PHP File Change Scanner: the scan report's Export CSV button is now a split button with two new options, Export Filtered CSV and Export Paths
Bug fixes
[LOW] PHP File Change Scanner: files under administrator/manifests were reported as Non-core, even though Joomla places them there itself when installing package, file, and library extensions
[LOW] PHP File Change Scanner: the CSV export of a scan report escaped double quotes with a backslash instead of doubling them, per RFC 4180
[LOW] PHP File Change Scanner: the CSV export of a scan report only exported the page of results currently displayed, and silently applied the filters left over in the session
[MEDIUM] PHP File Change Scanner: Non-core files were only reported by the scan which first saw them; they are now reported by every scan for as long as they exist on the site, unless they are Marked Safe. Test case NonCorePersistence.
[MEDIUM] PHP File Change Scanner: when the CoreSums checksum data could not be downloaded, Joomla's own files under includes/, administrator/includes/ and administrator/help/ were reported as Non-core
Miscellaneous changes
PHP File Change Scanner: the CSV export of a scan report now also includes the Type and Threat Score columns
Workaround for Joomla erroneously reporting our database tables as out of date
v7.9.0
New features
Configuration Monitoring: include a diff of the changed settings, redacting sensitive values [#334]
Machine-translated the extension into Greek, French, German, Spanish, Italian, and Portuguese
UploadShield reloaded: uploaded files are scanned for PHP code, PHP file extensions, multiple extensions, and .htaccess handler overrides [#346]
Bug fixes
[HIGH] .htaccess Maker: "Block access from specific user agents" failed because double quotes were used
[HIGH] .htaccess/NginX/web.config Maker: Apply/Save crashed with a fatal error, instead of a warning, when the "Restrict access by IP" cloud provider (e.g. Sucuri) could not be fetched
[HIGH] Allowed Domains: Quick Setup Wizard rendered the domains as the literal "Array", corrupting the list and locking sites out [#342]
[HIGH] PHP warning "Undefined variable $isHttpsForced" in Admin Secret Word feature on Joomla 5 sites
[LOW] File-diff SequenceMatcher: comments are not rejected during matching [#339]
[LOW] Improved CSRF checks in multiple backend views
[LOW] PHP File Change Scanner: the code default for "Only email when there are actionable items" disagreed with the Options page default on sites which had never saved their Options
[LOW] Several backend list-view search boxes and filters silently did nothing (auto-ban reason, temporary Super User e-mail search, IP list search, URL redirection published filter) [#344]
[LOW] Temporary Super Users: the orphaned-record cleanup query was malformed and did not reliably remove orphaned rows [#345]
[LOW] Transactional emails were not rendered in the recipient's language
[MEDIUM] Block Email Domains on Signup: a specially crafted local part could allow block bypass [#340]
[MEDIUM] Non-Super User access (optional feature) didn't work due to too-tight ACL checks.
[MEDIUM] PHP File Change Scanner CLI: warnings issued by the last step, including failures to send the scan results email, were silently discarded
[MEDIUM] PHP File Change Scanner: double-extension scanning would flag some innocuous files
[MEDIUM] PHP File Change Scanner: the "Possible Threat" status filter excluded new files with a nonzero threat score [#347]
[MEDIUM] PHP File Scanner: the error message for a failed scan was never displayed on screen.
[MEDIUM] PHPShield: leading whitespace bypassed anchored stream-wrapper check [#338]
[MEDIUM] WAF Exception w/out query params had no effect.
Miscellaneous changes
Control Panel now available to anyone with access to Admin Tools (core.manage)
Hardening: bind filter/request values as prepared parameters and use an ORDER BY column/direction allowlist across list views and the WAF [#343]
Inaccessible Control Panel feature buttons now hidden instead returning 403 when clicked
Joomla 7.0 forward compatibility: replace the removed Joomla.JText JavaScript proxy with Joomla.Text
Joomla! Update tools now requires global Super User (core.admin) access
PHP File Change Scanner: using transactions to speed up the initial scan
SQLiShield: Improved performance against 1-bit oracle exfiltration attacks
