LÁZÁR Imre AI Agent
32cb5b765b
Re-architect the baseline as constituents + a generator script (build-baseline.sh) instead of a checked-out deployed tree: a deployed Joomla docroot differs from the repo/source layout, so the script manifest-maps packaged extensions (lib/jmap.py), places no-source and Cadline files, applies core overrides, excludes malware/data, and emits out/ = the code baseline the operator HIDS verifier consumes. Adds RUNBOOK.md (recipe+inventory), PROVENANCE.md (upstream map), malware-iocs. Signed-off-by: LÁZÁR Imre <imre@illusion.hu> Assisted-by: claude-code@claude-opus-4-8
54 lines
3.3 KiB
Markdown
54 lines
3.3 KiB
Markdown
# PROVENANCE — extension → upstream map
|
|
|
|
Per-extension origin for the baseline. `SUBMODULE`/`packages/` = source obtainable
|
|
(manifest-mapped); `deployed/` = no obtainable source (vetted live files, upstream URL
|
|
kept for reference only); `cadline/` = Cadline own-code. "modified" = Cadline changed
|
|
it → the change is a `cadline.patch` (packages/) or documented here (no-source).
|
|
|
|
## Upstream-obtainable (packages/ — manifest-mapped)
|
|
|
|
| Module | Version | Upstream | State |
|
|
|---|---|---|---|
|
|
| OneAll Social Login | 5.5.0 | github.com/oneall/social-login-joomla @5.5.0 | **modified** (CRM integration) |
|
|
| RemoteImage | 2.0.10 | github.com/asikart/remoteimage @2.0.10 | stock |
|
|
| Phoca Commander | 3.0.2 | github.com/PhocaCz/PhocaCommander @3.0.2 | stock |
|
|
| Phoca Download | 3.1.2 | github.com/PhocaCz/PhocaDownload @3.1.2 | **modified** (10 files: trial/HU routes/DB) |
|
|
| Easy File Uploader | 2.7.8 | github.com/ollily/easyfileuploader | **modified** (3 files: contest upload form) |
|
|
|
|
## Git upstream exists but no version-matching package (deployed/, provenance only)
|
|
|
|
| Module | Version | Upstream | Note |
|
|
|---|---|---|---|
|
|
| K2 | 2.8.0 | github.com/getk2/k2 | no 2.8.0 tag → deployed |
|
|
| JoomGallery | 3.3.4 | github.com/JoomGallery/JoomGallery | no 3.3.4 tag → deployed |
|
|
| Windwalker (lib) | 2.1.18 | github.com/ventoviro/windwalker | branch only → deployed |
|
|
| SP Easy Image Gallery | 1.0 | github.com/JoomShaper/SP-Easy-Image-Gallery | no 1.0 → deployed |
|
|
| Image Swoop | 1.2.5 | github.com/TemplateMonster-JoomlaTeam/mod_image_swoop | master only → deployed |
|
|
| IceMegaMenu | 3.0.1/3.0.0 | github.com/dakuzen/mod_icemegamenu | version mismatch → deployed |
|
|
|
|
## No source (deployed/, vetted live files)
|
|
|
|
sh404SEF 4.4.4.1791, JCK Editor 6.4.4/6.6.2 (**modified**: menunodes.php CVE-2018-17254
|
|
mitigation — no upstream, Mértanmű fix, documented), SP Page Builder 3.6.2, iCagenda
|
|
3.7.15, Akeeba Backup 6.1.1, Convert Forms 3.0.0 (+NR Framework 4.6.26), Regular Labs
|
|
Sourcerer 7.4.0 / Advanced Module Manager 7.7.1 / Modals 9.13.0 / library 18.12.3953,
|
|
AcyMailing 6.2.0, MightySites 3.2.5/2.1.5, JSN/JoomlaShine 2.5.6, Jumi 3.0.5, TF Learn
|
|
1.7.5, Smart Countdown 3.4.5, Smart Shoutbox 3.0.6, Slideshow CK 2.5.2, Social Login &
|
|
Share 4.0, Helix3 2.5.5 (clean index.php — live one was infected), and repo-less
|
|
modules/plugins/libs/templates (bt_googlemaps, os_touchslider, jflickr, jux/mx/ol
|
|
timeline, ut_joomstagram, xpertscroller, anycode, flippingbook, joombig, youtuber,
|
|
jw_allvideos/sig, socialnetworks, fancybox, mootable, EUCookieDirectiveLite, extblank,
|
|
tmlazyload, p3p, xef, _theme3037, trada).
|
|
|
|
## Cadline own-code (cadline/)
|
|
|
|
Components: com_showroom, com_albanner, com_alworkshops, com_followedlinks, com_nonprofit,
|
|
com_presentation, com_project, com_tcexam, com_versions. Modules: mod_al_applications,
|
|
mod_al_login, mod_al_newsletter, mod_al_upload, mod_al_vote, mod_alusers, mod_alworkshops,
|
|
mod_course_list, mod_webinar, mod_webinar_list, mod_wsregister. Plugin: content/workshopdates.
|
|
Templates: blankframe, category. Submodules (Cadline-internal deployed-layout repos):
|
|
`common_cadline_libraries` → git.cadline.hu/cadline_web/cadcommonlib; `maintenance` →
|
|
git.cadline.hu/cadline_web/maintenance. Docroot apps: beiratkozas, iskolak, public, phpext.
|
|
Docroot PHPs: crashadmin.php, crm_hardlock.class.php, login-external.php, tips.php,
|
|
recaptchalib.php, configuration.php.
|