2 Commits

Author	SHA1	Message	Date
Jonathan Miller	9484d6bde9	security: fix 9 security and critical bugs (#107-#115, #120) ... - #107: Fix testConnection() broken event dispatch (Joomla 5+ ArrayAccess pattern) and add CSRF + ACL checks - #108: Add CSRF checkToken() to OauthController::authorize() - #109: Add core.manage ACL check to REST dispatch endpoint - #110: Fix LinkedIn null-coalesce on organization_id - #111: Add CURLOPT_PROTOCOLS to webhook, mastodon, ghost, bluesky to prevent SSRF via user-controlled URLs - #112: Encrypt credentials at rest using sodium_crypto_secretbox with key derived from Joomla secret; backward-compat with existing plaintext JSON credentials - #113: Fix unclosed <script> tag in dashboard template - #114: Fix hasPendingWork() to use exponential backoff matching processQueue() instead of linear delay - #115: Fix timestamp lock TOCTOU race with atomic UPDATE + WHERE - #120: Add CSRF token to dashboard migration link Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 09:33:12 -05:00
Jonathan Miller	75c34345f9	refactor: rename src/ to source/ per moko-platform standards ... Rename root source directory from src/ to source/ and update all references in Makefile, manifest.xml, .gitignore, CI workflows, and wiki documentation. Internal Joomla namespace paths (src/Extension) are unchanged as they are plugin-internal structure. CI workflows updated to check source/ first with src/ fallback for backward compatibility across repos. Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 08:11:29 -05:00