Security hardening: unblock confirmation, escaping, settings validation

[codeling]

What this does

The component side of a security review; the plugin side, with the full list of findings, is codeling/bfstop#231.

• Unblock link needs confirmation and the blocked IP: opening the link from the email (a GET request) only shows a confirmation button; the unblock itself is a POST and only works from the IP address the token was issued for (or, for a client blocked by its IPv6 network, from within that network). Mail security scanners and link previews that open every link in a message can no longer unblock an attacker automatically. The logic is in TokenunblockModel::process().
• Unblock page status and headers: the page answers with an error status if the link can't be used (400 without a token, 403 from another IP address, 404 for an unknown, expired or used token, 500 if unblocking failed), set with Joomla's setHeader('status', …), unless the plugin's "Use HTTP Error" setting is off (a web server or CDN replacing error pages with its own would hide the message). Opening the link (GET) stays a 200 for every token, so scanners learn nothing and don't flag the link as dead. Since the link contains a secret, the page is also never cached (allowCache(false)), sends Referrer-Policy: no-referrer and X-Robots-Tag: noindex, nofollow.
• Escaping: the log view (date, priority, message; the message can contain visitor-supplied usernames), the IP information view (request parameter and GeoIP data, including the toolbar title) and the raw log line in the "invalid entry" message are escaped.
• Subnet validation: the prefix length has to be plain digits; is_numeric() also accepted values like 1e1, which got as far as the .htaccess file.
• Settings: the .htaccess path and the GeoIP database path are validated (no stream wrappers such as phar://, a .mmdb file name; the directory has to exist if .htaccess blocking is used). Sending the test email now needs the permission to change the settings. New settings: "Usernames Not Matching an Account", "IPv6 Tracking Granularity", and two new values for "User Block Message" (the plugin's PR explains them).
• ParamHelper no longer fails if the plugin's settings can't be read. SECURITY.md added.

Things to know when reviewing

• New language strings are in en-GB and de-DE; other languages fall back to English.
• The plugin's DatabaseHelper::$UNBLOCK_TOKEN_VALID_DAYS and TokenunblockModel::TokenValidDays must stay in sync (both 3); there is a comment in each.
• Joomla's "System - Page Cache" plugin caches any guest GET page whatever its status or allowCache(); for the confirmation page that is harmless (same URL, same token, same page).
• The admin check on the test-email action is not covered by an automated test; the rest is covered by the integration tests in the plugin repository, which load this repository through COM_BFSTOP_ROOT.

Testing

The plugin's test suite (283 tests) passes with this branch as COM_BFSTOP_ROOT, including tests for the confirmation/IP-bound unblock, the escaped log view, the settings rules and the subnet validation. UnblockPageHttpTest (in the plugin repository) runs the installed Joomla site on PHP's built-in web server and checks the real status and headers of every outcome of the unblock page; it was checked to fail against the previous view.

Merge together

Needs the plugin PR (codeling/bfstop#231): it uses the plugin's IpHelper::isInSubnet() and settings. Merge both, and release them together.

🤖 Generated with Claude Code

https://claude.ai/code/session_01R3snnF5dGbTM4SazFxGY7q