The malware safety-net missed .htaccess/.htaccess.json droppers that
enable PHP on non-.php extensions (AddType/AddHandler
application/x-httpd-php .json, php_flag engine on): they carry no
<?php tag and are not *.php.json, so filters (a)/(b)/(c) all skipped
them. One such file (deployed/helix3/.../shaper_helix3/.htaccess.json)
had entered the source repo and was built into the baseline (B:match),
blinding the detector against itself.
Add safety-net section (d) mirroring the malware_htaccess_php_enable
YARA rule (illusion/hids#183), remove the file from the source tree,
and add its path to malware-iocs.paths.
Ref: cadline/infra#180
Without .gitattributes the checkout line-endings depend on the build
host's core.autocrlf. On the tanis host this produced CRLF: build-baseline.sh
died with `bash\r`, and a CRLF build tree would break the baseline-diff
byte-match. Pin `* text=auto eol=lf` so the source-of-truth LF is
authoritative regardless of client config; binary assets stay byte-exact.
Assisted-by: claude-code@claude-opus-4-8
deployed/helix3 held only a minimal 227-line variant, missing the live
docroot customization (Google Analytics gtag, warehouse-menu logic,
HTTP_HOST domain branches) — so the malware-remediation restore stripped
these from the live site. Replace with the byte-exact live version (792
lines) with the seo-cloaking backdoor line (google-UA C2 exfil) removed.
Assisted-by: claude-code@claude-opus-4-8
The repo now carries more than one site: main holds www.archline.hu and
site/archlinexp.eu holds the eu site, both driven by the same
site-agnostic generator. README.md still described a single-site repo.
Rewrite README.md around the actual model: one branch per site, the
baseline's dual role (known-good reference for the HIDS diff AND the
deployment source of truth), the verify-before-you-trust rule, and why a
customized core file must never be taken from live (the updater skips
customized files, so live silently keeps a stale base -- the eu site ran
a 3.9.2 version string over pre-3.8.13 com_users code).
Add AGENTS.md for automated agents: the cardinal never-build-from-an-
infected-tree rule, the mandatory post-build checklist (YARA, IOC paths,
disguise sweep, the structural core-namespace rule that caught what YARA
missed, core version assertion), the repository boundary, commit rules
and layer semantics.
Assisted-by: claude-code@claude-opus-4-8
The "clean" baseline unintentionally shipped ~34 planted webshells/backdoors
plus sbtrack (a third-party SEO-cloaking proxy) and inert scanner probes,
carried in from the vetted-live Helix3 template. They survived because the IOC
safety net keyed on extension ('*.php.json') while the attacker disguised one
webshell under ~20 fake extensions (.inc.json/.phar.json/.php[3-5].json/
.php.json.json) plus plain-.json defacements.
- History rewritten (git filter-repo) to remove all 48 files from every commit.
- build-baseline.sh step 6 is now CONTENT-based: any templates/**/*.json with a
PHP open tag is dropped (legit Helix3 presets are pure JSON).
- malware-iocs.paths extended with plain-.json defacements, probe artifacts and
non-.json droppers a content grep cannot key on.
Found by the imrcli HIDS YARA union layer during baseline integration (the
baseline-diff alone would have marked them baseline-match).
Assisted-by: claude-code@claude-opus-4-8
jmap.py is an authoring-only tool and is not invoked at build time; remove the
dead variable so the script matches the README.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Front-and-center, runnable steps to produce the baseline: clone
--recurse-submodules, run ./build-baseline.sh, use out/ as the vanilla_ref.
Documents prerequisites (no PHP/network; jmap.py is authoring-only), what out/
contains/excludes, the update workflow (submodule update --remote + rebuild),
and the current common_cadline_libraries/maintenance divergence.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
--exclude='cache/' matched any nested dir named cache (e.g. core
com_cache/views/cache/); anchor cache/tmp/logs/images excludes to the docroot
root so only runtime-data top-level dirs are dropped. Non-malware code residual
now 0 (remaining residual is excluded malware + scan artifacts).
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Live has mixed CRLF/LF and content drift vs the submodule HEADs, so normalizing
would break the currently-matching files. The baseline reflects the authoritative
developer repos; line-ending handling is a verifier concern.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
The developer-controlled Cadline repos (cadcommonlib, maintenance) become git
submodules so updates flow through: git submodule update --remote -> build ->
commit new pointers. Pinned to their authoritative HEADs. build-baseline.sh
inits the submodules and normalizes their CRLF to LF (the deploy transform) so
the assembled baseline byte-matches the deployed form. constants.php (live-only
config, not in the repo; carries a DB credential tracked in the credential
inventory) is kept as an overlay (overrides/) per instruction — removal happens
at source later.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
This repo lives on the customer Gitea (git.cadline.hu); drop references to the
operator's internal Gitea repos (audit/incident tracker, HIDS verifier) and
describe those generically instead.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Note the byte-fidelity decisions (cadcommonlib/maintenance as live files not
submodules; public/ excluded as data) and the verification outcome (out/ =
23,578 files, non-malware code residual = 0).
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
build-baseline.sh: packages/*/ placed as deployed-layout (reconciled to live
bytes at commit-authoring; jmap authors the pristine commit), overrides/ overlaid
as live files. Final out/ = 23578 clean code files; verified against live:
non-malware code residual = 0 (all residual is excluded malware + scan artifacts).
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Cadline/JSN additions to com_users: recaptchalib.php (anti-spam), easyprofile.php views (JSN EasyProfile) — only-in-live files not caught by the core-override diff.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
components/com_akeeba (frontend) — the admin side was added earlier; this completes the module.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
beez3 css/js/language + system modal.php/template.php present on live but absent from the downloaded package build; clean core template files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
common_cadline_libraries (CRM hardlock/db/users classes; upstream cadline_web/cadcommonlib), maintenance/ (ARCHLine.XP license backend; upstream cadline_web/maintenance), maintenance2/. Vetted live files (byte-truth); upstream repos in PROVENANCE.md. NOTE: could be git submodules — kept as live files for byte-fidelity.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
The ~24 legit Cadline customizations on the Joomla core (audit sec.16.1):
reCAPTCHA anti-spam (registration/reset/remind/login flow, captcha rule),
content view tweaks, mod_login template, phpversioncheck. build-baseline.sh
overlays these live versions onto the official-package core so the baseline
matches live for the legit mods, while the 3 trojanized core files stay clean.
NOTE: com_users/controllers/registration.php carries a hardcoded reCAPTCHA
secret (redacted; rotate on cleanup) — see malware-iocs.md.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Reconcile to live bytes. Diff vs pristine = Cadline modifications (trial-download flow, Hungarian routes, DB query — ~10 files per audit) + line-endings/install files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Reconcile to the vetted live deployed files (byte-truth for HIDS verification). The diff vs the previous commit is the full delta from pristine upstream: line-endings, Joomla-deployed install files, and the Cadline CRM integration in the system plugin (+ default.php blankframe branch). Vetted malware-free; SQLi code-quality follow-up noted in PROVENANCE.md.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Pristine OneAll 5.5.0 manifest-mapped from github.com/oneall/social-login-joomla @5.5.0 via lib/jmap.py to deployed layout. The next commit reconciles to the live bytes; the diff is the full delta vs upstream (line-endings + install files + Cadline CRM modification).
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Generic Joomla 3.x manifest -> deployed-path mapper (component/module/plugin/
library/template/package), used to author the pristine (upstream) commit of a
packages/<slug> module before it is reconciled to the live bytes. 18/18 tests
green; ruff/mypy-strict clean.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
EU Cookie Directive Lite system plugin (Channel Digital); unmapped -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
