What's new?
Bugfix release.
This version addresses bugs and makes minor improvements. Please consult the CHANGELOG.
Changelog
New features
- Configuration Monitoring: include a diff of the changed settings, redacting sensitive values [#334]
- Machine-translated the extension into Greek, French, German, Spanish, Italian, and Portuguese
- PHP File Change Scanner: verify core Joomla files against precomputed checksums
- UploadShield reloaded: uploaded files are scanned for PHP code, PHP file extensions, multiple extensions, and .htaccess handler overrides [#346]
Bug fixes
- [HIGH] .htaccess Maker: "Block access from specific user agents" failed because double quotes were used
- [HIGH] .htaccess/NginX/web.config Maker: Apply/Save crashed with a fatal error, instead of a warning, when the "Restrict access by IP" cloud provider (e.g. Sucuri) could not be fetched
- [HIGH] Allowed Domains: Quick Setup Wizard rendered the domains as the literal "Array", corrupting the list and locking sites out [#342]
- [HIGH] PHP warning "Undefined variable $isHttpsForced" in Admin Secret Word feature on Joomla 5 sites
- [LOW] File-diff SequenceMatcher: comments are not rejected during matching [#339]
- [LOW] Improved CSRF checks in multiple backend views
- [LOW] Joomla! Update: group-less plugin/module manifest nodes yielded malformed extension names [#337]
- [LOW] No logging of forbidden-username blocked logins
- [LOW] PHP File Change Scanner: missing anti-cache HTTP headers in AJAX endpoints
- [LOW] PHP File Change Scanner: the code default for "Only email when there are actionable items" disagreed with the Options page default on sites which had never saved their Options
- [LOW] Several backend list-view search boxes and filters silently did nothing (auto-ban reason, temporary Super User e-mail search, IP list search, URL redirection published filter) [#344]
- [LOW] Temporary Super Users: the orphaned-record cleanup query was malformed and did not reliably remove orphaned rows [#345]
- [LOW] Transactional emails were not rendered in the recipient's language
- [MEDIUM] Block Email Domains on Signup: a specially crafted local part could allow block bypass [#340]
- [MEDIUM] Non-Super User access (optional feature) didn't work due to too-tight ACL checks.
- [MEDIUM] PHP File Change Scanner CLI: warnings issued by the last step, including failures to send the scan results email, were silently discarded
- [MEDIUM] PHP File Change Scanner: double-extension scanning would flag some innocuous files
- [MEDIUM] PHP File Change Scanner: the "Possible Threat" status filter excluded new files with a nonzero threat score [#347]
- [MEDIUM] PHP File Scanner: the error message for a failed scan was never displayed on screen.
- [MEDIUM] PHPShield: leading whitespace bypassed anchored stream-wrapper check [#338]
- [MEDIUM] WAF Exception w/out query params had no effect.
Miscellaneous changes
- Control Panel now available to anyone with access to Admin Tools (core.manage)
- Hardening: bind filter/request values as prepared parameters and use an ORDER BY column/direction allowlist across list views and the WAF [#343]
- Inaccessible Control Panel feature buttons now hidden instead returning 403 when clicked
- Joomla 7.0 forward compatibility: replace the removed Joomla.JText JavaScript proxy with Joomla.Text
- Joomla! Update tools now requires global Super User (core.admin) access
- PHP File Change Scanner: using transactions to speed up the initial scan
- SQLiShield: Improved performance against 1-bit oracle exfiltration attacks