Admin Tools for Joomla! 7.9.3 Stable

Released on: 2026-09-23 23:02 CDT

What's new?

Security hardening. This version concludes our full audit of the code, addressing the remaining issues, and hardening the extension's security posture.

Tighter permission checks. Several views now require a Super User or an explicitly set Admin Tools-specific permission to work. If you were relying on Administrators or lower-privileged operators to handle some Admin Tools tasks you may want to review the permissions and grant them additional privileges (using a new user group!) according to their needs.

Enforced version compatibility checks. The package now checks your Joomla and PHP version when you try to install it. If it detects an incompatible Joomla and/or PHP version it will refuse to install / uninstall / update and tell you. The extension itself will warn you about the incompatibility and refuse to run. This is an additional protection against accidentally breaking your site by installing an incompatible version of our software or your site, or updating / downgrading Joomla or PHP outside the supported range after installing the extension.

Removed legacy error handler. The legacy error handler would show very detailed site and server information whenever an error occurred in the backend of the site. Joomla 4 and later have their own error handler showing the same level of detail when you enable Site Debug. We removed our handler in favor of the core-provided solution.

Clarified that the Security ACL permission grants Super User-equivalent access. This was strongly implied but never explicitly stated. This privilege allows users other than Super Users to manage security settings on your site. This can be conceivably used by a malicious operator to execute arbitrary code, perform redirections, execute server side request forgeries, etc. Therefore, the trust level that comes with this privilege is the same as that for granting Super User access. This privilege exists as a separate item because it doesn't automatically grant Super User equivalence in core Joomla and other third party extensions, i.e. someone cannot break the site by misclicking on one of those extensions – you can say that the backend UI is made a bit safer that way.

Raised the supported version ranges to PHP 8.6 and Joomla! 6.2. We have done our prep work for the upcoming Joomla 6.2 (coming October 2026) and PHP 8.6 (coming December 2026) versions. As always, we consider this preliminary work since neither of these two pieces of software is stable yet. Please do test them yourselves and let us know if you find any issues related to these two versions. We have a full suite of unit and integration (end-to-end – E2E) tests, but we can only test for issues we know about or have thought about. We cannot test for what we neither know nor can think of.

Bug fixes. We improved our unit and E2E tests with many more test cases, uncovering a number of low priority issues. These are now fixed.

Changelog

Critical bugs and important changes

  • CSV and JSON downloads now send X-Content-Type-Options: nosniff
  • CSV scan-report exports were not neutralised against spreadsheet formula injection
  • File-scanner and Critical Files Monitoring emails could contain unescaped HTML from file paths
  • Fixed open redirects on three Control Panel/Scan actions
  • Fixed remaining missing anti-CSRF token checks
  • PHP and Joomla minimum and maximum version compatibility is now enforced
  • SEO & Migration: fixed mass assignment issue, only allowing specific keys to be written
  • URL Redirections: the "Takes you here" field could store arbitrary data

Removed features

  • Removed legacy error handler

Bug fixes

  • [LOW] Blocked-request log could be forged with CR/LF in the URL, username, or User-Agent
  • [LOW] Control Panel changelog heading line was not escaped (defence-in-depth)
  • [LOW] Missing anti-CSRF token check on the scan report export endpoints
  • [LOW] PHP 8.6: a deprecation notice leaving the custom administrator directory, two more saving the WAF configuration
  • [LOW] Scan alert edit page echoed the file diff and path unescaped (defence-in-depth)
  • [LOW] Scan report export endpoints required a lower permission than viewing the report itself
  • [LOW] Scan report list echoed each file path segment unescaped (very unlikely to be exploitable)
  • [LOW] Temp Super Users: the self-edit/self-delete guard checked the wrong field and never triggered
  • [LOW] WAF Exceptions list showed a blank Query Parameter column instead of "(All)" when no query string was set
  • [LOW] When cleaning one cache failed, the remaining caches were not cleaned either
  • [MEDIUM] Blocked request reasons and exception notification emails could come out blank on PHP 7.4 and 8.0
  • [MEDIUM] The layout URL parameter could make a page include a PHP file from outside the templates folder
  • [MEDIUM] Upgrading, or downgrading to Core, left obsolete folders behind on case-insensitive filesystems

Miscellaneous changes

  • Clarified that the Security ACL permission grants Super User-equivalent access
  • Declare the core.options permission so it can be granted per user group
  • Errors thrown by custom upgrade handlers are now reported when Joomla's Debug Site setting is on
  • Funnelled every query through Helper\DbQuery::create() instead of duplicating the createQuery() compatibility branch
  • Quick Setup Wizard's Allowed Domains field is now repeatable, like Configure WAF's (gh-369)
  • Raised the supported version ranges to PHP 8.6 and Joomla! 6.2
  • Resetting the frontend Scanner Secret Word now requires the Options-page permission
  • Scanalerts::markallsafe now requires the Security permission

Release files

Admin Tools Core

pkg_admintools-7.9.3-core.zip

984.00 Kb

PHP 7.4 PHP 8.0 PHP 8.1 PHP 8.2 Joomla! 4.4 Joomla! 5.0 PHP 8.3 Joomla! 5.1 Joomla! 5.2 Joomla! 5.3 Joomla! 5.4 PHP 8.4 Joomla! 6.0 PHP 8.5 Joomla! 6.1

Download now