This release fixes a high-priority WP-CLI data-integrity bug, a data-integrity issue in database dumps, and a broad set of restoration, remote storage, and access control issues.
Bug fix: wp akeeba filter commands ignored --profile. Every wp akeeba filter subcommand silently wrote its changes to profile 1 regardless of the profile you specified, while still reporting "Success". If you used these commands against any profile other than the first, please review that profile's filters after updating. This has been fixed.
Bug fix: database dumps silently lost precision on DOUBLE columns. When dumping databases with the PDO MySQL or PostgreSQL drivers, values stored in DOUBLE columns could lose precision without any warning. This has been fixed.
Restoration and self-update: FTP/FTPS settings. The restoration FTP connection test ignored the "Use FTP over SSL" and passive mode settings, and restoration/self-update could save the wrong FTPS and passive mode values when writing the extraction settings. Both have been fixed.
Bug fix: split archives could end with an empty part. Under certain conditions a split backup archive could be written with a trailing empty part, causing post-processing (upload, remote storage) to fail. This has been fixed.
Security hardening: canAccess() empty privilege list. A privilege check that was meant to still require authentication when given an empty privilege list allowed unauthenticated access through instead. This has been fixed.
Security hardening: unvalidated return URLs. Profile switching, update checks, and any return URL that merely looked like base64-encoded data were not validated, or were decoded into binary garbage, before being used as a redirect target. Both have been fixed.
This release also includes a broad pass of medium and low priority fixes covering FTP/SFTP connection tests, ALICE log analysis, Pythia's wp-config.php credential parsing, WP-CLI backup take/backup list overrides and filters, front-end/upload check endpoints, path handling, and translation strings. See the changelog for the complete list.
Changelog
New features
- wp akeeba profile import: select profile with --profile; overwrite it with --force
Bug fixes
- [HIGH] Database dumps lost DOUBLE precision with PDO MySQL and PostgreSQL
- [HIGH] wp akeeba filter commands ignored --profile, wrote to profile 1, and returned "Success"
- [LOW] Archive relative path was wrong when the archive folder was above the site root
- [LOW] Backup sizes of 1EB or more had no unit
- [LOW] Base64-like return URLs were decoded into binary garbage
- [LOW] FTP over cURL test ignored the passive mode workaround
- [LOW] Format::fileSize() raised a TypeError when given a unit name
- [LOW] Front-end check and upload check endpoints threw instead of returning HTTP 403
- [LOW] Profile import without a selected file showed an error page
- [LOW] Release candidate and dev versions were normalised with the wrong revision
- [LOW] Setup wizard: Previous button linked to a nonexistent view
- [LOW] System Configuration: JavaScript error from the removed FTP/SFTP directory browser
- [LOW] convertMemoryLimitToBytes() could return a string instead of an integer
- [LOW] simplifyPath() stripped 'administrator' when it was not a complete path segment
- [LOW] wp akeeba backup list --description=0 ignored the filter
- [LOW] wp akeeba backup take reported long elapsed times incorrectly
- [LOW] wp akeeba profile import treated the file path as JSON instead of reading it
- [MEDIUM] ALICE never listed failed backup logs for selection
- [MEDIUM] FTP and SFTP tests showed the password in plain text on authentication failure
- [MEDIUM] Profile switching and update checks did not validate the return URL
- [MEDIUM] Pythia could corrupt or reject wp-config.php DB credentials due to faulty constant parsing
- [MEDIUM] Restoration and self-update saved wrong FTPS and passive mode extraction settings
- [MEDIUM] Restoration: FTP test ignored FTPS and passive mode settings
- [MEDIUM] Split archives could end with an empty part, failing post-processing
- [MEDIUM] canAccess() allowed unauthenticated access when the privilege list was empty
- [MEDIUM] wp akeeba backup take ignored --overrides=…
Miscellaneous changes
- Fine-tuned access control across all views and tasks
- Log files never use .log; hosts blocking .log.php get .php log files