Joomla
has announced that they are going to release a security release fixing a high priority security issue on Wednesday. Unfortunately, this will only be available for Joomla! 3.7.1. This is not goo, since Joomla! 3.7.0 was broken. Now they are giving users the choice between a broken site and a vulnerable (therefore soon to be hacked) site.
We have already stacked up with coffee, food and water to reverse engineer the issue being fixed by analyzing the fix as soon as it is released. We are going to publish a new version of Admin Tools late on Wednesday or early on Thursday which addresses that issue
even on Joomla! 3.6 (assuming it's affected). As a result I would recommend holding off upgrading Admin Tools until we release the new version.
As to how Joomla! 3.7 got out, their current system of code quality assurance (code is merged after two successful tests by any two random people) seems to be flawed. Whether these two people actually tested it, whether they have the experience to properly test it or understand its implications in third party software is anybody's guess. At a bare minimum API changes, i.e. anything not touching exclusively view templates, should be code reviewed. I understand the challenge of that (you need experienced reviewers and it's a full time job) but unless it's addressed I am afraid these major issues will keep happening.
In any case
we write software because it makes
our users' lives easier. We treat major incidents as learning experiences and an opportunity to improve our processes and safeguards. First, we are trying to catch issues in new Joomla! versions with automated testing. We already had that in Admin Tools and Akeeba Ticket System, now we're doing the same with Akeeba Backup - and extending automated testing to CLI scripts and legacy front-end backup methods, too. Moreover we are abstracting all calls to core Joomla! APIs in our code to make them go through a common platform abstraction layer. This will let work around broken Joomla! APIs in less time and with much less headache for you and for us.
Nicholas K. Dionysopoulos
Lead Developer and Director
🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!