0281383832
docs(runbook): record final model and verification result
...
Note the byte-fidelity decisions (cadcommonlib/maintenance as live files not
submodules; public/ excluded as data) and the verification outcome (out/ =
23,578 files, non-malware code residual = 0).
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:42:09 +02:00
8a4da84a87
build(baseline): finalize generator (packages as deployed, overrides as files)
...
build-baseline.sh: packages/*/ placed as deployed-layout (reconciled to live
bytes at commit-authoring; jmap authors the pristine commit), overrides/ overlaid
as live files. Final out/ = 23578 clean code files; verified against live:
non-malware code residual = 0 (all residual is excluded malware + scan artifacts).
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:41:04 +02:00
65ebcef76e
feat(baseline): add remaining legit files (postupdate, isis js, windwalker cli, sbtrack)
...
Completeness: administrator/postupdate.php + isis/js/_template.js (clean core
files absent from the downloaded package), bin/windwalker (Windwalker CLI),
sbtrack.php (Cadline tracking docroot PHP). All vetted malware-free.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:40:36 +02:00
64e3db16f3
feat(cadline): add com_users Cadline additions (recaptcha, easyprofile)
...
Cadline/JSN additions to com_users: recaptchalib.php (anti-spam), easyprofile.php views (JSN EasyProfile) — only-in-live files not caught by the core-override diff.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:39:03 +02:00
5855eb4295
feat(deployed): add Advanced Modules site component (completeness)
...
components/com_advancedmodules (RegularLabs) frontend — completes the module.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:39:02 +02:00
e9d0295acf
feat(deployed): add Akeeba site component (completeness)
...
components/com_akeeba (frontend) — the admin side was added earlier; this completes the module.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:39:02 +02:00
190c3ab0af
feat(overrides): add legit core template files missing from package
...
beez3 css/js/language + system modal.php/template.php present on live but absent from the downloaded package build; clean core template files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:39:02 +02:00
87205209af
feat(deployed): add shared language, vendor libs, manifests
...
Cross-extension shared code the baseline was missing: en-GB/hu-HU language (admin+site), libraries/vendor (Composer deps), administrator/manifests (installed-extension metadata). Malware-ext entries and scan artifacts excluded.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:39:01 +02:00
3a62043b94
feat(cadline): add Cadline docroot apps + root PHPs
...
Docroot sub-apps beiratkozas/, iskolak/, phpext/; root PHPs crashadmin.php, crm_hardlock.class.php, login-external.php, tips.php, recaptchalib.php, configuration.php (74-byte MightySites multi-site stub, legit). public/ excluded (user data, ~219k files).
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:34:31 +02:00
c2cf6dab13
feat(cadline): add common_cadline_libraries + maintenance backend
...
common_cadline_libraries (CRM hardlock/db/users classes; upstream cadline_web/cadcommonlib), maintenance/ (ARCHLine.XP license backend; upstream cadline_web/maintenance), maintenance2/. Vetted live files (byte-truth); upstream repos in PROVENANCE.md. NOTE: could be git submodules — kept as live files for byte-fidelity.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:34:30 +02:00
b0f795d5fc
feat(cadline): add Cadline plugin + templates
...
plg content/workshopdates; templates blankframe, category. Dropped Tiny File Manager backdoor (templates/category/tiny.php) excluded.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:34:30 +02:00
6a4b40b670
feat(cadline): add Cadline-own modules
...
11 Cadline-only modules (mod_al_*, mod_alusers, mod_alworkshops, mod_course_list, mod_webinar*, mod_wsregister). Dropped webshells excluded (mod_al_upload/b8.php, mod_course_list/a1.php); legit module bases kept.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:34:30 +02:00
b4e5fe9ac5
feat(cadline): add Cadline-own components
...
9 Cadline-only components (no public upstream): showroom, albanner, alworkshops, followedlinks, nonprofit, presentation, project, tcexam, versions. Vetted live files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:34:29 +02:00
bd30fd6bd8
feat(overrides): add Cadline core modifications (live versions)
...
The ~24 legit Cadline customizations on the Joomla core (audit sec.16.1):
reCAPTCHA anti-spam (registration/reset/remind/login flow, captcha rule),
content view tweaks, mod_login template, phpversioncheck. build-baseline.sh
overlays these live versions onto the official-package core so the baseline
matches live for the legit mods, while the 3 trojanized core files stay clean.
NOTE: com_users/controllers/registration.php carries a hardcoded reCAPTCHA
secret (redacted; rotate on cleanup) — see malware-iocs.md.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:32:07 +02:00
7bd85dc725
feat(pkg): add Phoca Commander 3.0.2 (vetted live, stock)
...
Phoca Commander 3.0.2 (github.com/PhocaCz/PhocaCommander @3.0.2), vetted clean, stock admin file-manager; live deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:30:03 +02:00
88510a61cd
feat(pkg): add RemoteImage 2.0.10 (vetted live, stock)
...
RemoteImage 2.0.10 (github.com/asikart/remoteimage @2.0.10), vetted clean, stock; live deployed files (upstream ships build-layout — deployed bytes used for verification).
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:30:02 +02:00
4364fd772a
feat(pkg): reconcile Easy File Uploader to live (Cadline delta)
...
Reconcile to live bytes. Diff vs pristine = Cadline modification (ARCHLine.XP 2024 Rendering contest upload form, ~3 files) + version drift/line-endings.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:30:02 +02:00
8b9d97e80a
feat(pkg): add Easy File Uploader (pristine upstream)
...
Pristine Easy File Uploader manifest-mapped from github.com/ollily/easyfileuploader via lib/jmap.py (upstream master; installed 2.7.8).
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:30:02 +02:00
d060102756
feat(pkg): reconcile Phoca Download to live (Cadline delta)
...
Reconcile to live bytes. Diff vs pristine = Cadline modifications (trial-download flow, Hungarian routes, DB query — ~10 files per audit) + line-endings/install files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:30:02 +02:00
488a843a54
feat(pkg): add Phoca Download 3.1.2 (pristine upstream)
...
Pristine Phoca Download 3.1.2 manifest-mapped from github.com/PhocaCz/PhocaDownload @3.1.2 via lib/jmap.py.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:30:01 +02:00
b3610e331e
feat(pkg): reconcile OneAll to live bytes (Cadline CRM delta)
...
Reconcile to the vetted live deployed files (byte-truth for HIDS verification). The diff vs the previous commit is the full delta from pristine upstream: line-endings, Joomla-deployed install files, and the Cadline CRM integration in the system plugin (+ default.php blankframe branch). Vetted malware-free; SQLi code-quality follow-up noted in PROVENANCE.md.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:29:08 +02:00
63092a2c2e
feat(pkg): add OneAll Social Login 5.5.0 (pristine upstream)
...
Pristine OneAll 5.5.0 manifest-mapped from github.com/oneall/social-login-joomla @5.5.0 via lib/jmap.py to deployed layout. The next commit reconciles to the live bytes; the diff is the full delta vs upstream (line-endings + install files + Cadline CRM modification).
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:29:07 +02:00
0c71320ee8
build(baseline): add lib/jmap.py Joomla manifest-mapper + tests
...
Generic Joomla 3.x manifest -> deployed-path mapper (component/module/plugin/
library/template/package), used to author the pristine (upstream) commit of a
packages/<slug> module before it is reconciled to the live bytes. 18/18 tests
green; ruff/mypy-strict clean.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:27:45 +02:00
2b076db480
feat(deployed): add trada template 1.0 (no-source, vetted live)
...
trada template (saihoai); the dropped webshell html/mod_articles_category/meant.php is excluded; unmapped -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:53 +02:00
6ef4cd6771
feat(deployed): add _theme3037 template 3.0 (no-source, vetted live)
...
_theme3037 template (TemplateMonster.com); unmapped -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:53 +02:00
ae58f42454
feat(deployed): add XEF library 1.4.4 (no-source, vetted live)
...
XEF library (Parvez Akther); unmapped -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:53 +02:00
5df49ca10b
feat(deployed): add P3P plugin (no-source, vetted live)
...
P3P system plugin (Joomla! Project label, no manifest version); unmapped -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:53 +02:00
2d331103d7
feat(deployed): add TM Lazy Load 1.2.1 (no-source, vetted live)
...
TM Lazy Load system plugin (Template Monster); unmapped -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:53 +02:00
9595120d38
feat(deployed): add ExtBlank 1.0 (no-source, vetted live)
...
ExtBlank system plugin (Convergence Services); unmapped -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:52 +02:00
6c8a2cdefe
feat(deployed): add EU Cookie Directive Lite 1.1.1 (no-source, vetted live)
...
EU Cookie Directive Lite system plugin (Channel Digital); unmapped -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:52 +02:00
c010bf8a98
feat(deployed): add MooTable 1.1.3 (no-source, vetted live)
...
MooTable system plugin (Roberto Segura); unmapped -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:52 +02:00
158744a4be
feat(deployed): add Fancybox 1.3.6 (no-source, vetted live)
...
Fancybox system plugin (Yireo); unmapped -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:52 +02:00
6eb2a9bc0b
feat(deployed): add SocialNetworks 1.1.3 (no-source, vetted live)
...
SocialNetworks (eMediaCom): authentication + user plugins + library; unmapped -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:52 +02:00
b46cad7754
feat(deployed): add JoomlaWorks Simple Image Gallery 3.6.0 (no-source, vetted live)
...
JoomlaWorks Simple Image Gallery content plugin; unmapped -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:52 +02:00
8f3f7aa28d
feat(deployed): add JoomlaWorks AllVideos 4.8.0 (no-source, vetted live)
...
JoomlaWorks AllVideos content plugin; unmapped -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:51 +02:00
a6cf67c9d6
feat(deployed): add YouTubeR plugin (no-source, vetted live)
...
YouTubeR (ZyX): system plugin 1.49 + editors-xtd button 1.41; unmapped -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:51 +02:00
8c86275abf
feat(deployed): add mod_helloworld 1.0.0 (no-source, vetted live)
...
mod_helloworld sample module (Tutorials Point tutorial sample) -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:51 +02:00
bdd87b5573
feat(deployed): add mod_ppc_simple_spotlight 3.1 (no-source, vetted live)
...
mod_ppc_simple_spotlight module (Pixel Point Creative); unmapped -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:51 +02:00
06e4335df7
feat(deployed): add mod_image_split_view (no-source, vetted live)
...
mod_image_split_view module; no manifest version, unmapped -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:51 +02:00
2332bf163c
feat(deployed): add mod_caroufredsel 1.2.3 (no-source, vetted live)
...
mod_caroufredsel module; unmapped -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:51 +02:00
f44141e6b3
feat(deployed): add mod_login2 3.0.0 (no-source, vetted live)
...
mod_login2 module (mislabeled Joomla! Project); unmapped -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:50 +02:00
8f559f4a8b
feat(deployed): add mod_estore 3.0.0 (no-source, vetted live)
...
mod_estore module (mislabeled Joomla! Project); unmapped -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:50 +02:00
56a5665e79
feat(deployed): add mod_articles_news_adv 1.5.5 (no-source, vetted live)
...
mod_articles_news_adv module (mislabeled Joomla! Project); unmapped clone -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:50 +02:00
ca8a88a619
feat(deployed): add mod_sp_simple_gallery 3.0 (no-source, vetted live)
...
SP Simple Gallery module (JoomShaper); unmapped -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:50 +02:00
4166ccc45d
feat(deployed): add mod_sp_quickcontact 1.4 (no-source, vetted live)
...
SP Quick Contact module (JoomShaper); unmapped -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:50 +02:00
c5573bc714
feat(deployed): add mod_joombig_notebook_flip_nice 1.1 (no-source, vetted live)
...
Joombig Notebook Flip module (joombig.com); no authentic source -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:50 +02:00
52401918ff
feat(deployed): add mod_flippingbook 2.1.1 (no-source, vetted live)
...
FlippingBook module (eucoders.com); vendor unverified -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:50 +02:00
ccf28549b7
feat(deployed): add mod_anycode 3.0 (no-source, vetted live)
...
AnyCode module (Hyde-Design); vendor unverified -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:49 +02:00
3fe1ddf401
feat(deployed): add mod_xpertscroller 3.10-1 (no-source, vetted live)
...
XpertScroller module (ThemeXpert); registration-gated vendor -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:49 +02:00
a0ffba0351
feat(deployed): add mod_ut_joomstagram 1.2.0 (no-source, vetted live)
...
UT Joomstagram module (Unitemplates.com); registration-gated vendor -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:49 +02:00