Download Our Latest Software

What's new?

Supported PHP and Joomla! versions have changed. This version requires Joomla! 5.4 to 6.2 and PHP 8.1 to 8.6. Support for Joomla! 4.x, Joomla! 5.0–5.3, PHP 7.4, and PHP 8.0 has been dropped. The installer now refuses to install on a Joomla! or PHP version outside this range, instead of installing and failing later.

Security hardening. This release fixes several security issues, most notably: personal data exports no longer include the user's password hash; only Super Users can export another Super User's data; backend users without access to the component could no longer run its other tasks through the URL; and stored XSS issues in the backend lists and user trails have been fixed. See the CHANGELOG for the complete list of security fixes.

Removed legacy error handler. We removed our legacy custom error handler. If you are met with an Exception or PHP error when using our software, please go to your site's administrator, System, Global Configuration, and set Debug Mode to Yes and Error Reporting to Developer. Then, reproduce the error. You will get the same level of information as our now-removed error handler. It is enough to help us help you.

Maximalist export option. The personal data export no longer includes the user's password hash. A new component option, Maximalist Export, controls whether the rest of the authentication material is exported: Multi-factor Authentication configuration and backup codes, “remember me” tokens, the Joomla! API token, and download IDs. It is enabled by default, mirroring what Joomla's own privacy export does. Set it to No to remove this material from the export and mask download IDs. Moreover, only Super Users can now export the personal data of other Super Users.

Please reset your Joomla! API tokens. Joomla! submits each user's API token back to the server whenever they save their user profile. Previous versions of Akeeba Data Compliance recorded it in the user changes audit trail, where anyone who can view the audit trails, or who has a copy of your site's database, could read it. By default, only Super Users have API tokens. This version no longer records the API token. However, tokens recorded by previous versions remain in the audit trail. We recommend that all Super Users reset their Joomla! API token: edit your user profile, go to the Joomla API Token tab, set Reset to Yes, and save.

Check your template overrides. The Export button on the user's data options page is now a form which submits the request with POST, instead of a link. This keeps your site's anti-CSRF token out of URLs, where it could leak through the browser history, server logs, and referrers. The Delete button no longer carries the anti-CSRF token; the token is only needed when the user confirms the deletion, which already happens through a form. The same applies to the Update and Reset buttons of the Email Templates page. If you have created a template override for the data options page (com_datacompliance/options/default.php) the Export button will stop working with an invalid token error. Please delete your override, or recreate it from the new version of the file.

Changelog

Critical bugs and important changes

• Dropped support for Joomla! 4.x and 5.0 to 5.3; Joomla! 5.4 to 6.2 is now required
• Dropped support for PHP 7.4 and 8.0; PHP 8.1 to 8.6 is now required
• PHP and Joomla minimum and maximum version compatibility is now enforced

New features

• "Maximalist export" option; set it to No to remove authentication material from data exports
• The installer now refuses to install on a Joomla! or PHP version newer than the supported maximum

Removed features

• Removed legacy error handler
• Removed the unused site URL option, obsolete since Joomla has its own CLI application

Bug fixes

• [HIGH] Accounts which had just registered were end-of-life under the default lifecycle rules
• [HIGH] Backend users without access to the component could run its other tasks by adding view=options to the URL
• [HIGH] Data exports included the user's password hash
• [HIGH] Disabling the Joomla plugin's lifecycle rules did not stop inactive users from being deleted
• [HIGH] The consent evidence recorded on someone's behalf was silently discarded on sites installed with 4.0.3 or later
• [HIGH] The user changes audit trail recorded Super Users' Joomla! API tokens
• [HIGH] Users with the export privilege could export Super Users' data, including credentials
• [HIGH] With admin notifications on (default), account wipes crashed half-way and could not be retried
• [HIGH] datacompliance:account:delete --dry-run deleted the account for real when combined with --force
• [LOW] A Super User's Options page showed Export and Delete to administrators not allowed to use them
• [LOW] A failed account deletion stopped the user changes audit trail for the rest of the session
• [LOW] A refused account deletion did not tell the user why
• [LOW] Admin email notifications ignored the recipients list and did not reach any Super User
• [LOW] An unhandled filesystem error could abort the post-installation cleanup, leaving obsolete files behind
• [LOW] Anti-CSRF tokens were placed in URLs, where they could leak through browser history, logs, and referrers
• [LOW] Apostrophes were shown doubled in the notification emails and in French, Italian and Greek texts
• [LOW] Checking the mail templates rewrote them every time, even when they were up to date
• [LOW] Exporting a user that does not exist caused an HTTP 500 error and left an export audit trail record
• [LOW] Internal error messages, e.g. database errors, were shown to users when deleting an account failed
• [LOW] Names and other user data were inserted as raw HTML in the HTML notification emails
• [LOW] Personal data exports were sent with headers allowing shared caches to store them
• [LOW] Saving a custom field change together with a user parameter change lost the parameter change from the user trail
• [LOW] Sorting the Lifecycle page by last visit date did not work, and its sort options had the wrong labels
• [LOW] The Control Panel loaded JavaScript libraries from a third-party CDN without integrity checks
• [LOW] The Lifecycle page could show a stale list of users, ignoring the selected date
• [LOW] The administrator notifications about a deleted account greeted the Super User by the deleted user's name
• [LOW] The component's icon font was never installed, so the back-end icons were missing
• [LOW] The data options page could be displayed without the access check by using task=display
• [LOW] The data options pages did not escape the username and site name
• [LOW] The package shipped development files of bundled libraries, and their folder allowed direct web access
• [LOW] The subject of the automatic (lifecycle) account deletion email contained HTML and the name of a CLI command
• [LOW] The user changes audit trail built some database queries without prepared statements
• [LOW] The user changes audit trail recorded raw account activation tokens
• [LOW] Upgrading did not remove some obsolete files and folders left behind by very old versions
• [LOW] Upgrading left obsolete folders behind on Windows, macOS, and other case-insensitive filesystems
• [LOW] User details were inserted into HTML emails without escaping
• [LOW] Users with only the export or delete privilege could record consent on behalf of other users
• [LOW] When cleaning one cache failed, the remaining caches were not cleaned either
• [LOW] Wiping a user that does not exist caused an HTTP 500 error
• [LOW] datacompliance:lifecycle:delete reported wrong numbers, with a PHP warning
• [MEDIUM] A database error while recording consent could delete the user's existing consent record
• [MEDIUM] Akeeba Ticket System attachment files were left on disk after deleting a user account
• [MEDIUM] Akeeba Ticket System ticket invitations of a deleted user were neither deleted nor exported
• [MEDIUM] Manager notes of a deleted user's Akeeba Ticket System tickets were not deleted
• [MEDIUM] Personal data exports contained no Akeeba Ticket System data with ATS 5 or later
• [MEDIUM] Profile changes were never logged; exports filed profile and key records under the wrong heading
• [MEDIUM] Recording consent for a non-existent user overwrote your own consent record
• [MEDIUM] Remember-me keys were neither exported nor deleted when an account was wiped
• [MEDIUM] Stored XSS in the User Trails details through user parameters, profile, and custom field values
• [MEDIUM] Stored XSS in the backend lists through user names not created by Joomla's user forms (e.g. SSO)
• [MEDIUM] The S3 audit trail plugin never uploaded anything
• [MEDIUM] The data export crashed when a plugin exported an object value
• [MEDIUM] The datacompliance:lifecycle:notify CLI command failed with a PHP error instead of notifying users
• [MEDIUM] The layout URL parameter could make a page include a PHP file from outside the templates folder
• [MEDIUM] The values of user custom fields survived the account wipe
• [MEDIUM] Users with the component's Access Administration Interface permission could export or delete any user
• [MEDIUM] Wiped accounts kept their user groups
• [MEDIUM] With Maximalist Export off, the account activation / password reset token was still exported
• [MEDIUM] datacompliance:account:delete --force failed on accounts with an earlier deletion audit trail

Miscellaneous changes

• Cache cleaning now targets the single cache folder that every Joomla 4+ application shares
• Database queries in the plugins now use prepared statements instead of quoted values
• Declare the core.options permission so it can be granted per user group
• Deleting another user's account now checks whether it can be deleted as an administrator deletion
• Emails no longer receive the account activation code as an (unused) template tag
• Errors thrown by custom upgrade handlers are now reported when Joomla's Debug Site setting is on
• Funnelled all createQuery()/getQuery(true) compatibility branches through Helper\DbQuery::create()
• Hardened template loading: Email Templates page uses the same layout name cleaning as all other pages
• Pseudonymised user accounts now store a properly hashed random password
• The package no longer includes a stale copy of the component manifest
• Updated moment.js to 2.31.0