Jonathan Miller
861086bf33
Generic: Repo Health / Site Health (push) Has been cancelled
Generic: Repo Health / Access control (push) Has been cancelled
Universal: Auto Version Bump / Version Bump (push) Has been cancelled
Update Server / Update Server (push) Has been cancelled
Platform: moko-platform CI / Gate 1: Code Quality (push) Has been cancelled
Platform: moko-platform CI / Gate 2: Unit Tests (8.1) (push) Has been cancelled
Platform: moko-platform CI / Gate 2: Unit Tests (8.2) (push) Has been cancelled
Platform: moko-platform CI / Gate 2: Unit Tests (8.3) (push) Has been cancelled
Platform: moko-platform CI / Gate 3: Self-Health Check (push) Has been cancelled
Platform: moko-platform CI / Gate 4: Governance (push) Has been cancelled
Platform: moko-platform CI / Gate 5: Template Integrity (push) Has been cancelled
Platform: moko-platform CI / CI Summary (push) Has been cancelled
Generic: Repo Health / Scripts governance (push) Has been cancelled
Generic: Repo Health / Repository health (push) Has been cancelled
Generic: Repo Health / Report Issues (push) Has been cancelled
#1 exportSettings: added CSRF token check (Session::checkToken('get')) #2 All controllers: added explicit return after jsonForbidden() and early-exit jsonResponse() calls — prevents execution fallthrough #3 Delete/update handlers: return validation implicit via getInt #6 WAF scanInput: double urldecode to catch %25xx encoding tricks #7 PrivacyModel anonymize: now clears #__user_profiles and #__contact_details (GDPR completeness) #12 SLA responded: only marked on staff replies, not customer self-replies — prevents customers from clearing their own SLA timer #13 MokoWaaSHelper: getMasterUsernames() changed to private static — prevents third-party code from accessing decoded master usernames Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
MokoWaaS
MokoWaaS is a Joomla 5.x / 6.x system plugin package that provides white-label branding, security hardening, tenant restrictions, health monitoring, and multi-domain management for the MokoWaaS platform.
Features
- White-Label Branding — configurable brand name, company, support URL, colors, favicon, custom CSS
- Tenant Restrictions — master user enforcement, installer/sysinfo/config/template access control
- Health Monitoring — 16 diagnostic checks via
/?mokowaas=healthwith Grafana auto-provisioning - Site Aliases — per-alias offline mode, robots directives, backend redirect, canonical URLs
- Remote API — 6 endpoints (health, install, update, cache, backup, info)
- Security Hardening — HTTPS enforcement, session timeouts, password policy, upload restrictions
- Plugin Protection — protected status, hidden from non-master users, disable/uninstall blocked
Requirements
- Joomla 5.0+ or 6.x
- PHP 8.1+ (8.3+ for Joomla 6)
Installation
Download the latest pkg_mokowaas-*.zip from Releases and install via System → Install → Upload Package File.
After installation, the package auto-enables and sets protected status.
Documentation
Full documentation is available on the MokoWaaS Wiki:
License
GPL-3.0-or-later — see LICENSE.md
Changelog
See CHANGELOG.md