Akeeba Backup Pro für J!4 10.3.7

Bug fixes​

• [HIGH] Box, Dropbox, Google Drive, OneDrive token refresh during upload could overwrite another profile's remote storage configuration
• [HIGH] Database dumps silently lost precision on DOUBLE columns (PDO MySQL and PostgreSQL)
• [LOW] Hardening: all database queries built from filter, user-state, and request values now use bound, typed query parameters across the backend, front-end JSON API, and the Akeeba Engine
• [LOW] Hardening: assorted backend control panel actions now require an anti-CSRF token (backup filter/exclusion/inclusion editors, remote archive delete/download, Transfer Wizard, Upload, S3 import, FTP/SFTP connection tests, custom data processing API, Configuration Wizard, output directory check, hide restoration modal, dismiss upsell)
• [LOW] Hardening: the backend backup AJAX flow now uses a per-backup anti-CSRF token, immune to session token rotation during long backups
• [LOW] Hardening: the front-end and JSON API Secret Word is now compared in constant time
• [LOW] Importing a profile without selecting a file caused an error page instead of a graceful redirect
• [LOW] The backend backup AJAX endpoint did not send no-cache headers
• [MEDIUM] Backend views did not all enforce their intended ACL privilege (Schedule, Push, Statistic, Profile, and deleting backup records)
• [MEDIUM] Box reported a lapsed authorisation as an opaque HTTP 401 error
• [MEDIUM] Box, Dropbox, Google Drive, and OneDrive did not refresh an access token missing from the backup profile, failing with an opaque authorisation error
• [MEDIUM] Dropbox did not explain a missing or lapsed Download ID
• [MEDIUM] Google Drive and OneDrive did not report a rejected token refresh
• [MEDIUM] Test FTP Connection button ignored the "Use FTP over SSL (FTPS)" setting, causing spurious authentication errors against FTPS-only servers
• [MEDIUM] The Schedule page is now restricted to users allowed to edit the component's Options (it displays the front-end/JSON API secrets)
• [MEDIUM] WebDAV did not surface failed upload reason to the UI or the log file

Akeeba Backup for Joomla! 10.3.6​

Released on: 2026-06-22 04:57 CDT

This release adds a new Site Transfer Wizard feature and fixes several high-priority cloud storage issues affecting Box, Dropbox, OneDrive, and BackBlaze B2.

Site Transfer Wizard: transfer any archive on the server​

The Site Transfer Wizard can now transfer any backup archive present on your server, not just the most recent one. Previously you were forced to take a new backup if you wanted to transfer an older archive.

Cloud storage bug fixes​

Two high-priority bugs are fixed in this release:

• Box, Dropbox, and OneDrive were storing uploaded files under the local temporary filename rather than the correct archive filename. This means previously uploaded files may appear with incorrect names in your cloud storage. Files uploaded with 10.3.6 onward will use the correct names.
• BackBlaze B2 uploads failed entirely when using a bucket-restricted API key (one scoped to a specific bucket rather than the entire account).

Several medium-priority issues are also addressed: token refresh race conditions for Box, Dropbox, Google Drive, and OneDrive; an incorrect credential being validated for RackSpace CloudFiles; an access token leaking in Dropbox public download URLs; broken signed download URLs for OneDrive for Business on the Microsoft Graph API; S3 v4 pre-signed URL failures (403) on path-style non-AWS hosts; and duplicate bucket names in Google Storage pre-signed URLs (403).

Changelog​

New features​

• Site Transfer Wizard: transfer any backup archive present on the server, not just the latest one (gh-36)

Bug fixes​

• [HIGH] Box, Dropbox, OneDrive stored files under the local temp name
• [HIGH] Uploads failed when using a bucket-restricted BackBlaze B2 key
• [LOW] BackBlaze cancelUpload sent the request body as form-data, not JSON
• [LOW] BackBlaze downloadFileById used the wrong API path (404)
• [LOW] Box folder listing paginated incorrectly
• [LOW] Site Transfer Wizard: Dark mode layout issues (white-on-white in upload stats area)
• [LOW] WebDAV options() dropped capabilities from repeated DAV headers
• [MEDIUM] Box, Dropbox, Google Drive, OneDrive token refresh raced expiry
• [MEDIUM] Dropbox public download URL embedded the access token
• [MEDIUM] Google Storage pre-signed URLs duplicated the bucket name (403)
• [MEDIUM] OneDrive for Business signed download URL was broken on Graph
• [MEDIUM] RackSpace CloudFiles validated the username, not the API key
• [MEDIUM] S3 v4 pre-signed URLs failed (403) on path-style non-AWS hosts

Akeeba Backup for Joomla! 10.3.5​

Released on: 2026-06-17 19:47 CDT

This release adds translations for several languages and addresses two high-priority issues.

New translations​

We now include language files for Greek (el-GR), French (fr-FR), German (de-DE), Spanish (es-ES), Portuguese (pt-PT), and Italian (it-IT). These are machine-translated, which puts them on par with what we have historically received from community translators — but with the added benefit of being complete and consistent throughout the entire interface.

BackBlaze B2 v4 API​

If you use BackBlaze B2 for cloud storage, Akeeba Backup now uses the v4 API. No action is required on your part; your existing B2 credentials continue to work.

OVH file scanner false positive for kickstart.txt​

Some OVH-hosted sites have a broken file scanner that incorrectly flags kickstart.txt (the Kickstart documentation file included in the backup archive) as malicious. Akeeba Backup now obfuscates this file to prevent false positives on these hosts.

Changelog​

New features​

• Translations for Greek (el-GR), French (fr-FR), German (de-DE), Spanish (es-ES), Portuguese (pt-PT), and Italian (it-IT)

Bug fixes​

• [HIGH] DirectFTP would not work due to setting erroneous directory permissions
• [HIGH] The Site Transfer Wizard was not working

Miscellaneous changes​

• Obfuscate kickstart.txt so that broken file scanners (OVH) don't cause problems by misidentifying it as "malicious"
• Switched to BackBlaze B2 v4 API

This is a bugfix release.

Bug fix: PHP fatal error when loading the Site Transfer Wizard. A high-priority bug caused a PHP fatal error when attempting to open the Site Transfer Wizard page. This has been resolved.

Bug fixes

[HIGH] Site Transfer Wizard: PHP fatal error when loading the page
[MEDIUM] Fix stdClass warning when reading akeeba.quota.logfiles configuration key

New features​

• Add "Delete obsolete log files" quota feature

Bug fixes​

• [HIGH] Check Backup Uploads: TypeError (null given to method_exists) when checking for failed uploads
• [HIGH] Check file upload: SQL error on all PHP versions when checking for failed uploads
• [MEDIUM] Configuration page: saving an SFTP password containing an angle bracket (e.g. `F9`) would blank the profile description and deselect the one-click backup icon

Miscellaneous changes​

• Manage Backups: the View Log button is now disabled with a tooltip when the log file no longer exists on the server

Miscellaneous changes​

• Obfuscate the PostgreSQL dump engine EVEN MORE AGGRESSIVELY so that certain antivirus don't throw a false positive.

Miscellaneous changes​

• Obfuscate the PostgreSQL dump engine so that certain antivirus don't throw a false positive.

New features​

• PostgreSQL support

New features​

• Failed backup and failed uploads checks are now available as Joomla Scheduled Tasks

Bug fixes​

• [LOW] PHP Warning when deleting backup archives under PHP 8.4 and later versions
• [LOW] The AKWarn plugin may not work on hosts with open_basedir restrictions not allowing access to the site's root.

• [HIGH] Joomla 5.4 and 6.0: The console plugin is raising a PHP warning