LÁZÁR Imre AI Agent bd48d89480 build(baseline): constituents+generator skeleton

Re-architect the baseline as constituents + a generator script (build-baseline.sh)
instead of a checked-out deployed tree: a deployed Joomla docroot differs from the
repo/source layout, so the script manifest-maps packaged extensions (lib/jmap.py),
places no-source and Cadline files, applies core overrides, excludes malware/data,
and emits out/ = the code baseline the operator HIDS verifier consumes.

Adds RUNBOOK.md (recipe+inventory), PROVENANCE.md (upstream map), malware-iocs.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8

2026-07-16 09:40:46 +02:00

3.3 KiB

Raw Blame History

PROVENANCE — extension → upstream map

Per-extension origin for the baseline. SUBMODULE/packages/ = source obtainable (manifest-mapped); deployed/ = no obtainable source (vetted live files, upstream URL kept for reference only); cadline/ = Cadline own-code. "modified" = Cadline changed it → the change is a cadline.patch (packages/) or documented here (no-source).

Upstream-obtainable (packages/ — manifest-mapped)

Module	Version	Upstream	State
OneAll Social Login	5.5.0	github.com/oneall/social-login-joomla @5.5.0	modified (CRM integration)
RemoteImage	2.0.10	github.com/asikart/remoteimage @2.0.10	stock
Phoca Commander	3.0.2	github.com/PhocaCz/PhocaCommander @3.0.2	stock
Phoca Download	3.1.2	github.com/PhocaCz/PhocaDownload @3.1.2	modified (10 files: trial/HU routes/DB)
Easy File Uploader	2.7.8	github.com/ollily/easyfileuploader	modified (3 files: contest upload form)

Git upstream exists but no version-matching package (deployed/, provenance only)

Module	Version	Upstream	Note
K2	2.8.0	github.com/getk2/k2	no 2.8.0 tag → deployed
JoomGallery	3.3.4	github.com/JoomGallery/JoomGallery	no 3.3.4 tag → deployed
Windwalker (lib)	2.1.18	github.com/ventoviro/windwalker	branch only → deployed
SP Easy Image Gallery	1.0	github.com/JoomShaper/SP-Easy-Image-Gallery	no 1.0 → deployed
Image Swoop	1.2.5	github.com/TemplateMonster-JoomlaTeam/mod_image_swoop	master only → deployed
IceMegaMenu	3.0.1/3.0.0	github.com/dakuzen/mod_icemegamenu	version mismatch → deployed

No source (deployed/, vetted live files)

sh404SEF 4.4.4.1791, JCK Editor 6.4.4/6.6.2 (modified: menunodes.php CVE-2018-17254 mitigation — no upstream, Mértanmű fix, documented), SP Page Builder 3.6.2, iCagenda 3.7.15, Akeeba Backup 6.1.1, Convert Forms 3.0.0 (+NR Framework 4.6.26), Regular Labs Sourcerer 7.4.0 / Advanced Module Manager 7.7.1 / Modals 9.13.0 / library 18.12.3953, AcyMailing 6.2.0, MightySites 3.2.5/2.1.5, JSN/JoomlaShine 2.5.6, Jumi 3.0.5, TF Learn 1.7.5, Smart Countdown 3.4.5, Smart Shoutbox 3.0.6, Slideshow CK 2.5.2, Social Login & Share 4.0, Helix3 2.5.5 (clean index.php — live one was infected), and repo-less modules/plugins/libs/templates (bt_googlemaps, os_touchslider, jflickr, jux/mx/ol timeline, ut_joomstagram, xpertscroller, anycode, flippingbook, joombig, youtuber, jw_allvideos/sig, socialnetworks, fancybox, mootable, EUCookieDirectiveLite, extblank, tmlazyload, p3p, xef, _theme3037, trada).

Cadline own-code (cadline/)

Components: com_showroom, com_albanner, com_alworkshops, com_followedlinks, com_nonprofit, com_presentation, com_project, com_tcexam, com_versions. Modules: mod_al_applications, mod_al_login, mod_al_newsletter, mod_al_upload, mod_al_vote, mod_alusers, mod_alworkshops, mod_course_list, mod_webinar, mod_webinar_list, mod_wsregister. Plugin: content/workshopdates. Templates: blankframe, category. Submodules (Cadline-internal deployed-layout repos): common_cadline_libraries → git.cadline.hu/cadline_web/cadcommonlib; maintenance → git.cadline.hu/cadline_web/maintenance. Docroot apps: beiratkozas, iskolak, public, phpext. Docroot PHPs: crashadmin.php, crm_hardlock.class.php, login-external.php, tips.php, recaptchalib.php, configuration.php.