fix: admin submenu items and icons for Joomla 6 #45
Reference in New Issue
Block a user
Delete Branch "dev"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Admin Menu & Icons (Joomla 6)
<submenu>entries in component manifestensureSubmenuItems()— creates missing submenu items on update via MenuTable APImenu_iconparam for level 2+ items (Atum only rendersimgcolumn for level 1)#menu→.main-nav(Joomla 6 uses dynamicid="menu{moduleId}")margin-inline-endfor RTL supportACL Permissions
access.xmlwith core actions + 3 custom backup actions (run, download, restore)checkToken('get')to download, ACL check to verify()readfile()instead of memory-unsafefile_get_contents+ base64Installer Script Hardening
postflight()@mkdirwith checkedcreateBackupDirectory()+.htaccess/index.htmlprotectionpreflight()\Exception(not\Throwable),enqueueMessage()for user feedbackensureSubmenuItems()mergesmenu_iconinto existing params (not overwrite)getIdentity()?->idnull-safe operatorwarnDefaultBackupDir→migrateDefaultBackupDirsyncMenuIcons()LIKE pattern precisionfixPackageClientId()— packages must beclient_id=0for update matchingConfiguration Security
configuration.phpin backups — store as.bakwith credentials stripped[SANITIZED:field]placeholders (DB, secret, SMTP, proxy, Redis, TLS)configuration.phpin archive — rebuilt from.baktemplate + user input on restore.htaccessreset option (checkbox to restore Joomla defaults).bak, falls back to legacyconfiguration.phpPre-action Backups
onExtensionBeforeUpdate/onExtensionBeforeUninstallBug Fixes
boot()— addHtmlDocumenttype check, widen catch to\Exceptionclient_id— packages must be 0 (site) for Joomla updater to matchTest plan
configuration.php.bakin archive with credentials stripped, noconfiguration.php.bak+ user input, SMTP fields work, .htaccess reset worksRenames all sub-extensions from mokojoombackup to mokosuitebackup (package, component, 7 plugins, language files, manifests). Adds [HOME] placeholder to BackupDirectory and PlaceholderResolver so users can set backup_dir to [HOME]/backups (outside web root). Fixes folder browser "access denied" on PHP-FPM shared hosting where getenv('HOME') returns empty by adding POSIX and JPATH_ROOT fallback detection.The CSS selector #menu doesn't exist in Joomla 6 — mod_menu uses id="menu{moduleId}" (dynamic). Switch to .main-nav class selector which is stable across Joomla 4/5/6. Also use margin-inline-end for RTL support.- Add ACL check (core.manage) to verify() — was completely unguarded - Add checkToken('get') to download() for CSRF protection - Wrap all setMessage() calls in Text::_() for proper translation - Add HTTP 403 status to all AJAX token/ACL denial responses - Add $status param to sendJson() helper - Wrap viewLog() DB query in try-catch, return JSON error on failure - Fix viewLog() file_get_contents to detect read errors vs missing - Replace API download() file_get_contents + base64 with streaming readfile() to prevent memory exhaustion on large backups - Gate backup profile selector in template behind backup.run permission