--exclude='cache/' matched any nested dir named cache (e.g. core
com_cache/views/cache/); anchor cache/tmp/logs/images excludes to the docroot
root so only runtime-data top-level dirs are dropped. Non-malware code residual
now 0 (remaining residual is excluded malware + scan artifacts).
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Live has mixed CRLF/LF and content drift vs the submodule HEADs, so normalizing
would break the currently-matching files. The baseline reflects the authoritative
developer repos; line-ending handling is a verifier concern.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
The developer-controlled Cadline repos (cadcommonlib, maintenance) become git
submodules so updates flow through: git submodule update --remote -> build ->
commit new pointers. Pinned to their authoritative HEADs. build-baseline.sh
inits the submodules and normalizes their CRLF to LF (the deploy transform) so
the assembled baseline byte-matches the deployed form. constants.php (live-only
config, not in the repo; carries a DB credential tracked in the credential
inventory) is kept as an overlay (overrides/) per instruction — removal happens
at source later.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
This repo lives on the customer Gitea (git.cadline.hu); drop references to the
operator's internal Gitea repos (audit/incident tracker, HIDS verifier) and
describe those generically instead.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Note the byte-fidelity decisions (cadcommonlib/maintenance as live files not
submodules; public/ excluded as data) and the verification outcome (out/ =
23,578 files, non-malware code residual = 0).
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
build-baseline.sh: packages/*/ placed as deployed-layout (reconciled to live
bytes at commit-authoring; jmap authors the pristine commit), overrides/ overlaid
as live files. Final out/ = 23578 clean code files; verified against live:
non-malware code residual = 0 (all residual is excluded malware + scan artifacts).
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Cadline/JSN additions to com_users: recaptchalib.php (anti-spam), easyprofile.php views (JSN EasyProfile) — only-in-live files not caught by the core-override diff.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
components/com_akeeba (frontend) — the admin side was added earlier; this completes the module.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
beez3 css/js/language + system modal.php/template.php present on live but absent from the downloaded package build; clean core template files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
common_cadline_libraries (CRM hardlock/db/users classes; upstream cadline_web/cadcommonlib), maintenance/ (ARCHLine.XP license backend; upstream cadline_web/maintenance), maintenance2/. Vetted live files (byte-truth); upstream repos in PROVENANCE.md. NOTE: could be git submodules — kept as live files for byte-fidelity.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
The ~24 legit Cadline customizations on the Joomla core (audit sec.16.1):
reCAPTCHA anti-spam (registration/reset/remind/login flow, captcha rule),
content view tweaks, mod_login template, phpversioncheck. build-baseline.sh
overlays these live versions onto the official-package core so the baseline
matches live for the legit mods, while the 3 trojanized core files stay clean.
NOTE: com_users/controllers/registration.php carries a hardcoded reCAPTCHA
secret (redacted; rotate on cleanup) — see malware-iocs.md.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Reconcile to live bytes. Diff vs pristine = Cadline modifications (trial-download flow, Hungarian routes, DB query — ~10 files per audit) + line-endings/install files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Reconcile to the vetted live deployed files (byte-truth for HIDS verification). The diff vs the previous commit is the full delta from pristine upstream: line-endings, Joomla-deployed install files, and the Cadline CRM integration in the system plugin (+ default.php blankframe branch). Vetted malware-free; SQLi code-quality follow-up noted in PROVENANCE.md.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Pristine OneAll 5.5.0 manifest-mapped from github.com/oneall/social-login-joomla @5.5.0 via lib/jmap.py to deployed layout. The next commit reconciles to the live bytes; the diff is the full delta vs upstream (line-endings + install files + Cadline CRM modification).
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Generic Joomla 3.x manifest -> deployed-path mapper (component/module/plugin/
library/template/package), used to author the pristine (upstream) commit of a
packages/<slug> module before it is reconciled to the live bytes. 18/18 tests
green; ruff/mypy-strict clean.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
EU Cookie Directive Lite system plugin (Channel Digital); unmapped -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
