MokoConsulting/MokoSuiteBackup
1
0
Fork 0
Code Issues 29 Pull Requests 1 Releases 2 Wiki Activity

fix(review): open-redirect + btoa + honest duplicate-mode txn #249

Merged
jmiller merged 2 commits from fix/prerelease-review into dev 2026-07-12 22:14:44 +00:00
Conversation 0 Commits 2 Files Changed 16
+66 -28

2 Commits

Author SHA1 Message Date
mokogitea-actions[bot] 498f62e975 chore(version): pre-release bump to 02.58.36-dev [skip ci]
Branch Cleanup / Delete merged branch (pull_request) Has been cancelled
Details
RC Revert / Rename rc/ back to dev/ (pull_request) Has been cancelled
Details
2026-07-12 22:14:30 +00:00
jmiller f9c1c6b186 @
Universal: Pre-Release / Build Pre-Release (${{ inputs.stability || github.ref_name }}) (push) Successful in 16s
Details
Generic: Project CI / Lint & Validate (pull_request) Has been cancelled
Details
Universal: PR Check / Branch Policy (pull_request) Has been cancelled
Details
Universal: PR Check / Require Docs Update (pull_request) Has been cancelled
Details
Universal: PR Check / Wiki Update Reminder (pull_request) Has been cancelled
Details
Universal: PR Check / Secret Scan (pull_request) Has been cancelled
Details
Universal: PR Check / Validate PR (pull_request) Has been cancelled
Details
Joomla: Metadata Validation / Validate Joomla Metadata (pull_request) Has been cancelled
Details
Generic: Project CI / Tests (pull_request) Has been cancelled
Details
Universal: PR Check / Build RC Package (pull_request) Has been cancelled
Details
Universal: PR Check / Report Issues (pull_request) Has been cancelled
Details 
fix(review): open-redirect, btoa UTF-8 safety, honest duplicate-mode txn

Pre-release review findings on dev -> main:

- Return-URL open-redirect (MED): a base64 returnurl like "/\evil.com"
  passed the root-relative allow-list (raw[1] is "\", not "/"), and a
  browser normalises leading "/\" to "//", yielding a protocol-relative
  redirect off-site. Reject any backslash or control char in the decoded
  return URL outright — legitimate Joomla admin URLs never contain them.

- installer-backup.js btoa() (LOW): btoa() throws on non-Latin1 input
  (e.g. a UTF-8 filter value in the list query string), and the throw was
  uncaught after preventDefault(), leaving the toolbar button dead. Build
  the redirect (UTF-8-safe base64) BEFORE swallowing the click; if it
  still fails, bail without preventing so Joomla proceeds normally.

- Snapshot duplicate-mode transaction (HIGH): restore() wrapped duplicate
  mode in transactionStart()/Rollback(), but duplicate mode writes via
  Joomla Table API whose Nested tables (categories/tags) issue LOCK
  TABLES, which implicitly COMMITS the open transaction in MySQL — so the
  rollback promise was illusory and a mid-inject failure left a slave
  half-updated. Run only the raw-DB modes (replace/create/merge) inside
  the transaction; duplicate mode runs outside it, matching its existing
  per-item defensive design (bad item skipped + logged, never fatal).

Claude-Session: https://claude.ai/code/session_01WbGBN9VyRK61zczYWcCQ2i
@
 2026-07-12 17:14:10 -05:00