Release highlights
Kickstart password protection.
The password you can set in kickstart.json.php did not provide adequate protection beyond the user interface. This is fixed. If you rely on a Kickstart password on a site that is reachable from the Internet, please update.
Stricter archive handling.
Archive entries with dot paths (such as . or ..) in their name are now rejected during extraction. Resumed extractions also only accept the classes the extraction engine itself defines, instead of any class name.
Delete the site's files before extracting.
This option is now available in Kickstart Core, not just Professional. It also used to fail with a fatal error before deleting anything, both in Kickstart and in restore.php, which Akeeba Backup uses to restore sites. That is fixed.
Simplified write modes.
The SFTP and "use FTP for all files" write modes were removed. The Hybrid mode now falls back to FTP by itself when it cannot write a file directly. If you had selected one of the removed modes, choose Hybrid or FTP instead.
ZIP archives with "fast" compression.
ZIP archives created by tools such as 7-Zip or WinZip using a "fast" compression setting were wrongly reported as corrupt. They now extract normally.
Changelog
Critical bugs and important changes
- Extraction would accept archive entries with dot paths in their name
- Kickstart password failed to provide adequate protection beyond the user interface
New features
- Deleting the site's files before extraction is now available in Kickstart Core, too
Bug fixes
- [HIGH] "Delete the site's files before extracting" died with a fatal error before deleting anything
- [HIGH] Decrypting a JPS archive without OpenSSL raised an "Undefined constant" fatal error, not a clean failure
- [HIGH] The Hybrid write mode failed on archives needing more than one step: "Invalid archive type or extension"
- [HIGH] ZIP archives made with a "fast" compression setting (7-Zip, WinZip) were reported as corrupt
- [HIGH] restore.php: "Delete the site's files before extracting" also failed, breaking Akeeba Backup restoration
- [LOW] Clean Up left behind the kicktemp folder created by Akeeba Backup's Site Transfer Wizard
- [LOW] JPS archives: encryption padding was never trimmed off decrypted blocks; harmless in practice
- [LOW] PHP 8.1+ deprecation notice when extracting into an existing folder with no extraction target set
- [LOW] PHP 8.1+ deprecation notices in the file zapper and restoration finalisation if settings were unset
- [LOW] PHP 8.1+ deprecation notices when extracting a JPS archive containing a symbolic link
- [LOW] PHP 8.5 deprecation notices when opening a JPS archive with a password shorter than 16 characters
- [LOW] Two error messages (archive entry outside the extraction folder, S3 file not found) were not translated
- [MEDIUM] Professional: S3 import ignored the chosen signature method and region when using a custom endpoint
- [MEDIUM] Professional: importing a missing archive from Amazon S3 never stopped; progress sat at 0%, size "NAN b"
- [MEDIUM] Resumed extraction unserialized its saved state without an allow-list, allowing arbitrary class names
Miscellaneous changes
- Professional: URL import shows real download progress again instead of sitting at 0%
- Removed the SFTP and "use FTP for all files" write modes; Hybrid now falls back to FTP by itself
- The class allow-list for resumed extractions is now derived from the engine's own class hierarchy