223db38921
feat(deployed): add SP Page Builder 3.6.2 (no-source, vetted live)
...
SP Page Builder (JoomShaper); GitHub exposes only 1.x, the installed 3.6.2 is gated -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:40 +02:00
9a2654b4fc
feat(deployed): add JCK Editor 6.4.4 (no-source, vetted live)
...
JCK Editor (WebxSolution, com_jckman 6.4.4 + editors/jckeditor 6.6.2); dead vendor, no upstream -> deployed files; manual CVE-2018-17254 mitigation on menunodes.php preserved.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:39 +02:00
b2bc981aab
feat(deployed): add sh404SEF 4.4.4.1791 (no-source, vetted live)
...
sh404SEF SEF/URL component (Weeblr), vetted clean from live; upstream gated and discontinued for Joomla 3 -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:24:39 +02:00
ff342a4c18
feat(deployed): add Windwalker library 2.1.18 (no-source, vetted live)
...
Windwalker 2.1.18 (Asika; RemoteImage dependency), vetted clean from live; branch-only upstream → deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 09:48:14 +02:00
9be7e17536
feat(deployed): add JoomGallery 3.3.4 (no-source, vetted live)
...
JoomGallery 3.3.4, vetted clean from live; no 3.3.4 tag upstream → deployed files. Excluded temp/ update-staging (data).
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 09:48:13 +02:00
6ca5826110
feat(deployed): add K2 2.8.0 (no-source, vetted live)
...
K2 2.8.0 (JoomlaWorks), vetted clean from live; no version-matching upstream package (getk2/k2 has no 2.8.0 tag) → deployed files. Bundles elFinder (admin file-manager attack surface).
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 09:48:13 +02:00
bd48d89480
build(baseline): constituents+generator skeleton
...
Re-architect the baseline as constituents + a generator script (build-baseline.sh)
instead of a checked-out deployed tree: a deployed Joomla docroot differs from the
repo/source layout, so the script manifest-maps packaged extensions (lib/jmap.py),
places no-source and Cadline files, applies core overrides, excludes malware/data,
and emits out/ = the code baseline the operator HIDS verifier consumes.
Adds RUNBOOK.md (recipe+inventory), PROVENANCE.md (upstream map), malware-iocs.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 09:40:46 +02:00
