# PROVENANCE — extension → upstream map

Per-extension origin for the baseline. `SUBMODULE`/`packages/` = source obtainable
(manifest-mapped); `deployed/` = no obtainable source (vetted live files, upstream URL
kept for reference only); `cadline/` = Cadline own-code. "modified" = Cadline changed
it → the change is a `cadline.patch` (packages/) or documented here (no-source).

## Upstream-obtainable (packages/ — manifest-mapped)

| Module | Version | Upstream | State |
|---|---|---|---|
| OneAll Social Login | 5.5.0 | github.com/oneall/social-login-joomla @5.5.0 | **modified** (CRM integration) |
| RemoteImage | 2.0.10 | github.com/asikart/remoteimage @2.0.10 | stock |
| Phoca Commander | 3.0.2 | github.com/PhocaCz/PhocaCommander @3.0.2 | stock |
| Phoca Download | 3.1.2 | github.com/PhocaCz/PhocaDownload @3.1.2 | **modified** (10 files: trial/HU routes/DB) |
| Easy File Uploader | 2.7.8 | github.com/ollily/easyfileuploader | **modified** (3 files: contest upload form) |

## Git upstream exists but no version-matching package (deployed/, provenance only)

| Module | Version | Upstream | Note |
|---|---|---|---|
| K2 | 2.8.0 | github.com/getk2/k2 | no 2.8.0 tag → deployed |
| JoomGallery | 3.3.4 | github.com/JoomGallery/JoomGallery | no 3.3.4 tag → deployed |
| Windwalker (lib) | 2.1.18 | github.com/ventoviro/windwalker | branch only → deployed |
| SP Easy Image Gallery | 1.0 | github.com/JoomShaper/SP-Easy-Image-Gallery | no 1.0 → deployed |
| Image Swoop | 1.2.5 | github.com/TemplateMonster-JoomlaTeam/mod_image_swoop | master only → deployed |
| IceMegaMenu | 3.0.1/3.0.0 | github.com/dakuzen/mod_icemegamenu | version mismatch → deployed |

## No source (deployed/, vetted live files)

sh404SEF 4.4.4.1791, JCK Editor 6.4.4/6.6.2 (**modified**: menunodes.php CVE-2018-17254
mitigation — no upstream, Mértanmű fix, documented), SP Page Builder 3.6.2, iCagenda
3.7.15, Akeeba Backup 6.1.1, Convert Forms 3.0.0 (+NR Framework 4.6.26), Regular Labs
Sourcerer 7.4.0 / Advanced Module Manager 7.7.1 / Modals 9.13.0 / library 18.12.3953,
AcyMailing 6.2.0, MightySites 3.2.5/2.1.5, JSN/JoomlaShine 2.5.6, Jumi 3.0.5, TF Learn
1.7.5, Smart Countdown 3.4.5, Smart Shoutbox 3.0.6, Slideshow CK 2.5.2, Social Login &
Share 4.0, Helix3 2.5.5 (clean index.php — live one was infected), and repo-less
modules/plugins/libs/templates (bt_googlemaps, os_touchslider, jflickr, jux/mx/ol
timeline, ut_joomstagram, xpertscroller, anycode, flippingbook, joombig, youtuber,
jw_allvideos/sig, socialnetworks, fancybox, mootable, EUCookieDirectiveLite, extblank,
tmlazyload, p3p, xef, _theme3037, trada).

## Cadline own-code (cadline/)

Components: com_showroom, com_albanner, com_alworkshops, com_followedlinks, com_nonprofit,
com_presentation, com_project, com_tcexam, com_versions. Modules: mod_al_applications,
mod_al_login, mod_al_newsletter, mod_al_upload, mod_al_vote, mod_alusers, mod_alworkshops,
mod_course_list, mod_webinar, mod_webinar_list, mod_wsregister. Plugin: content/workshopdates.
Templates: blankframe, category. Submodules (Cadline-internal deployed-layout repos):
`common_cadline_libraries` → git.cadline.hu/cadline_web/cadcommonlib; `maintenance` →
git.cadline.hu/cadline_web/maintenance. Docroot apps: beiratkozas, iskolak, public, phpext.
Docroot PHPs: crashadmin.php, crm_hardlock.class.php, login-external.php, tips.php,
recaptchalib.php, configuration.php.