4 Commits

Author	SHA1	Message	Date
jmiller	71a102028d	fix: security & correctness batch (#99, #100, #101, #102, #106) ... #99 — AI AJAX endpoint hardening: - require core.edit/core.create on com_content before generating (was reachable by any authenticated back-end user → paid-credit abuse) - callAiApi: 20s timeout + HTTP status check (throw on non-200) instead of silently returning an empty string #100 — Sitemap information disclosure + robustness: - filter to public (guest) view levels so registered/special-access articles are never written into the public sitemap - atomic write (temp file + rename) so concurrent saves can't expose a half-written sitemap.xml - (throttling + SEF URLs remain follow-ups, noted on the issue) #101 — Expose newer columns in CSV + API: - og_video, event_data, recipe_data, custom_schema added to CSV export/import (appended, so existing CSVs still import) and to the REST API field whitelist - import validates JSON fields as arrays/objects and og_video as http(s) (prevents re-introducing the #97 scalar-JSON-LD crash via import) #102 — Forward-compat (complete): - Factory::getLanguage() -> getApplication()->getLanguage() (4 sites) - Joomla\CMS\Filesystem\File/Folder -> Joomla\Filesystem\* (ImageHelper, ImageGenerator) #106 — partial: loadArticle() now caches null misses (array_key_exists), getArticleDate() skips 0000-00-00 dates. Batch-JS halt deferred — the offset=0 design re-fetches failed rows, so the created>0 guard prevents an infinite loop; a safe fix needs cursor-based pagination in BatchController.	2026-06-29 09:52:51 -05:00
jmiller	d6fb2816cf	refactor: replace Joomla-7-deprecated APIs (forward compatibility) ... Removes accessors deprecated in Joomla 5 and slated for removal in 7 (extension already runs on 6; this future-proofs for 7): - Factory::getDbo() -> Factory::getContainer()->get(DatabaseInterface::class) across plugins, controllers, static helpers, and the install script - Factory::getUser() -> Factory::getApplication()->getIdentity() - Factory::getSession() -> Factory::getApplication()->getSession() - jexit(Text::_('JINVALID_TOKEN')) -> throw new \RuntimeException(..., 403), consistent with the access-denied checks already in those controllers Note: SQL update-version concern is already resolved — the release bumped to 01.05.00, which matches the 01.05.00.sql update slot.	2026-06-28 14:47:34 -05:00
Jonathan Miller	f484675300	fix: batch limit cap, TagTable validation, CSV language column (#42, #43, #52) ... - Cap batch process limit to 200 per request to prevent DoS (#42) - Add TagTable::check() validation: og_type enum, field max lengths, canonical_url format, robots directives, content_type pattern (#43) - Add language column to CSV export headers and data (#52) - Parse language column on CSV import with format validation - Include language in duplicate check query to match unique key	2026-06-21 10:57:38 -05:00
Jonathan Miller	05b2a44209	refactor: rename src/ to source/ and update all CI references ... - Rename project source directory from src/ to source/ - Update CI workflows (ci-joomla, pr-check, repo-health) to check source/ first, falling back to src/ and htdocs/ for compat - Update .gitignore vendor exception path - manifest.xml entry-point already updated Authored-by: Moko Consulting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-06 08:24:35 -05:00