Akeeba Backup PRO for Joomla v10.5.0

Decryption key:

To view the content, you need to Sign In or Register.

Akeeba Backup PRO for Joomla v10.5.0
= What's new?
Security hardening. This version builds on the hardening work started in version 10.3.7 and concludes our full audit of the code, addressing the remaining very minor issues.

Enforced version compatibility checks. The package now checks your Joomla and PHP version when you try to install it. If it detects an incompatible Joomla and/or PHP version it will refuse to install / uninstall / update and tell you. The extension itself will warn you about the incompatibility and refuse to run. This is an additional protection against accidentally breaking your site by installing an incompatible version of our software or your site, or updating / downgrading Joomla or PHP outside the supported range after installing the extension.

Removed legacy error handler. The legacy error handler would show very detailed site and server information whenever an error occurred in the backend of the site. Joomla 4 and later have their own error handler showing the same level of detail when you enable Site Debug. We removed our handler in favor of the core-provided solution. Do remember to set Site Debug to Yes and set Error Reporting to Maximum in your Joomla Global Configuration page to receive a detailed error report before requesting support.

Added support for seven additional Amazon S3 regions. More regions have been added to the S3 engine, matching the updated Amazon S3 documentation. As always, if you had used one of those regions as a custom region it will still work without any change necessary on your end.

Legacy OneDrive options removed. "Upload to Microsoft OneDrive (LEGACY)" and "Upload to Microsoft OneDrive (App-Specific Folder)" are gone. If a backup profile uses either of them, switch it to the “OneDrive for Business” connector. Despite its name, it works with personal Microsoft 365 subscriptions as well – look, we get it, Microsoft's naming of their products and APIs is weird; we just follow their official naming, it doesn't mean we like it.

Restoration changes. The integrated restoration no longer offers the "Use the FTP layer" extraction option, nor the SFTP and "use FTP for all files" modes. Direct and Hybrid remain; Hybrid falls back to FTP when a direct write fails.

Starting backups now requires an anti-CSRF token. The Backup menu item no longer has a "Start immediately" option, and the Quick Icon no longer autostarts the backup, because menu items and links cannot carry an anti-CSRF token. You now start the backup yourself with a click. If your server has broken session handling and backups fail with a security token error, turn off the new Options setting "Backend backup checks the anti-CSRF token".

S3-compatible storage. Import Archives from S3 now supports the custom endpoint of S3-compatible storage. Yes, this means you can now import archives from third-party services such as Wasabi, Synology C2, Scaleway and so on.

Many (very minor) bug fixes. The vast majority of these bugs were issues nobody had hit in over a decade; others were PHP or Joomla version-specific, or packaging issues. A number of reported PostgreSQL backup issues were fixed as well.

Changelog​

Critical bugs and important changes​

• PHP and Joomla minimum and maximum version compatibility is now enforced
• Restoration: extraction accepted archive entries with dot paths in their name
• Three exception-chain walkers looped forever instead of terminating once an exception had a previous exception

Original Files

Decryption key:

To view the content, you need to Sign In or Register.

Akeeba Backup PRO for Joomla v10.4.0
Changelog
New features

• akeebarofile:import into specific profile ID with --profile, overwriting profile with --force

Bug fixes​

• [LOW] CLI command reference documented positional arguments as --options
• [LOW] CLI commands treated mandatory arguments as optional
• [LOW] Failed JSON API authentication did not fire onUserLoginFailure
• [LOW] Manage Backups, Site Transfer Wizard showed wrong path when output directory missing or outside open_basedir
• [LOW] Some English, French, and Italian strings displayed a literal backslash before an apostrophe
• [LOW] The OAuth2 token refresh had wrong cache-busting headers
• [LOW] The Options page "Check for failed backups" section header had no language string, showing the raw key instead
• [LOW] Three Site Transfer Wizard strings were untranslated
• [LOW] akeeba:backup:alternate was missing from the CLI command reference
• [MEDIUM] POST requests to the v3 JSON API endpoint always failed
• [MEDIUM] Split archives could end in an empty part, failing post-processing with "Missing input parameters"
• [MEDIUM] akeeba:sysconfig:get and akeeba:sysconfig:set improper error when missing the argument

Miscellaneous changes​

• JSON API v2, and Secret Word authentication on the v3 API, are deprecated; removal in 11.0, October 2027
• JSON API: support for non-Super-User accounts in the API
• Logs never created with .log extension; when .log.php is blocked we now use just .php

Decryption key:

To view the content, you need to Sign In or Register.

Akeeba Backup PRO for Joomla v10.3.7
= Bug fixes

• [HIGH] Box, Dropbox, Google Drive, OneDrive token refresh during upload could overwrite another profile's remote storage configuration
• [HIGH] Database dumps silently lost precision on DOUBLE columns (PDO MySQL and PostgreSQL)
• [LOW] Hardening: all database queries built from filter, user-state, and request values now use bound, typed query parameters across the backend, front-end JSON API, and the Akeeba Engine
• [LOW] Hardening: assorted backend control panel actions now require an anti-CSRF token (backup filter/exclusion/inclusion editors, remote archive delete/download, Transfer Wizard, Upload, S3 import, FTP/SFTP connection tests, custom data processing API, Configuration Wizard, output directory check, hide restoration modal, dismiss upsell)
• [LOW] Hardening: the backend backup AJAX flow now uses a per-backup anti-CSRF token, immune to session token rotation during long backups
• [LOW] Hardening: the front-end and JSON API Secret Word is now compared in constant time
• [LOW] Importing a profile without selecting a file caused an error page instead of a graceful redirect
• [LOW] The backend backup AJAX endpoint did not send no-cache headers
• [MEDIUM] Backend views did not all enforce their intended ACL privilege (Schedule, Push, Statistic, Profile, and deleting backup records)
• [MEDIUM] Box reported a lapsed authorisation as an opaque HTTP 401 error
• [MEDIUM] Box, Dropbox, Google Drive, and OneDrive did not refresh an access token missing from the backup profile, failing with an opaque authorisation error
• [MEDIUM] Dropbox did not explain a missing or lapsed Download ID
• [MEDIUM] Google Drive and OneDrive did not report a rejected token refresh
• [MEDIUM] Test FTP Connection button ignored the "Use FTP over SSL (FTPS)" setting, causing spurious authentication errors against FTPS-only servers
• [MEDIUM] The Schedule page is now restricted to users allowed to edit the component's Options (it displays the front-end/JSON API secrets)
• [MEDIUM] WebDAV did not surface failed upload reason to the UI or the log file

Decryption key:

To view the content, you need to Sign In or Register.

Akeeba Backup PRO for Joomla v10.3.6
= New features

• Site Transfer Wizard: transfer any backup archive present on the server, not just the latest one (gh-36)

Bug fixes

• [HIGH] Box, Dropbox, OneDrive stored files under the local temp name
• [HIGH] Uploads failed when using a bucket-restricted BackBlaze B2 key
• [LOW] BackBlaze cancelUpload sent the request body as form-data, not JSON
• [LOW] BackBlaze downloadFileById used the wrong API path (404)
• [LOW] Box folder listing paginated incorrectly
• [LOW] Site Transfer Wizard: Dark mode layout issues (white-on-white in upload stats area)
• [LOW] WebDAV options() dropped capabilities from repeated DAV headers
• [MEDIUM] Box, Dropbox, Google Drive, OneDrive token refresh raced expiry
• [MEDIUM] Dropbox public download URL embedded the access token
• [MEDIUM] Google Storage pre-signed URLs duplicated the bucket name (403)
• [MEDIUM] OneDrive for Business signed download URL was broken on Graph
• [MEDIUM] RackSpace CloudFiles validated the username, not the API key
• [MEDIUM] S3 v4 pre-signed URLs failed (403) on path-style non-AWS hosts

Decryption key:

To view the content, you need to Sign In or Register.

Akeeba Backup PRO for Joomla v10.3.5
New translations
We now include language files for Greek (el-GR), French (fr-FR), German (de-DE), Spanish (es-ES), Portuguese (pt-PT), and Italian (it-IT). These are machine-translated, which puts them on par with what we have historically received from community translators — but with the added benefit of being complete and consistent throughout the entire interface.

BackBlaze B2 v4 API​

If you use BackBlaze B2 for cloud storage, Akeeba Backup now uses the v4 API. No action is required on your part; your existing B2 credentials continue to work.

OVH file scanner false positive for kickstart.txt​

Some OVH-hosted sites have a broken file scanner that incorrectly flags kickstart.txt (the Kickstart documentation file included in the backup archive) as malicious. Akeeba Backup now obfuscates this file to prevent false positives on these hosts.

Changelog​

New features​

• Translations for Greek (el-GR), French (fr-FR), German (de-DE), Spanish (es-ES), Portuguese (pt-PT), and Italian (it-IT)

Bug fixes​

• [HIGH] DirectFTP would not work due to setting erroneous directory permissions
• [HIGH] The Site Transfer Wizard was not working

Miscellaneous changes​

• Obfuscate kickstart.txt so that broken file scanners (OVH) don't cause problems by misidentifying it as "malicious"
• Switched to BackBlaze B2 v4 API

Decryption key:

To view the content, you need to Sign In or Register.

Akeeba Backup PRO for Joomla v10.3.4
= Changelog = Bug fixes

• [LOW] Configuration page: Count Quota value not saved when using spinner arrows or when saving without first clicking outside the custom value field
• [MEDIUM] Fix stdClass warning when reading akeeba.quota.logfiles configuration key

Decryption key:

To view the content, you need to Sign In or Register.

Akeeba Backup PRO for Joomla v10.3.3
= Changelog
New features

• Add "Delete obsolete log files" quota feature

Bug fixes​

• [HIGH] Check Backup Uploads: TypeError (null given to method_exists) when checking for failed uploads
• [HIGH] Check file upload: SQL error on all PHP versions when checking for failed uploads
• [MEDIUM] Configuration page: saving an SFTP password containing an angle bracket (e.g. `F9`) would blank the profile description and deselect the one-click backup icon

Miscellaneous changes​

• Manage Backups: the View Log button is now disabled with a tooltip when the log file no longer exists on the server

Decryption key:

To view the content, you need to Sign In or Register.

Akeeba Backup PRO for Joomla v10.3.2
= Miscellaneous changes

• Obfuscate the PostgreSQL dump engine EVEN MORE AGGRESSIVELY so that certain antivirus don't throw a false positive.

Decryption key:

To view the content, you need to Sign In or Register.

Akeeba Backup PRO for Joomla v10.3.1
Changelog
Miscellaneous changes

• Obfuscate the PostgreSQL dump engine so that certain antivirus don't throw a false positive.

Decryption key:

To view the content, you need to Sign In or Register.

Akeeba Backup PRO for Joomla v10.3.0
= New features

• PostgreSQL support