Skip to content

Unblock removes .htaccess lines right away; fix multi-unblock, allow list sorting, duration labels - #31

Merged
codeling merged 3 commits into
mainfrom
ccr-f557f83f-uk6a4f
Nov 7, 2026
Merged

codeling merged 3 commits into
mainfrom
ccr-f557f83f-uk6a4f

Conversation

@codeling

@codeling codeling commented Nov 7, 2026

Copy link
Copy Markdown
Owner

Component half of a bug/security review of plugin and component. The plugin PR is the bfstop branch of the same name (ccr-f557f83f-uk6a4f). Its tests cover these changes, and this branch needs HtaccessHelper::removeLiftedBlocks() from it.

Changes

  • Unblocking now takes the address out of .htaccess right away (776cf14). With blocking through .htaccess, unblocking in the block list or with the emailed unblock link only recorded the unblock in the database. The web server kept rejecting the address until the plugin blocked the next one or ran its daily maintenance, which could be up to a day. BlocklistModel::unblock() and TokenunblockModel now call UnblockHelper::removeLiftedHtaccessBlocks(). Lines an admin added by hand, with no block in the database, are left alone, as before.
  • Unblocking several blocks at once no longer stops at one that was already lifted (776cf14). UnblockHelper::unblockDB() returned false at the first such block, so the blocks selected after it stayed blocked. Also, a database exception during the insert left the result at "success".
  • Allow list column sorting works again (29203dc). The headers sorted by b.id, b.ipaddress and b.notes, but the model's filter fields and table alias use a.*, so ListModel fell back to the default ordering and clicking a header did nothing.
  • Block durations are always shown as text (aa79c35). convertDurationToReadable() built a language key from the duration, and those keys only exist for the durations in the block form. Blocks of a week or 30 days (both offered in the settings) and progressive durations showed raw keys like COM_BFSTOP_BLOCK_168HOURS. The new DurationHelper keeps the existing strings and shows any other duration as days, hours or minutes, using new COM_BFSTOP_BLOCK_N_DAYS/HOURS/MINUTES strings in all 10 languages.

None of this affects the released 1.5.x: removing lifted blocks from .htaccess and progressive durations are both new in 2.0.0. The sorting bug may be older.

Testing

Run locally against Joomla 5.4.10 on PostgreSQL 16, with plugin and component installed from these branches (tests/ci/install-joomla.sh):

  • Plugin suite, unit + integration: 388 tests OK, 3 skipped for environment reasons (running as root; MySQL-only checks). The new ComponentTest tests fail on main of this repo and pass on this branch.
  • check-language.php bfstop.xml COM_BFSTOP: 0 errors, 0 warnings. check-zip, php -l and xmllint all pass.

Generated by Claude Code

…rst lifted one

- With blocking through .htaccess, unblocking in the block list or with
  an emailed unblock link only recorded the unblock in the database; the
  web server kept rejecting the address until the plugin blocked the next
  one or ran its daily maintenance (up to a day). Both now remove what
  was lifted from .htaccess right away (HtaccessHelper::removeLiftedBlocks()
  of the plugin branch of the same name).
- UnblockHelper::unblockDB() returned at the first selected block which
  was unblocked already, so the blocks selected after it stayed blocked
  and the list reported a failure. It goes on with the others now.
- A database exception while inserting an unblock left the result at
  "success"; it is a failure now.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AFJFMPv7CSqgJJ93QJvYfL
The column headers sorted by b.id, b.ipaddress and b.notes, which are
not among AllowlistModel's filter fields (the table alias is "a"), so
ListModel replaced them by the default ordering and clicking a header
did nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AFJFMPv7CSqgJJ93QJvYfL
convertDurationToReadable() built a language key from the duration,
which only exists for the durations of the block form. The plugin's
settings also offer a week and 30 days, and the progressive block
duration doubles the duration up to 64 times, so such blocks showed
e.g. COM_BFSTOP_BLOCK_168HOURS. DurationHelper keeps the existing
strings and shows any other duration as a number of days, hours or
minutes (new strings COM_BFSTOP_BLOCK_N_DAYS/HOURS/MINUTES, in all
languages).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AFJFMPv7CSqgJJ93QJvYfL
@codeling
codeling merged commit 42e78ad into main Nov 7, 2026
15 checks passed
@codeling
codeling deleted the ccr-f557f83f-uk6a4f branch November 7, 2026 21:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants