Skip to content

Unsaved settings match the settings page: purge age, log level, common usernames (B4) - #254

Open
codeling wants to merge 1 commit into
ccr-c4633bb2-v97st1-upgrade-sqlfrom
ccr-c4633bb2-v97st1-defaults
Open

codeling wants to merge 1 commit into
ccr-c4633bb2-v97st1-upgrade-sqlfrom
ccr-c4633bb2-v97st1-defaults

Conversation

@codeling

@codeling codeling commented Nov 4, 2026

Copy link
Copy Markdown
Owner

Stack 4/4 for the 2.0.0 release (#250), based on #253. Review only the top commit. Merge together with codeling/com_bfstop#25, which is on the branch of the same name. CI tests the two branches together, and each fails CI without the other.

Problem

Until an administrator saves the settings, the plugin uses built-in defaults. These are meant to be what the settings page shows (DefaultSettings, and the changelog's "Settings which have not been saved yet now have the values the settings page shows"). Comparing every params->get() default with com_bfstop/admin/forms/settings.xml found three that weren't:

Setting Plugin (unsaved) Settings page Now
deleteOld 4 weeks 0 (never) 4: the first save turned purging off
logLevel disabled errors (8) 8, like 1.5.2's form and com_bfstop's LogHelper
riskCommonUsernames empty admin, administrator, root, test, webmaster the list, so those names score and aren't hashed

Change

  • The three settings are in Bfstop::DefaultSettings and the plugin reads them from there.
  • DatabaseHelper::$DEFAULT_PURGE_WEEKS is removed in favour of DefaultSettings['deleteOld'].
  • com_bfstop#25 changes the form default and the component's hints.

Tests

testUnsavedSettingsAreWhatTheSettingsPageShows compares every key of DefaultSettings with the form, so it now covers all three; it fails against com_bfstop main (deleteOld). The full suite passes locally on Joomla 5.4.10 with MySQL 8.4 and PostgreSQL 16, together with the com_bfstop branch.


Generated by Claude Code

The plugin runs with built-in defaults until an administrator saves the
settings, and these are meant to be what the settings page shows (see
DefaultSettings). Three were not:

- deleteOld: the plugin purged failed logins after 4 weeks, the settings
  page showed 0 - so the first save of the settings switched purging off,
  contrary to the changelog. The page says 4 weeks now (com_bfstop).
- logLevel: the plugin didn't log at all, the page showed "errors".
- riskCommonUsernames: the page listed admin, administrator, root, test and
  webmaster, the plugin used an empty list (no risk points, and such names
  were stored as a hash when they aren't an account).

They are in DefaultSettings now, which testUnsavedSettingsAreWhatTheSettings
PageShows compares with the settings form. DatabaseHelper::$DEFAULT_PURGE_WEEKS
is replaced by DefaultSettings['deleteOld'].

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AFJFMMUpch4LGexEiXN8Nc
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants