MokoConsulting/MokoSuiteBackup

feat: full-screen backup screen for pre-update + Backup Now (Akeeba-style), fixes white screen #238

Merged

jmiller merged 2 commits from feat/fullscreen-backup-screen into dev

2026-07-06 03:58:05 +00:00

Author	SHA1	Message	Date
jmiller	4311ec8f99	fix(security): enforce scheme allow-list on runbackup return URL Universal: PR Check / Branch Policy (pull_request) Successful in 2s Details Universal: PR Check / Require Docs Update (pull_request) Has been skipped Details Universal: PR Check / Wiki Update Reminder (pull_request) Has been skipped Details Universal: PR Check / Secret Scan (pull_request) Successful in 9s Details Generic: Project CI / Lint & Validate (pull_request) Successful in 14s Details RC Revert / Rename rc/ back to dev/ (pull_request) Has been skipped Details Branch Cleanup / Delete merged branch (pull_request) Successful in 2s Details Universal: PR Check / Validate PR (pull_request) Failing after 14s Details Joomla: Metadata Validation / Validate Joomla Metadata (pull_request) Successful in 1m8s Details Generic: Project CI / Tests (pull_request) Has been cancelled Details Universal: PR Check / Build RC Package (pull_request) Has been cancelled Details Universal: PR Check / Report Issues (pull_request) Has been cancelled Details The pre-update return URL is assigned to window.location.href, so a javascript:/data: URI (empty host) would have passed the host-only check and executed. Require an absolute http(s) same-host URL or a single-slash root-relative path; reject javascript:/data:/vbscript: and protocol-relative //host. Claude-Session: https://claude.ai/code/session_01WbGBN9VyRK61zczYWcCQ2i	2026-07-05 22:57:40 -05:00
jmiller	8cfa46d985	feat: full-screen backup screen for pre-update + Backup Now (Akeeba-style) Universal: PR Check / Wiki Update Reminder (pull_request) Has been skipped Details Universal: PR Check / Require Docs Update (pull_request) Has been skipped Details Universal: PR Check / Branch Policy (pull_request) Successful in 1s Details Universal: PR Check / Secret Scan (pull_request) Successful in 7s Details Generic: Project CI / Lint & Validate (pull_request) Successful in 12s Details Universal: PR Check / Validate PR (pull_request) Failing after 13s Details Joomla: Metadata Validation / Validate Joomla Metadata (pull_request) Successful in 49s Details Generic: Project CI / Tests (pull_request) Has been cancelled Details Universal: PR Check / Build RC Package (pull_request) Has been cancelled Details Universal: PR Check / Report Issues (pull_request) Has been cancelled Details Replace the popup-modal pre-update approach with a dedicated full-page backup screen, modelled on Akeeba Backup-on-Update, and fix the white screen caused by running a backup synchronously inside the update request. - New view=runbackup (View/Runbackup + tmpl/runbackup): full-screen progress page that auto-starts the stepped backup (ajax.init -> loop ajax.step), then redirects to a validated returnurl on completion or shows a completion/retry panel. Auto-resolved by MVCFactory. - System plugin: on com_joomlaupdate task=update.install (when backup_before_update is on), redirect to the full-screen backup screen with returnurl back to update.install&is_backed_up=1; on return, arm the throttle so onExtensionBeforeUpdate does not run a duplicate backup. No synchronous backup in the update request. - Dashboard 'Backup Now' navigates to the full-screen screen instead of the inline modal; the inline modal + stepped JS are removed. - Retire the popup modal: delete media/js/update-backup.js, remove the plugin <media> element and the preupdate_auto_intercept param. - Dashboard: warn when Global Config live_site is empty (CLI/scheduled backup naming + URL generation depend on it). Refs #196 Claude-Session: https://claude.ai/code/session_01WbGBN9VyRK61zczYWcCQ2i	2026-07-05 22:55:28 -05:00