From 3cd149e4cde31adab8cac3410a62b7c565bb28dd Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 5 Nov 2026 22:20:22 +0000 Subject: [PATCH] Keep the plugin's own values on save; install hint; version check - Settings: saving replaced all the plugin's params with the form's values, dropping the ones the plugin keeps for itself (Bfstop::InternalSettings: addressesCanonical, lastPurge) - so after every save, the next request converted all stored addresses again and ran the daily maintenance. They are kept now. - The install hint told administrators to enable the plugin, which the plugin now does itself when it is installed; it points to the settings instead, and is only shown on installation (on an update, the plugin's script says what to review). Translated into all languages. - The installer script extends Joomla's InstallerScript: it refuses Joomla before 5.0, PHP before 8.1, and replacing a newer version with an older one. - Delay Duration and Maximum Adaptive Delay offered up to 120 seconds, but the plugin never delays a response longer than 60 (Bfstop::MaxDelaySeconds). Needs the plugin branch of the same name (Bfstop::InternalSettings). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01AFJFMMUpch4LGexEiXN8Nc --- admin/forms/settings.xml | 4 +-- admin/language/ca-ES/ca-ES.com_bfstop.ini | 2 +- admin/language/de-DE/de-DE.com_bfstop.ini | 2 +- admin/language/en-GB/en-GB.com_bfstop.ini | 2 +- admin/language/es-ES/es-ES.com_bfstop.ini | 2 +- admin/language/fr-FR/fr-FR.com_bfstop.ini | 2 +- admin/language/it-IT/it-IT.com_bfstop.ini | 2 +- admin/language/nl-NL/nl-NL.com_bfstop.ini | 2 +- admin/language/ru-RU/ru-RU.com_bfstop.ini | 2 +- admin/src/Model/SettingsModel.php | 36 ++++++++++++++++++++++- installscript.php | 18 +++++++++--- 11 files changed, 59 insertions(+), 15 deletions(-) diff --git a/admin/forms/settings.xml b/admin/forms/settings.xml index 198c698..5403630 100644 --- a/admin/forms/settings.xml +++ b/admin/forms/settings.xml @@ -215,7 +215,7 @@
PLG_SYSTEM_BFSTOP_ENABLED visió general dels connectors, clica a l'entrada 'System - Brute Force Stop' (pots cercar-la o part del seu nom per trobar-la més ràpid a la llista) i activa'l - després ves a la vista de configuració del component per configurar-lo segons les teves necessitats!" +COM_BFSTOP_INSTALL_HINT="Brute Force Stop protegeix el lloc amb la configuració per defecte tan bon punt s'instal·la el seu connector (el paquet l'instal·la i l'activa). Revisa la configuració a la vista de configuració del component." diff --git a/admin/language/de-DE/de-DE.com_bfstop.ini b/admin/language/de-DE/de-DE.com_bfstop.ini index c11c444..2169617 100644 --- a/admin/language/de-DE/de-DE.com_bfstop.ini +++ b/admin/language/de-DE/de-DE.com_bfstop.ini @@ -83,7 +83,7 @@ COM_BFSTOP_IP_PRIVATE_OR_RESERVED="Eingegebene Adresse/Bereich ist in einem priv COM_BFSTOP_IP_BLOCKS_USER="Eingegebene Adresse/Bereich (%s) würde die IP-Adresse, von der aus aktuell zugegriffen wird (%s), blockieren!" COM_BFSTOP_HEADING_IPRANGE_INFO="IP Bereich Info" COM_BFSTOP_YOUR_IP_IS="Deine IP-Adresse aus der Sicht von BFStop ist %s." -COM_BFSTOP_INSTALL_HINT="Bitte sicherstellen, dass BFStop aktiviert und richtig konfiguriert ist! Gehe zur Plugin-Übersicht, klicke auf den Eintrag 'System - Brute Force Stop' (du kannst auch danach oder Teilen des Namens suchen, um es in der langen Liste schneller zu finden), dann setze das Plugin auf 'Aktiviert' - gehe dann zur Einstellungen-Ansicht der Komponente, um es nach deinen Bedürfnissen zu konfigurieren!" +COM_BFSTOP_INSTALL_HINT="Brute Force Stop schützt die Website mit den Standardeinstellungen, sobald das Plugin installiert ist (das Paket installiert und aktiviert es). Bitte die Einstellungen in der Einstellungen-Ansicht der Komponente überprüfen." COM_BFSTOP_FAILEDLOGIN_AUTOPURGE_ENABLED="Fehlgeschlagene Login-Versuche, die älter als %d Wochen sind, werden automatisch gelöscht. Dies kann über die Einstellung 'Löschen alter Einträge' im Reiter 'Advanced' der Einstellungen geändert werden." COM_BFSTOP_FAILEDLOGIN_AUTOPURGE_DISABLED="Alte fehlgeschlagene Login-Versuche werden derzeit nicht automatisch gelöscht. Um das zu aktivieren, 'Löschen alter Einträge' im Reiter 'Advanced' der Einstellungen setzen, oder mit dem Button 'Alte Einträge löschen' manuell aufräumen." COM_BFSTOP_BLOCKLIST_AUTOPURGE_ENABLED="Abgelaufene Sperren (und ihre Entsperr-Einträge), die vor mehr als %d Wochen geendet haben, werden automatisch gelöscht. Dies kann über die Einstellung 'Löschen alter Einträge' im Reiter 'Advanced' der Einstellungen geändert werden. Permanente Sperren werden nie automatisch gelöscht." diff --git a/admin/language/en-GB/en-GB.com_bfstop.ini b/admin/language/en-GB/en-GB.com_bfstop.ini index 3f198f8..bf7806c 100644 --- a/admin/language/en-GB/en-GB.com_bfstop.ini +++ b/admin/language/en-GB/en-GB.com_bfstop.ini @@ -84,7 +84,7 @@ COM_BFSTOP_IP_PRIVATE_OR_RESERVED="The entered address/range (%s) is in a privat COM_BFSTOP_IP_BLOCKS_USER="The entered IP/range (%s) would block the IP address from which currrent access is happening (%s)!" COM_BFSTOP_HEADING_IPRANGE_INFO="IP Range Info" COM_BFSTOP_YOUR_IP_IS="Your IP address as BFStop sees it is %s." -COM_BFSTOP_INSTALL_HINT="You need to make sure BFStop is enabled and properly set up for your needs! Please go to the plugin overview, click on the entry 'System - Brute Force Stop' (you can search for this or parts of it in order to find the plugin faster in the long list), and set it to enabled - then go to the component's Settings view to configure it according to your needs!" +COM_BFSTOP_INSTALL_HINT="Brute Force Stop protects your site with its default settings as soon as its plugin is installed (the package installs and enables it). Please review them in the component's Settings view." COM_BFSTOP_SETTINGS_ACCOUNT_FIELDSET_LABEL="Account-level Throttle" COM_BFSTOP_SETTINGS_ACCOUNT_THROTTLE_ENABLED_LABEL="Enable Account-level Throttle" COM_BFSTOP_SETTINGS_ACCOUNT_THROTTLE_ENABLED_DESC="Whether to also count failed logins per username, added up across every source IP address that attempted them - not just per IP address. This catches a distributed attack that spreads attempts against one account across many different IPs, which the regular per-IP block threshold alone cannot detect. The account itself is never locked out; only failed attempts get progressively delayed." diff --git a/admin/language/es-ES/es-ES.com_bfstop.ini b/admin/language/es-ES/es-ES.com_bfstop.ini index 55e9fa2..6760198 100644 --- a/admin/language/es-ES/es-ES.com_bfstop.ini +++ b/admin/language/es-ES/es-ES.com_bfstop.ini @@ -35,4 +35,4 @@ COM_BFSTOP_SETTINGS_VERSION_FIELDSET_LABEL="Acerca de" COM_BFSTOP_SETTINGS_VERSION_COMPONENT="Versión del componente: %s" COM_BFSTOP_SETTINGS_VERSION_PLUGIN="Versión del plugin: %s" COM_BFSTOP_SETTINGS_VERSION_UNKNOWN="desconocida" -COM_BFSTOP_INSTALL_HINT="¡Debe asegurarse de que BFStop esté activado y configurado correctamente! Vaya a la vista general de plugins, haga clic en la entrada 'System - Brute Force Stop' (puede buscar este texto o parte de él para encontrar el plugin más rápido en la larga lista) y actívelo - luego vaya a la vista de configuración del componente para configurarlo según sus necesidades!" +COM_BFSTOP_INSTALL_HINT="Brute Force Stop protege su sitio con la configuración predeterminada en cuanto se instala su plugin (el paquete lo instala y lo activa). Revise la configuración en la vista de configuración del componente." diff --git a/admin/language/fr-FR/fr-FR.com_bfstop.ini b/admin/language/fr-FR/fr-FR.com_bfstop.ini index dc21700..98fbfb4 100644 --- a/admin/language/fr-FR/fr-FR.com_bfstop.ini +++ b/admin/language/fr-FR/fr-FR.com_bfstop.ini @@ -49,4 +49,4 @@ COM_BFSTOP_DESC_BLOCK_IPADDRESS="L'adresse IP (ou le sous-réseau) à bloquer. L COM_BFSTOP_DESC_BLOCK_CRDATE="La date / l'heure de mise en oeuvre du blocage" COM_BFSTOP_DESC_ALLOWLIST_IPADDRESS="L'adresse IP (ou le sous-réseau) pour lequel l'accès à ce site est toujours autorisé (les contrôles réalisés par le plugin sont désactivés). Les sous-réseaux sont spécifiés dans la notation de suffixe de CIDR, c'est à dire au moyen d'un bloc défini par le préfixe (par exemple 192.168.0.0) suivi de / puis du nombre de bits représentant la taille du bloc (par exemple '192.168.0.0/24')" COM_BFSTOP_DESC_ALLOWLIST_NOTES="Notes pour l'entrée dans la liste blanche." -COM_BFSTOP_INSTALL_HINT="Vous devez vous assurer que BFStop est activé et correctement configuré ! Allez dans la liste des plugins, cliquez sur l'entrée 'System - Brute Force Stop' (vous pouvez rechercher ce texte ou une partie pour le trouver plus rapidement dans la longue liste) et activez-le - puis allez dans la vue Réglages du composant pour le configurer selon vos besoins !" +COM_BFSTOP_INSTALL_HINT="Brute Force Stop protège votre site avec ses réglages par défaut dès que son plugin est installé (le paquet l'installe et l'active). Veuillez vérifier les réglages dans la vue Réglages du composant." diff --git a/admin/language/it-IT/it-IT.com_bfstop.ini b/admin/language/it-IT/it-IT.com_bfstop.ini index dc0a7ad..632ddfa 100644 --- a/admin/language/it-IT/it-IT.com_bfstop.ini +++ b/admin/language/it-IT/it-IT.com_bfstop.ini @@ -39,4 +39,4 @@ COM_BFSTOP_HEADING_IPINFO="Informazioni per l'indirizzo IP %s" COM_BFSTOP_SUBMENU_ALLOWLIST="Whitelist" COM_BFSTOP_HEADING_ALLOWLIST="Brute Force Stop: Whitelist" COM_BFSTOP_ALLOWLIST_DELETE_CONFIRM="Sei sicuro di voler cancellare l'indirizzo(i) IP contrassegnato(i)" -COM_BFSTOP_INSTALL_HINT="Assicurati che BFStop sia abilitato e configurato correttamente! Vai alla panoramica dei plugin, fai clic sulla voce 'System - Brute Force Stop' (puoi cercare questo testo o parte di esso per trovare il plugin più velocemente nell'elenco), e attivalo - poi vai alla vista Impostazioni del componente per configurarlo secondo le tue esigenze!" +COM_BFSTOP_INSTALL_HINT="Brute Force Stop protegge il sito con le impostazioni predefinite non appena il suo plugin è installato (il pacchetto lo installa e lo attiva). Controlla le impostazioni nella vista Impostazioni del componente." diff --git a/admin/language/nl-NL/nl-NL.com_bfstop.ini b/admin/language/nl-NL/nl-NL.com_bfstop.ini index 0819703..6be5aa9 100644 --- a/admin/language/nl-NL/nl-NL.com_bfstop.ini +++ b/admin/language/nl-NL/nl-NL.com_bfstop.ini @@ -41,4 +41,4 @@ COM_BFSTOP_HEADING_IPINFO="Informatie over IP-adres %s" COM_BFSTOP_SUBMENU_ALLOWLIST="Whitelist" COM_BFSTOP_HEADING_ALLOWLIST="Brute Force Stop: Whitelist" COM_BFSTOP_ALLOWLIST_DELETE_CONFIRM="Weet u zeker dat u de gekozen IP-adressen wilt verwijderen?" -COM_BFSTOP_INSTALL_HINT="Zorg ervoor dat BFStop is ingeschakeld en correct is ingesteld! Ga naar het plugin-overzicht, klik op de vermelding 'System - Brute Force Stop' (u kunt hierop of een deel hiervan zoeken om de plugin sneller te vinden in de lange lijst) en schakel deze in - ga vervolgens naar de instellingenweergave van het component om het naar wens in te stellen!" +COM_BFSTOP_INSTALL_HINT="Brute Force Stop beschermt uw site met de standaardinstellingen zodra de plugin is geïnstalleerd (het pakket installeert en activeert deze). Controleer de instellingen in de instellingenweergave van het component." diff --git a/admin/language/ru-RU/ru-RU.com_bfstop.ini b/admin/language/ru-RU/ru-RU.com_bfstop.ini index 04ebaa4..87e4eac 100644 --- a/admin/language/ru-RU/ru-RU.com_bfstop.ini +++ b/admin/language/ru-RU/ru-RU.com_bfstop.ini @@ -35,4 +35,4 @@ COM_BFSTOP_SETTINGS_VERSION_FIELDSET_LABEL="О программе" COM_BFSTOP_SETTINGS_VERSION_COMPONENT="Версия компонента: %s" COM_BFSTOP_SETTINGS_VERSION_PLUGIN="Версия плагина: %s" COM_BFSTOP_SETTINGS_VERSION_UNKNOWN="неизвестно" -COM_BFSTOP_INSTALL_HINT="Убедитесь, что BFStop включён и правильно настроен! Перейдите в список плагинов, найдите там запись 'System - Brute Force Stop' (можно ввести часть названия для быстрого поиска в длинном списке) и включите его - затем перейдите в раздел настроек компонента, чтобы настроить его в соответствии с вашими требованиями!" +COM_BFSTOP_INSTALL_HINT="Brute Force Stop защищает сайт с настройками по умолчанию, как только установлен его плагин (пакет устанавливает и включает его). Проверьте настройки в разделе настроек компонента." diff --git a/admin/src/Model/SettingsModel.php b/admin/src/Model/SettingsModel.php index 1a5e12a..62315ce 100644 --- a/admin/src/Model/SettingsModel.php +++ b/admin/src/Model/SettingsModel.php @@ -10,6 +10,7 @@ defined('_JEXEC') or die; +use Codeling\Plugin\System\Bfstop\Extension\Bfstop; use Joomla\CMS\Factory; use Joomla\CMS\MVC\Model\AdminModel; use Joomla\CMS\Table\Extension; @@ -54,10 +55,43 @@ protected function loadFormData() public function save($data) { - $data[$this->getTable()->getKeyName()] = $this->resolvePluginExtensionId(); + $id = $this->resolvePluginExtensionId(); + $data[$this->getTable()->getKeyName()] = $id; + $data['params'] = self::keepInternalSettings($data['params'] ?? array(), $this->loadStoredParams($id)); return parent::save($data); } + /** + * The form's values replace all the plugin's params when they are saved, + * so the values the plugin keeps there for itself (which the form doesn't + * have, Bfstop::InternalSettings) have to be put back in: without them, + * it would convert all stored addresses again on the next request and run + * its daily maintenance at once. + */ + public static function keepInternalSettings($params, array $stored) + { + $params = is_array($params) ? $params : array(); + foreach (Bfstop::InternalSettings as $name) + { + if (array_key_exists($name, $stored) && !array_key_exists($name, $params)) + { + $params[$name] = $stored[$name]; + } + } + return $params; + } + + private function loadStoredParams($id) + { + $table = $this->getTable(); + if (!$table->load($id)) + { + return array(); + } + $params = json_decode((string) $table->params, true); + return is_array($params) ? $params : array(); + } + // the "settings" being edited here are not stored in a table of this // component; they are the plugin's own params, on its #__extensions row. protected function resolvePluginExtensionId() diff --git a/installscript.php b/installscript.php index e9de5dc..2d0fa3d 100644 --- a/installscript.php +++ b/installscript.php @@ -1,6 +1,6 @@ = 3 + * @package BFStop Component (com_bfstop) for Joomla! * @author Bernhard Froehler * @copyright (C) Bernhard Froehler * @license GNU/GPLv3 http://www.gnu.org/licenses/gpl-3.0.html @@ -9,12 +9,18 @@ use Joomla\CMS\Factory; use Joomla\CMS\Installer\InstallerAdapter; +use Joomla\CMS\Installer\InstallerScript; use Joomla\CMS\Language\Text; use Joomla\CMS\Router\Route; use Joomla\Filesystem\Folder; -class com_bfstopInstallerScript +class com_bfstopInstallerScript extends InstallerScript { + // InstallerScript::preflight() refuses to install on anything older (and + // to replace a newer version of the component with an older one) + protected $minimumJoomla = '5.0.0'; + protected $minimumPhp = '8.1.0'; + /** * @param InstallerAdapter $adapter The object responsible for running this script */ @@ -42,12 +48,16 @@ public function update(InstallerAdapter $adapter) } return true; } - function postflight($type, InstallerAdapter $adapter) + public function postflight($type, $adapter) { + // on an update, the plugin says what there is to review (if anything) + if ($type !== 'install') + { + return; + } $lang = Factory::getApplication()->getLanguage(); $lang->load('com_bfstop', JPATH_ADMINISTRATOR); Factory::getApplication()->enqueueMessage(Text::sprintf('COM_BFSTOP_INSTALL_HINT', - Route::_('index.php?option=com_plugins&view=plugins', false), Route::_('index.php?option=com_bfstop&view=settings', false) ), 'warning'); }