What's new?
Obsolete Core Files.
A new feature reports, and can remove, files left behind by Joomla's own update process that used to belong to Joomla core but no longer do.
Bad Words: Escape Regular Expression.
Bad Words entries can now be matched literally instead of as a regular expression.
Fallback language for notification emails.
Set a preferred fallback language for Admin Tools' notification emails, with an option to force it for all of them.
Important bug fixes.
This release fixes several high-impact bugs, including CLI commands that failed silently, Emergency Off-Line Mode misreporting success, and failed-login lockout never triggering. Please consult the CHANGELOG for the complete list.
Changelog
New features
- Bad Words: Escape Regular Expression; a plain word matches itself literally
- New --exempt-ip option for the admintools:offline CLI command
- Obsolete Core Files feature: removing leftover files after a Joomla! update
- Preferred fallback language option for notification emails, and an option to force it for all
Bug fixes
- [HIGH] Admin Password validation accepted characters outside the allowed set
- [HIGH] Admin Tools' actions were not recorded in the Action Log on sites without Akeeba Backup installed
- [HIGH] Bad Words containing a "#" character never blocked anything
- [HIGH] DFI Shield did not detect NUL bytes in the request
- [HIGH] Delete Inactive Users scheduled task always failed; its User Group filter also selected the wrong groups
- [HIGH] Emergency Off-Line Mode enabled from the CLI reported success but left the site fully accessible
- [HIGH] PHP File Change Scanner: Mark All Safe ignored every alert with a zero threat score
- [HIGH] PHP File Change Scanner: marking a file safe only worked from the most recent scan's report
- [HIGH] Temporary Super Users: a past expiration date created a permanent, untracked Super User
- [HIGH] Users were never deactivated after too many failed logins, whatever the threshold
- [HIGH] admintools:import from the CLI failed with a fatal error on any file admintools:export had produced
- [HIGH] admintools:temp:clear from the CLI never finished on sites with a lot to clean up
- [LOW] CLI commands displayed relative times in the wrong unit, e.g. "24 hours" instead of "1 day"
- [LOW] Configure WAF: Forgotten Users Lockout heading used outdated wording
- [LOW] DFI Shield never detected Windows drive-letter paths such as “C:\Windows\system.ini”
- [LOW] Fixed missing and malformed translations
- [LOW] Legacy Clean Temporary Files feature hang the page until whole temp directory was cleaned
- [LOW] Legacy Clean Temporary Files feature logged PHP warning on every pass
- [LOW] web.config Maker: blocking access to common server configuration files could also block unrelated files
- [MEDIUM] Emergency Off-Line Mode sent visitors to a broken address
- [MEDIUM] Folder path validation checked the administrator folder instead of the site folder
- [MEDIUM] IP allow/disallow lists accepted invalid IP values, matching nothing
- [MEDIUM] Link Migration would rewrite rewrite look-alike domains such as example.com.evil.net
- [MEDIUM] NginX Conf Maker and web.config Maker used .htaccess Maker's list for "Restrict access by IP"
- [MEDIUM] Notification emails were sent in the current site language instead of a predictable one
- [MEDIUM] PHP File Change Scanner: internal warnings queue ignored its size limit and grew unbounded
- [MEDIUM] PHP File Change Scanner: third party API application files, under api/components, were reported as Non-core
- [MEDIUM] Possible fatal error on future Joomla versions which have removed CMSObject
- [MEDIUM] Quick Setup Wizard generated wrong site-relative paths on sites whose path ends in /api
- [MEDIUM] Scheduled tasks: Auto Import with invalid URL failed on every run, instead of doing nothing
- [MEDIUM] Scheduled tasks: PHP File Change Scanner could give itself an unrealistic one second time limit
- [MEDIUM] Server configuration makers: exception files list could be corrupted when upgrading
- [MEDIUM] Server configuration makers: exceptions for file / folder names with backslashes were generated wrong
- [MEDIUM] The email telling you a user account was reactivated after failed logins was never actually sent
- [MEDIUM] Third party integration event onAdminToolsThirdpartyException wasn't handled
- [MEDIUM] Third party integration: fatal error when blocked request's extra information was passed as an array
- [MEDIUM] WAF Exceptions and WAF Deny List: filtering the list by two or more columns at once returned the wrong rows
Miscellaneous changes
- web.config Maker: remove naming of the rule blocking access to configuration.php-dist and htaccess.txt