Commit Graph

62 Commits

Author SHA1 Message Date
61d176fb5e feat(archlinexp.eu): add clean deployable baseline on Joomla 3.9.2
Build the archlinexp.eu/www baseline from clean sources on a dedicated
site branch, per the web-baseline deploy model: vanilla Joomla 3.9.2 core
plus the developer-sourced own-code plus a vetted module layer, with the
Cadline core delta applied on the 3.9.2 base. The generator is reused
unchanged: build-baseline.sh is site-agnostic, only the content differs.

Layers:
- core/      vanilla Joomla 3.9.2 official package (installer removed)
- cadline/   own-code from the developer source (beiratkozas, maintenance,
             mod_al_*, mod_alusers, mod_course_list) plus 11 assets that
             the developer source lacks
- deployed/  third-party module slugs taken from live, vetted
- overrides/ the 5 genuine Cadline core modifications, on the 3.9.2 base

The live core carried 31 stale com_users files: the updater skipped the
customized ones, so the version string said 3.9.2 while the code did not.
Taking vanilla 3.9.2 plus the 2 real deltas fixes that silently.

Vetting caught two items that content-based YARA did not flag. Both come
from a structural rule: an extra file on a core-component path that is
not a template override is not a module -- it is a leftover or a plant.
Both are excluded through malware-iocs.paths:
- components/com_mailto/mail.php: an unauthenticated file-write webshell
  (POST save_file + file_content -> fopen/fwrite, no auth check at all),
  present on live since 2021-07-26
- administrator/components/com_joomlaupdate/restoration.php: an Akeeba
  Kickstart leftover carrying a security password (known RCE vector)

Verification: build-baseline.sh -> out/ = 12284 files; YARA (16 rules) on
every source layer and on the built tree = 0 hits; none of the 291 IOC
paths present; no disguised .json dropper; core verified as 3.9.2; the
only extra file left on a core path is the legit Google reCAPTCHA library.

Assisted-by: claude-code@claude-opus-4-8
2026-07-17 12:18:26 +02:00
4168b737cc feat(baseline): add remaining legit files (postupdate, isis js, windwalker cli, sbtrack)
Completeness: administrator/postupdate.php + isis/js/_template.js (clean core
files absent from the downloaded package), bin/windwalker (Windwalker CLI),
sbtrack.php (Cadline tracking docroot PHP). All vetted malware-free.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:40:36 +02:00
750e3a23e1 feat(deployed): add Advanced Modules site component (completeness)
components/com_advancedmodules (RegularLabs) frontend — completes the module.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:39:02 +02:00
6be21235f1 feat(deployed): add Akeeba site component (completeness)
components/com_akeeba (frontend) — the admin side was added earlier; this completes the module.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:39:02 +02:00
8067654629 feat(deployed): add shared language, vendor libs, manifests
Cross-extension shared code the baseline was missing: en-GB/hu-HU language (admin+site), libraries/vendor (Composer deps), administrator/manifests (installed-extension metadata). Malware-ext entries and scan artifacts excluded.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:39:01 +02:00
e905b51c4e feat(deployed): add trada template 1.0 (no-source, vetted live)
trada template (saihoai); the dropped webshell html/mod_articles_category/meant.php is excluded; unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:53 +02:00
3a45537dfe feat(deployed): add _theme3037 template 3.0 (no-source, vetted live)
_theme3037 template (TemplateMonster.com); unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:53 +02:00
d3e7422d2d feat(deployed): add XEF library 1.4.4 (no-source, vetted live)
XEF library (Parvez Akther); unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:53 +02:00
f6bac67e3a feat(deployed): add P3P plugin (no-source, vetted live)
P3P system plugin (Joomla! Project label, no manifest version); unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:53 +02:00
ccc70a13de feat(deployed): add TM Lazy Load 1.2.1 (no-source, vetted live)
TM Lazy Load system plugin (Template Monster); unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:53 +02:00
dc45f5f5aa feat(deployed): add ExtBlank 1.0 (no-source, vetted live)
ExtBlank system plugin (Convergence Services); unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:52 +02:00
51499123fb feat(deployed): add EU Cookie Directive Lite 1.1.1 (no-source, vetted live)
EU Cookie Directive Lite system plugin (Channel Digital); unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:52 +02:00
9c29c2ea3e feat(deployed): add MooTable 1.1.3 (no-source, vetted live)
MooTable system plugin (Roberto Segura); unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:52 +02:00
eac85b2c01 feat(deployed): add Fancybox 1.3.6 (no-source, vetted live)
Fancybox system plugin (Yireo); unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:52 +02:00
ce544166a6 feat(deployed): add SocialNetworks 1.1.3 (no-source, vetted live)
SocialNetworks (eMediaCom): authentication + user plugins + library; unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:52 +02:00
d504c742e6 feat(deployed): add JoomlaWorks Simple Image Gallery 3.6.0 (no-source, vetted live)
JoomlaWorks Simple Image Gallery content plugin; unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:52 +02:00
31e461c23c feat(deployed): add JoomlaWorks AllVideos 4.8.0 (no-source, vetted live)
JoomlaWorks AllVideos content plugin; unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:51 +02:00
6a96a3e84d feat(deployed): add YouTubeR plugin (no-source, vetted live)
YouTubeR (ZyX): system plugin 1.49 + editors-xtd button 1.41; unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:51 +02:00
e3307720dc feat(deployed): add mod_helloworld 1.0.0 (no-source, vetted live)
mod_helloworld sample module (Tutorials Point tutorial sample) -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:51 +02:00
b2046e464c feat(deployed): add mod_ppc_simple_spotlight 3.1 (no-source, vetted live)
mod_ppc_simple_spotlight module (Pixel Point Creative); unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:51 +02:00
17915a0582 feat(deployed): add mod_image_split_view (no-source, vetted live)
mod_image_split_view module; no manifest version, unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:51 +02:00
e433f392c2 feat(deployed): add mod_caroufredsel 1.2.3 (no-source, vetted live)
mod_caroufredsel module; unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:51 +02:00
6ab09f98d9 feat(deployed): add mod_login2 3.0.0 (no-source, vetted live)
mod_login2 module (mislabeled Joomla! Project); unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:50 +02:00
1a72af3e11 feat(deployed): add mod_estore 3.0.0 (no-source, vetted live)
mod_estore module (mislabeled Joomla! Project); unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:50 +02:00
bf4b0b1b3d feat(deployed): add mod_articles_news_adv 1.5.5 (no-source, vetted live)
mod_articles_news_adv module (mislabeled Joomla! Project); unmapped clone -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:50 +02:00
4a208fb3bd feat(deployed): add mod_sp_simple_gallery 3.0 (no-source, vetted live)
SP Simple Gallery module (JoomShaper); unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:50 +02:00
0ad6755db1 feat(deployed): add mod_sp_quickcontact 1.4 (no-source, vetted live)
SP Quick Contact module (JoomShaper); unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:50 +02:00
b4d7123e1b feat(deployed): add mod_joombig_notebook_flip_nice 1.1 (no-source, vetted live)
Joombig Notebook Flip module (joombig.com); no authentic source -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:50 +02:00
a03a4b00dd feat(deployed): add mod_flippingbook 2.1.1 (no-source, vetted live)
FlippingBook module (eucoders.com); vendor unverified -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:50 +02:00
e9e7c6c0ab feat(deployed): add mod_anycode 3.0 (no-source, vetted live)
AnyCode module (Hyde-Design); vendor unverified -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:49 +02:00
ffaaffc16b feat(deployed): add mod_xpertscroller 3.10-1 (no-source, vetted live)
XpertScroller module (ThemeXpert); registration-gated vendor -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:49 +02:00
e94895afa5 feat(deployed): add mod_ut_joomstagram 1.2.0 (no-source, vetted live)
UT Joomstagram module (Unitemplates.com); registration-gated vendor -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:49 +02:00
a48f64e90e feat(deployed): add mod_mx_timeline 4.0.3 (no-source, vetted live)
MX Timeline module (mixwebtemplates); no identifiable source -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:49 +02:00
32592feea0 feat(deployed): add mod_jux_timeline 1.0.1 (no-source, vetted live)
JUX Timeline module (JoomlaUX); registration-gated vendor -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:49 +02:00
37c4e00e1b feat(deployed): add mod_jflickr 1.4.2 (no-source, vetted live)
jFlickr module (Joomla Bamboo); vendor unverified -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:49 +02:00
872811d9a1 feat(deployed): add mod_os_touchslider 3.6.1 (no-source, vetted live)
OS Touch Slider module + ajax plugin (OrdaSoft); registration-gated vendor -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:49 +02:00
5b9abb06f8 feat(deployed): add mod_bt_googlemaps 2.1.0 (no-source, vetted live)
BT Google Maps module (BowThemes); registration-gated vendor -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:48 +02:00
12b8876503 feat(deployed): add mod_ol_k2timeline 4.0.2 (no-source, vetted live)
OL K2 Timeline module (olwebdesign); no identifiable upstream -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:48 +02:00
b6c9da67eb feat(deployed): add Helix3 2.5.5 (no-source, vetted live)
Helix3 (JoomShaper) template + system/ajax plugins; the live templates/shaper_helix3/index.php was fbwjedi-cloaking-infected and is replaced with the clean monolith copy -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:48 +02:00
126df0f9f2 feat(deployed): add Image Swoop 1.2.5 (no-source, vetted live)
Image Swoop module (Template Monster) -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:48 +02:00
e15c68261a feat(deployed): add IceMegaMenu (no-source, vetted live)
IceMegaMenu (IceTheme, mod 3.0.1 / plg 3.0.0) -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:47 +02:00
92e89cbb02 feat(deployed): add SP Easy Image Gallery 1.0 (no-source, vetted live)
SP Easy Image Gallery (JoomShaper); no version-matching upstream package -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:47 +02:00
0233f2db81 feat(deployed): add Social Login and Social Share 4.0 (no-source, vetted live)
Social Login and Social Share (LoginRadius); repo deleted after CIAM pivot -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:47 +02:00
7030c058c7 feat(deployed): add Slideshow CK (no-source, vetted live)
Slideshow CK (Cedric Keiflin, com 2.5.2 / mod 2.5.0); vendor login-gated -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:47 +02:00
a8e6138d0d feat(deployed): add Smart Shoutbox 3.0.6 (no-source, vetted live)
Smart Shoutbox (The Krotek); no repo -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:46 +02:00
6172b965f9 feat(deployed): add Smart Countdown 3 (no-source, vetted live)
Smart Countdown 3 (Alex Polonski, com 3.4.5 / mod 3.4.7); no repo -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:46 +02:00
bb1c28ae0c feat(deployed): add TF Learn 1.7.5 (no-source, vetted live)
TF Learn (Tech Fry) + techfry library 1.3.4; login-gated, no repo -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:46 +02:00
1097812b20 feat(deployed): add Jumi 3.0.5 (no-source, vetted live)
Jumi (Edvard Ananyan); business closed, no clean J3 upstream -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:45 +02:00
62e29d6343 feat(deployed): add JSN / JoomlaShine 2.5.6 (no-source, vetted live)
JSN / JoomlaShine (JSN Project) component + framework + modules + plugins; vendor closed in 2021 -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:45 +02:00
0e2d7a7410 feat(deployed): add MightySites (no-source, vetted live)
MightySites (AlterBrains, com 3.2.5 / plg 2.1.5); subscription-only, no public download -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:44 +02:00