jmap.py is an authoring-only tool and is not invoked at build time; remove the
dead variable so the script matches the README.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Front-and-center, runnable steps to produce the baseline: clone
--recurse-submodules, run ./build-baseline.sh, use out/ as the vanilla_ref.
Documents prerequisites (no PHP/network; jmap.py is authoring-only), what out/
contains/excludes, the update workflow (submodule update --remote + rebuild),
and the current common_cadline_libraries/maintenance divergence.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
--exclude='cache/' matched any nested dir named cache (e.g. core
com_cache/views/cache/); anchor cache/tmp/logs/images excludes to the docroot
root so only runtime-data top-level dirs are dropped. Non-malware code residual
now 0 (remaining residual is excluded malware + scan artifacts).
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Live has mixed CRLF/LF and content drift vs the submodule HEADs, so normalizing
would break the currently-matching files. The baseline reflects the authoritative
developer repos; line-ending handling is a verifier concern.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
The developer-controlled Cadline repos (cadcommonlib, maintenance) become git
submodules so updates flow through: git submodule update --remote -> build ->
commit new pointers. Pinned to their authoritative HEADs. build-baseline.sh
inits the submodules and normalizes their CRLF to LF (the deploy transform) so
the assembled baseline byte-matches the deployed form. constants.php (live-only
config, not in the repo; carries a DB credential tracked in the credential
inventory) is kept as an overlay (overrides/) per instruction — removal happens
at source later.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
This repo lives on the customer Gitea (git.cadline.hu); drop references to the
operator's internal Gitea repos (audit/incident tracker, HIDS verifier) and
describe those generically instead.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Note the byte-fidelity decisions (cadcommonlib/maintenance as live files not
submodules; public/ excluded as data) and the verification outcome (out/ =
23,578 files, non-malware code residual = 0).
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
build-baseline.sh: packages/*/ placed as deployed-layout (reconciled to live
bytes at commit-authoring; jmap authors the pristine commit), overrides/ overlaid
as live files. Final out/ = 23578 clean code files; verified against live:
non-malware code residual = 0 (all residual is excluded malware + scan artifacts).
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Cadline/JSN additions to com_users: recaptchalib.php (anti-spam), easyprofile.php views (JSN EasyProfile) — only-in-live files not caught by the core-override diff.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
components/com_akeeba (frontend) — the admin side was added earlier; this completes the module.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
beez3 css/js/language + system modal.php/template.php present on live but absent from the downloaded package build; clean core template files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
common_cadline_libraries (CRM hardlock/db/users classes; upstream cadline_web/cadcommonlib), maintenance/ (ARCHLine.XP license backend; upstream cadline_web/maintenance), maintenance2/. Vetted live files (byte-truth); upstream repos in PROVENANCE.md. NOTE: could be git submodules — kept as live files for byte-fidelity.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
The ~24 legit Cadline customizations on the Joomla core (audit sec.16.1):
reCAPTCHA anti-spam (registration/reset/remind/login flow, captcha rule),
content view tweaks, mod_login template, phpversioncheck. build-baseline.sh
overlays these live versions onto the official-package core so the baseline
matches live for the legit mods, while the 3 trojanized core files stay clean.
NOTE: com_users/controllers/registration.php carries a hardcoded reCAPTCHA
secret (redacted; rotate on cleanup) — see malware-iocs.md.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Reconcile to live bytes. Diff vs pristine = Cadline modifications (trial-download flow, Hungarian routes, DB query — ~10 files per audit) + line-endings/install files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Reconcile to the vetted live deployed files (byte-truth for HIDS verification). The diff vs the previous commit is the full delta from pristine upstream: line-endings, Joomla-deployed install files, and the Cadline CRM integration in the system plugin (+ default.php blankframe branch). Vetted malware-free; SQLi code-quality follow-up noted in PROVENANCE.md.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Pristine OneAll 5.5.0 manifest-mapped from github.com/oneall/social-login-joomla @5.5.0 via lib/jmap.py to deployed layout. The next commit reconciles to the live bytes; the diff is the full delta vs upstream (line-endings + install files + Cadline CRM modification).
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Generic Joomla 3.x manifest -> deployed-path mapper (component/module/plugin/
library/template/package), used to author the pristine (upstream) commit of a
packages/<slug> module before it is reconciled to the live bytes. 18/18 tests
green; ruff/mypy-strict clean.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
EU Cookie Directive Lite system plugin (Channel Digital); unmapped -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Helix3 (JoomShaper) template + system/ajax plugins; the live templates/shaper_helix3/index.php was fbwjedi-cloaking-infected and is replaced with the clean monolith copy -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Social Login and Social Share (LoginRadius); repo deleted after CIAM pivot -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Slideshow CK (Cedric Keiflin, com 2.5.2 / mod 2.5.0); vendor login-gated -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
MightySites (AlterBrains, com 3.2.5 / plg 2.1.5); subscription-only, no public download -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
AcyMailing (Acyba); installed 6.2.0 is on an EOL branch, only 7.7.5+ published -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Convert Forms (Tassos Marinos) + bundled NR Framework dependency; commercial vendor-zip, Pro files may be absent -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Official Joomla_3.8.11-Stable-Full_Package (downloads.joomla.org), installer dir
removed. This is the clean deployed core; it byte-matches the live core for the
legit files and provides clean versions of the 3 files the attacker trojanized
(auth/joomla.php credential-stealer, session/storage.php, event/event.php).
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Re-architect the baseline as constituents + a generator script (build-baseline.sh)
instead of a checked-out deployed tree: a deployed Joomla docroot differs from the
repo/source layout, so the script manifest-maps packaged extensions (lib/jmap.py),
places no-source and Cadline files, applies core overrides, excludes malware/data,
and emits out/ = the code baseline the operator HIDS verifier consumes.
Adds RUNBOOK.md (recipe+inventory), PROVENANCE.md (upstream map), malware-iocs.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Establish the www.archline.hu clean-baseline repo. This root commit on main
documents the baseline definition (only our code, deployable) and the
reproducible per-commit reconstruction method used on the build branch.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
