[4.0] Add locked field to extensions table, prevent uninstalling core extensions, restructure protected extension list#28462
Conversation
|
i guess we need to add com_privacy & com_actionlogs to the list of core component |
|
plus com_csp |
|
And someone has to check PostgreSQL, system tests for postgres are failing in drone. I don't have time now. |
|
List of core extension here should be up to date, so just use this as master: https://github.com/joomla/joomla-cms/blob/4.0-dev/libraries/src/Extension/ExtensionHelper.php#L46. (posted wrong link for staging before, now is correct 4.0-dev) |
|
it seems crazy to me that we have one hard coded list already and to add a second one is even more bizarre |
administrator/components/com_admin/sql/updates/mysql/4.0.0-2020-03-25.sql
Outdated
Show resolved
Hide resolved
…in Drone and update to 4.0-dev (#1) * [RTL] Fix position of close button in modal * Fix error with PostgreSQL installation * Adjust update sql to latest components and modules as in joomla.sql * Adjust update sql to latest plugins as in joomla.sql * SQL CS - use spaces in IN lists * Revert unrelated scss change Co-authored-by: wilsonge <georgejameswilson@googlemail.com>
|
What remains to be done is to check and if necessary update the list of core extensions in section "Now protect from disabling essential core extensions" at the bottom of the update sql. These values for |
|
@Quy You can remove the sentence about SQL files to be reviewed from the description since I’ve reviewed them. |
|
I have tested this item ✅ successfully on 793bd1d
|
|
Addition to test: #28462 (comment) =============
|
Scenario 1 Mysql and Postgres
By the way I wonder why there is sometimes a icon that shows to you, that the extension is protected and sometimes this icon is missing. I know that this icon is for protecting publishing and unpublished. But it is a little bit confusing for new Joomlers. System Information System Information |
|
@astridx Please read |
|
Scenario 2 MySQL and Postgres
By the way: After the update I saw this errors using postgres and using mysql. System Information System information |
|
I have tested this item ✅ successfully on 793bd1d This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/28462. |
|
RTC This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/28462. |
|
Thanks guys! |
|
Any reason to lock the Language Switcher module and not the Language Filter system plugin? |
|
See issue #28527 |
9 participants
Porting of PR #17219 to J4
All credits to @mbabker. Thank you!
Thanks @richard67 for updating the SQL files.
Text below copied from PR #17219.
Summary of Changes
This is PR #13037. See the original PR for added context and past conversation.
The long and short is this adds a new field,
locked, to the extensions table, and splits the current definition of theprotectedfield. This also updates the protected extension list to make the list only include admin components, core libraries, and the files extension that Joomla tracks itself with (this means all modules and plugins are now unprotected and can be enabled/disabled consistently).Current:
protectedindicates an extension which cannot be disabled or uninstalledNew:
protectedindicates an extension which cannot be disabledlockedindicates an extension which cannot be uninstalledWhy This Distinction Matters
Uninstalling core extensions can be problematic, and honestly it's not very effective given our current packaging and upgrading solutions. Even if you do uninstall the extensions, they end up back on your site's filesystem during the update process because we don't make the package extraction step aware of the database and inherently the installed extensions. Also, uninstalling components takes their tables with them, and if an update includes a SQL delta for one of those tables, it causes the update to fail over. So we should take an extra step to protect users from doing things that could be dangerous for their sites. Next, an uninstallable extension should not mean that the extension must be enabled. The only extensions which should be protected are those which if disabled would critically bring down the site, every other aspect of the extension listing should be controllable by the site administrator.
Testing Instructions
It needs to test the same changes in 2 scenarios:
Then, after the new installation or the update, it needs to test in both cases:
For scenario 1 new installation, apply the patch of this PR to a clean 4.0-dev branch when having a git clone, or use the patched full package download for this PR (see below).
For scenario 2, use the patched update package download for this PR (see below).
You can find a link to the downoads page when expanding the test results at the bottom of this PR on GitHub, if not already expanded:
The link leads to a download page where you can donwnload patched installation and update packages for this PR. By the commit number you can check if they fit to the last commit of this PR, i.e. they are up to date:
There is also a custom update URL given for the update package so you can use the online update with that custom URL.
Btw. this is a standard feature for new or newly modified PR's on the 4.0-dev branch, so it can be used in the same way for testing other PR's, too.
Documentation Changes Required
We should probably add a page explaining the various extension states and what these columns exist for if one doesn't already exist.