Release: MokoJoomCross v01.01.00 #106
Closed
jmiller
wants to merge 116 commits from
dev into main
pull from: dev
merge into: :main
:main
:dev
:feature/107-bug-testconnection-broken-event-dispatch
:feature/108-security-oauthcontroller-authorize-missi
:feature/109-security-rest-dispatch-endpoint-missing-
:feature/110-bug-linkedin-organization-id-missing-nul
:feature/111-security-ssrf-risk-in-user-controlled-se
:feature/112-security-oauth-credentials-stored-in-pla
:feature/113-bug-broken-script-tag-in-dashboard-templ
:feature/114-bug-haspendingwork-backoff-mismatch-with
:feature/115-bug-race-condition-in-timestamp-based-qu
:feature/116-performance-n-1-queries-in-processevergr
:feature/117-performance-n-1-queries-in-rendertemplat
:feature/118-enhancement-media-attachments-not-wired-
:feature/119-enhancement-8-stub-service-plugins-need-
:feature/120-bug-dashboard-migration-link-missing-csr
:feature/121-bug-schedule-allows-re-scheduling-alread
:feature/122-bug-updatelastruntimestamp-race-conditio
:feature/123-bug-missing-curl-error-handling-across-a
:feature/124-enhancement-teams-plugin-uses-deprecated
:feature/126-bug-ntfy-supportsmedia-inconsistency
:feature/100-bug-duplicate-category-rules-table-in-in
:feature/101-bug-evergreen-search-uses-fragile-json-l
:feature/102-enhancement-dispatchcontroller-duplicate
:feature/103-enhancement-deprecated-sidebar-api-usage
:feature/104-security-no-acl-csrf-check-on-csv-export
:feature/105-security-missing-csrf-check-on-migration
:feature/84-fixed-csrf-nonce-on-oauth-authorize-call
:feature/85-fixed-service-credential-fields-never-sa
:feature/86-fixed-joomla-5-event-arrayaccess-pattern
:feature/87-fixed-servicetable-missing-check-method
:feature/88-fixed-webhookservice-credential-key-mism
:feature/89-fixed-post-method-enforcement-on-rest-di
:feature/90-fixed-serviceiconhelper-xss-via-unescape
:feature/91-fixed-article-history-html-double-escape
:feature/92-bug-mysql-only-get-lock-breaks-postgresq
:feature/93-bug-processevergreen-imports-wrong-plugi
:feature/94-bug-postscontroller-retryfailed-misses-p
:feature/95-bug-postscontroller-unvalidated-datetime
:feature/96-enhancement-facebook-token-should-not-be
:feature/97-enhancement-bluesky-re-authenticates-on-
:feature/98-enhancement-mailchimp-campaigns-are-crea
:feature/99-performance-crosspostdispatcher-makes-n-
:feature/79-test-category-routing-rules
:feature/80-test-character-counter-in-template-edito
:feature/81-test-service-type-icons-throughout-ui
:feature/82-test-per-service-analytics-drill-down
:feature/83-test-article-editor-cross-post-history-p
:feature/53-test-twitter-oauth-1-0a-credential-field
:feature/54-test-all-34-service-credential-fields-di
:feature/55-test-13-rewritten-service-plugin-api-imp
:feature/56-test-admin-views-load-without-errors-too
:feature/57-test-post-edit-form-manual-post-creator-
:feature/58-test-evergreen-content-re-sharing
:feature/59-test-test-connection-button-on-service-e
:feature/60-test-bulk-re-queue-failed-and-purge-post
:feature/61-test-dashboard-trend-chart-and-date-rang
:feature/62-test-queue-depth-warning-on-dashboard
:feature/63-test-exponential-backoff-for-retries
:feature/64-test-first-publish-only-toggle
:feature/65-test-hashtag-injection-placeholders-tags
:feature/66-test-custom-field-placeholders-field-xxx
:feature/67-test-posts-list-filters-service-search-a
:feature/68-test-image-attachment-pipeline
:feature/69-test-token-auto-refresh-for-oauth-servic
:feature/70-test-lifecycle-events-beforepost-afterpo
:feature/71-test-rest-api-dispatch-endpoint
:feature/72-test-wordpress-canonical-url-source-link
:feature/73-test-content-type-source-plugin-architec
:feature/74-test-oncontentbeforedisplay-joomla-5-6-c
:feature/75-test-getsupportedmediatypes-on-all-servi
:feature/76-test-per-service-help-links-in-service-e
:feature/77-test-kb-articles-on-mokoconsulting-tech
:feature/78-test-system-hooks-retry-and-scheduling
:feature/48-system-plugin-hooks-for-calendar-and-gal
:feature/49-scheduling-ui-for-timed-cross-posts
:feature/50-cross-post-analytics-dashboard
:feature/51-retry-mechanism-for-failed-posts
:feature/52-test-calendar-and-gallery-cross-post-plu
:feature/23-generic-webhook-service-plugin-universal
:feature/24-microsoft-teams-service-plugin-incoming-
:feature/25-threads-meta-service-plugin-threads-api
:feature/26-google-business-profile-service-plugin
:feature/27-whatsapp-business-service-plugin-cloud-a
:feature/28-google-chat-service-plugin-webhooks
:feature/29-medium-service-plugin-publishing-api
:feature/30-pinterest-service-plugin-pins-api
:feature/31-reddit-service-plugin-submit-api
:feature/32-sendgrid-service-plugin-marketing-campai
:feature/33-brevo-sendinblue-service-plugin-email-ca
:feature/34-wordpress-service-plugin-rest-api-cross-
:feature/35-ntfy-service-plugin-push-notifications
:feature/36-tumblr-service-plugin-posts-api
:feature/37-convertkit-service-plugin-broadcasts
:feature/38-nostr-service-plugin-decentralized-proto
:feature/39-activitypub-service-plugin-generic-fediv
:feature/40-dev-to-service-plugin-forem-api
:feature/41-ghost-service-plugin-admin-api
:feature/42-hashnode-service-plugin-graphql-api
:feature/43-blogger-service-plugin-google-blogger-ap
:feature/44-matrix-element-service-plugin
:feature/45-rss-feed-service-plugin-dedicated-cross-
:feature/46-constant-contact-service-plugin-email-ca
:feature/47-tiktok-service-plugin-content-posting-ap
:feature/1-core-cross-posting-engine-dispatch-artic
:feature/10-slack-service-plugin-incoming-webhooks
:feature/11-post-queue-processor-retry-logic-and-sch
:feature/12-linkedin-service-plugin-share-api-integr
:feature/13-mastodon-service-plugin-api-integration
:feature/14-bluesky-service-plugin-at-protocol-integ
:feature/15-mailchimp-service-plugin-campaigns-api
:feature/16-webservices-rest-api-full-crud-endpoints
:feature/17-message-template-management-ui
:feature/18-activity-logs-view-and-log-retention
:feature/19-selective-cross-posting-per-article
:feature/2-telegram-service-plugin-bot-api-integrat
:feature/20-cross-post-analytics-dashboard
:feature/21-oauth-flow-for-services-requiring-browse
:feature/22-load-help-articles-to-waas-live-site
:feature/3-admin-component-services-crud
:feature/4-admin-component-post-queue-view
:feature/5-admin-component-dashboard-with-stats-and
:feature/6-perfect-publisher-pro-migration-tool
:feature/7-facebook-service-plugin-graph-api-integr
:feature/8-discord-service-plugin-webhook-integrati
:feature/9-x-twitter-service-plugin-api-v2-integrat
No Reviewers
Labels
No items
No labels
Priority
-
Type
-
Milestone
No items
No Milestone
Assignees
jmiller (Jonathan Miller)
Clear assignees
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: MokoConsulting/MokoSuiteCross#106
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Delete Branch "dev"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Test plan
Fixes three issues found during dev site testing: 1. All 4 list views (Services, Posts, Logs, Templates) missing filterForm and activeFilters properties. Joomla searchtools layout calls getGroup() on null filterForm. Added get('FilterForm') and get('ActiveFilters') to all list HtmlView classes. 2. Content plugin onContentPrepareForm typed as Form but Joomla 5/6 passes PrepareFormEvent. Now accepts both: extracts Form from PrepareFormEvent when available, falls back to legacy Form type. 3. WebServices API routes expanded: added templates and logs CRUD endpoints alongside posts and services. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>All 13 plugins had copy-paste stub code with literal placeholder URLs (e.g. '{site_url}/api/endpoint') that were never substituted with actual credential values. Each plugin now has correct: - URL construction from credentials - Auth method (Basic Auth for WP, JWT for Ghost, GraphQL for Hashnode) - API payload format per platform spec - Credential validation with live API checks Fixed: ActivityPub, Blogger, Ghost, Google Business, Hashnode, Matrix, Medium, Nostr (stub), RSS Feed, Threads, Tumblr, WhatsApp, WordPress. Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>1. Test Connection button — AJAX validation on service edit sidebar 2. Bulk re-queue failed + purge posted — toolbar buttons on Posts list 3. Exponential backoff — retry_delay * 2^retry_count replaces fixed delay 4. Queue depth warning — dashboard alert when queued > 50 5. First-publish-only toggle — skip cross-posting on article re-saves 6. Dashboard trend chart — Chart.js line chart for daily posted/failed 7. Hashtag injection — {tags} and {hashtags} template placeholders 8. Posts list filters — service dropdown + search by article/message 9. CSV export — download filtered post history as spreadsheet 10. Dashboard date range — 7d/30d/90d/all filter on analytics Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>1. Image attachment pipeline — article intro image passed to publish() via $media array (system plugin + QueueProcessor) 2. Custom fields as placeholders — {field:xxx} resolves Joomla custom fields in templates 3. Lifecycle events — onMokoJoomCrossBeforePost (cancellable), AfterPost, PostFailed for third-party hooks 4. Token auto-refresh — OAuthHelper::refreshTokenIfNeeded() checks token_expires and refreshes via refresh_token before each publish 5. DB lock race fix — MySQL GET_LOCK() replaces read-then-write pattern 6. WordPress canonical URL — appends source link to cross-posted content 7. REST API dispatch — POST /api/v1/mokojoomcross/dispatch triggers cross-posting programmatically with article_id + optional service_ids Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>C-1: CSRF nonce on OAuth authorize/callback flow C-2: POST method enforcement on REST dispatch endpoint C-5: Service credential fields now saved from form to JSON column (collect cred_* fields, strip prefix, JSON encode on save; expand back on load for editing) H-1: Joomla 5 event ArrayAccess pattern for service plugin collection (reads from Event indices instead of broken by-reference) H-4: ServiceTable::check() with alias generation, required validation H-9: WebhookService credential keys match form XML field names, Bearer/Basic auth headers implemented correctly M-4: XSS fix — escape $extraClass in ServiceIconHelper::renderIcon() M-5: Article history HTML injection via setFieldAttribute() instead of double-escaped XML description attribute Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>Pull request closed