zip, pdo, pdo_mysql, curl, ftp, mbstring) — composer install
fails if any are missing, which CI enforces.
Closes#22
gitea-actions[bot]
jmiller