Akeeba Admin Tools PRO 7.9.1

v7.9.1

New features​

• PHP File Change Scanner: the scan report's Export CSV button is now a split button with two new options, Export Filtered CSV and Export Paths

Bug fixes​

• [LOW] PHP File Change Scanner: files under administrator/manifests were reported as Non-core, even though Joomla places them there itself when installing package, file, and library extensions
• [LOW] PHP File Change Scanner: the CSV export of a scan report escaped double quotes with a backslash instead of doubling them, per RFC 4180
• [LOW] PHP File Change Scanner: the CSV export of a scan report only exported the page of results currently displayed, and silently applied the filters left over in the session
• [MEDIUM] PHP File Change Scanner: Non-core files were only reported by the scan which first saw them; they are now reported by every scan for as long as they exist on the site, unless they are Marked Safe. Test case NonCorePersistence.
• [MEDIUM] PHP File Change Scanner: when the CoreSums checksum data could not be downloaded, Joomla's own files under includes/, administrator/includes/ and administrator/help/ were reported as Non-core

Miscellaneous changes​

• PHP File Change Scanner: the CSV export of a scan report now also includes the Type and Threat Score columns
• Workaround for Joomla erroneously reporting our database tables as out of date

v7.9.0

New features​

• Configuration Monitoring: include a diff of the changed settings, redacting sensitive values [#334]
• Machine-translated the extension into Greek, French, German, Spanish, Italian, and Portuguese
• PHP File Change Scanner: verify core Joomla files against precomputed checksums
• UploadShield reloaded: uploaded files are scanned for PHP code, PHP file extensions, multiple extensions, and .htaccess handler overrides [#346]

Bug fixes​

• [HIGH] .htaccess Maker: "Block access from specific user agents" failed because double quotes were used
• [HIGH] .htaccess/NginX/web.config Maker: Apply/Save crashed with a fatal error, instead of a warning, when the "Restrict access by IP" cloud provider (e.g. Sucuri) could not be fetched
• [HIGH] Allowed Domains: Quick Setup Wizard rendered the domains as the literal "Array", corrupting the list and locking sites out [#342]
• [HIGH] PHP warning "Undefined variable $isHttpsForced" in Admin Secret Word feature on Joomla 5 sites
• [LOW] File-diff SequenceMatcher: comments are not rejected during matching [#339]
• [LOW] Improved CSRF checks in multiple backend views
• [LOW] Joomla! Update: group-less plugin/module manifest nodes yielded malformed extension names [#337]
• [LOW] No logging of forbidden-username blocked logins
• [LOW] PHP File Change Scanner: missing anti-cache HTTP headers in AJAX endpoints
• [LOW] PHP File Change Scanner: the code default for "Only email when there are actionable items" disagreed with the Options page default on sites which had never saved their Options
• [LOW] Several backend list-view search boxes and filters silently did nothing (auto-ban reason, temporary Super User e-mail search, IP list search, URL redirection published filter) [#344]
• [LOW] Temporary Super Users: the orphaned-record cleanup query was malformed and did not reliably remove orphaned rows [#345]
• [LOW] Transactional emails were not rendered in the recipient's language
• [MEDIUM] Block Email Domains on Signup: a specially crafted local part could allow block bypass [#340]
• [MEDIUM] Non-Super User access (optional feature) didn't work due to too-tight ACL checks.
• [MEDIUM] PHP File Change Scanner CLI: warnings issued by the last step, including failures to send the scan results email, were silently discarded
• [MEDIUM] PHP File Change Scanner: double-extension scanning would flag some innocuous files
• [MEDIUM] PHP File Change Scanner: the "Possible Threat" status filter excluded new files with a nonzero threat score [#347]
• [MEDIUM] PHP File Scanner: the error message for a failed scan was never displayed on screen.
• [MEDIUM] PHPShield: leading whitespace bypassed anchored stream-wrapper check [#338]
• [MEDIUM] WAF Exception w/out query params had no effect.

Miscellaneous changes​

• Control Panel now available to anyone with access to Admin Tools (core.manage)
• Hardening: bind filter/request values as prepared parameters and use an ORDER BY column/direction allowlist across list views and the WAF [#343]
• Inaccessible Control Panel feature buttons now hidden instead returning 403 when clicked
• Joomla 7.0 forward compatibility: replace the removed Joomla.JText JavaScript proxy with Joomla.Text
• Joomla! Update tools now requires global Super User (core.admin) access
• PHP File Change Scanner: using transactions to speed up the initial scan
• SQLiShield: Improved performance against 1-bit oracle exfiltration attacks

• Changed [LOW] Fix PHP 9 deprecations (gh-326)
• Added [LOW] Immediate IP block on failed login with a forbidden username
• Fixed [HIGH] PHP File Change Scanner could fail on PostgreSQL when "Do not report files with a zero Threat Score" is enabled
• Fixed [HIGH] PHP File Change Scanner results page would crash with a fatal error on PostgreSQL sites
• Fixed [HIGH] PHP File Change Scanner list page would crash with a fatal error on PostgreSQL sites
• Fixed [HIGH] PHP File Change Scanner page would crash with a fatal error on PostgreSQL sites

• Added [LOW] Delete Inactive Users scheduled task: optional User Group filter
• Fixed [HIGH] .htaccess Maker outputs blocked user agents rules before RewriteEngine On
• Fixed [HIGH] Admin Secret URL Parameter override cookie wouldn't work on Joomla 6 without the backwards compatibility plugin enabled
• Fixed [HIGH] Unblock My IP in the Control Panel would fail with a fatal error

• Fixed [HIGH] "Cannot use object of type stdClass as array" on some sites

New features​

• Override automatic server detection

Bug fixes​

• [HIGH] Cannot combine "Restrict access by IP" with "User agents to block"
• [HIGH] Cannot save .htaccess configuration when "Restrict access by IP" is set to Custom
• [LOW] Litespeed was incorrectly treated as Apache 2.0 when it supports Apache 2.4 syntax

• [HIGH] Resetting Joomla Update would fail on Joomla 6 (core b/c break)
• [HIGH] Restrict access by IP range could fail on Joomla 6 (core b/c break)
• [HIGH] Warn About Leaked Passwords would fail on Joomla 6 (core b/c break)
• [MEDIUM] Dropdown labels were swapped in the Delete inactive users scheduled task.

• Changed: PHP 8.5 compatiblity
• Fixed: [LOW] PHP warning in Web.Config Maker coming from a reference to an obsolete feature

• PHP 8.5 compatibility: implicit nullable method parameters are deprecated
• PHP 8.5 compatibility: setAccessible is deprecated for reflection objects
• Support for Joomla 6

• Changed Preliminary support for Joomla 6
• Changed Removed wget and pycurl from the default list of blocked user agent strings
• Changed Improve Unicode support in Bad Words filtering
• Fixed [HIGH] Fatal error on blocked request under Joomla 5 and PostgreSQL due to internal J5 changes
• Fixed [LOW] PHP warning 'Attempt to read property "guest" on null' in some rare admin login failure cases
• Fixed [LOW] Misnamed column in the URL redirects table for PostgreSQL

• Changed Preliminary support for Joomla 6
• Changed No longer report Joomla API application's NotAcceptable exception by email.
• Fixed [MEDIUM] Cannot mark a file safe from the Examine File page
• Fixed [LOW] Limit for disabled obsolete admins check was too low in the interface
• Fixed [LOW] Custom block page should never be triggered in the backend of the site
• Fixed [LOW] "Warn about use of well-known passwords" will throw a PHP error if the user groups for the feature have not been set