Download Our Latest Software

Security hardening. This version concludes our full audit of the code, addressing the remaining issues, and hardening the extension's security posture.

Removed legacy error handler. We removed our legacy custom error handler. If you are met with an Exception or PHP error when using our software, please go to your site's administrator, System, Global Configuration, and set Debug Mode to Yes and Error Reporting to Developer. Then, reproduce the error. You will get the same level of information as our now-removed error handler. It is enough to help us help you.

Enforced version compatibility checks. The package now checks your Joomla and PHP version when you try to install it. If it detects an incompatible Joomla and/or PHP version it will refuse to install / uninstall / update and tell you. The extension itself will warn you about the incompatibility and refuse to run. This is an additional protection against accidentally breaking your site by installing an incompatible version of our software or your site, or updating / downgrading Joomla or PHP outside the supported range after installing the extension.

Expanded JSON:API. We added JSON:API routes for Automatic Item Descriptions, Download ID labels, Environments, and Update Streams, bringing every ARS resource under the API. Every endpoint now supports many more list filters, and sorting with list_ordering / list_direction. The whole API is documented as a ready-to-use request collection in assets/http/api.http, for developers building integrations against your release system.

Faster Download Logs. The Download Logs page no longer recounts millions of log rows on every page load, and filtering by IP address no longer scans the entire table, so the page stays responsive on sites with large logs. A new Clear Cache toolbar button lets you refresh the cached row count on demand.

Changelog

Critical bugs and important changes

• PHP and Joomla minimum and maximum version compatibility is now enforced

New features

• Clear Cache button in Download Logs refreshes the cached row count on demand
• Documented the whole JSON:API in assets/http/api.http
• JSON API routes for Automatic Item Descriptions, Download ID labels, Environments, and Update Streams
• JSON API: many more list filters, and sorting with list_ordering / list_direction, on every endpoint

Removed features

• Removed a dead, unreachable legacy debug error-page template
• Removed legacy error handler

Bug fixes

• [LOW] PHP Warning on inaccessible item [gh-251]
• [LOW] The Item and Accessed On column sorts in Download Logs did not work
• [LOW] Upgrading left obsolete folders behind on Windows, macOS, and other case-insensitive filesystems
• [LOW] When cleaning one cache failed, the remaining caches were not cleaned either
• [MEDIUM] The layout URL parameter could make a page include a PHP file from outside the templates folder

Miscellaneous changes

• Cache cleaning now targets the single cache folder that every Joomla 4+ application shares
• Common database query helper to facilitate transition into strict createQuery in future Joomla versions
• Declare the core.options permission so it can be granted per user group
• Download Logs page no longer recounts millions of log rows on every page load
• Download Logs: filtering by IP address no longer scans the entire download log table
• Errors thrown by custom upgrade handlers are now reported when Joomla's Debug Site setting is on
• Fixed a SQL syntax error in the frontend Download ID search query
• Hardening: Bleeding Edge age/count cleanup no longer follows a crafted release version outside its directory
• Hardening: Update Stream/Autodescription controllers and the release file browser now enforce category ACL
• Hardening: authorise JSON:API deletions against the record's own category, not just the component
• Hardening: batch move/copy and JSON:API PATCH now authorise the record's source and target category
• Hardening: bulk publish/unpublish/archive/trash on Categories now checks the category's own ACL
• Hardening: escape release version in the content plugin and mod_arsdownloads
• Hardening: escape tag titles in the backend Categories and Releases lists
• Hardening: escape the name/username/email/link fields in the shared user info layout
• Hardening: item filename is now confined to its category directory on download, delete, and hashing
• Hardening: restore option escaping in the Items batch-move/copy release dropdown
• Hardening: strip quote/control characters from the Content-Disposition download filename
• Hardening: the JSON:API only shows a user other people's Download IDs if they may manage the component
• Hardening: the extension update feed is now fetched over HTTPS
• Hardening: the frontend item picker only lists items from published, access-authorised releases/categories
• Joomla 7.0 readiness: dropped the unreachable CMSObject fallback from plg_editors-xtd_arslink
• Joomla 7.0 readiness: dropped the unreachable Toolbar::getInstance() fallback from the backend views
• Removed dead Joomla 4 compatibility code, unreachable since the minimum supported version became Joomla 5.4
• Removed the redundant UCM record back-fill; Joomla 5.4 and later create UCM records on demand when a record is tagged