chore(submodule): bump lib_cwmscripture to v1.1.5 - #11
Closed
bcordis wants to merge 1 commit into
Closed
Conversation
Moves the nested library from 3babb2a (v1.1.4-14) to v1.1.5 (db35140), which contains the fix removing the DROP TABLE statements from sql/uninstall.mysql.utf8.sql (Joomla-Bible-Study/lib_cwmscripture#18). Until this pointer moves, pkg_cwmscripture ships the pre-fix library and reinstalls the old manifest and the old destructive uninstall SQL onto every site it touches — re-arming the very failure the package's disarmLegacyScriptureUninstallSql() preflight exists to defuse. That re-arming was observed directly in run 3 of Joomla-Bible-Study/lib_cwmscripture#17. The preflight disarm is still required and must stay: it protects the upgrade *from* a pre-fix install, which a fixed library cannot do — the uninstall SQL that runs during an update is the one already on disk. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
bcordis
added a commit
that referenced
this pull request
Jul 29, 2026
… bump the library
Reconciles the package work that was split across two checkouts and adds
the missing piece that made plg_system_cwmscripture inert.
Brings in from the working branch:
- build/script.install.php — blanks the installed library's legacy
uninstall SQL in preflight, before the library child installs, plus
dropScriptureTablesIfLastConsumer() which asks the library's
ConsumerRegistry whether anything outside this package still uses the
shared tables before removing them
- <scriptfile> and blockChildUninstall in build/pkg_cwmscripture.xml
- package.installer and script.install.php in cwm-build.config.json
- the CLAUDE.md note explaining why the preflight disarm exists
Adds enablePlugin('cwmscripture', 'system') to postflight. Joomla installs
plugins disabled, and a disabled plg_system_cwmscripture never fires — its
whole job is to disarm the legacy SQL before an admin runs a library-only
update, so shipping it off by default would leave the protection absent on
exactly the sites least recently touched, which are the ones most likely
to still carry a destructive 1.1.4 library. It only flips a plugin that is
currently disabled, so an admin who deliberately turned it off is not
overridden on the next update.
Bumps the nested libraries/lib_cwmscripture pointer from 3babb2a
(v1.1.4-14) to v1.1.6, which carries the manifest with no <uninstall><sql>
at all, ConsumerRegistry, and the uninstall dependency guard. Until this
moved, the package shipped a pre-fix library and re-armed the destructive
SQL on every site it touched. Supersedes PR #11, which targeted v1.1.5.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Member
Author
|
Superseded by #13, which bumps the nested v1.1.5 predates the work that matters here: it still declares Bumping to v1.1.5 first would have left the package shipping a library without the API its own install script calls. |
bcordis
added a commit
that referenced
this pull request
Jul 30, 2026
…y bump to v1.1.6 (#13) * feat(plugin): add plg_system_cwmscripture to protect downloaded Bibles lib_cwmscripture up to 1.1.4 declared <uninstall><sql> pointing at DROP TABLE statements, and Joomla's LibraryAdapter uninstalls the installed library before writing the new one — so that SQL ran on every UPDATE and destroyed every locally downloaded translation. 1.1.6 removed the block, but that only protects the upgrade *after* this one: the uninstall SQL Joomla executes during an update is the one already in JPATH_LIBRARIES, belonging to the installed version. A site on 1.1.4 is still destroyed by the very update that fixes it. Nothing inside the incoming package can prevent that. InstallerAdapter::install() calls checkExtensionInFilesystem() — which triggers the old library's uninstall — before triggerManifestScript( 'preflight') loads the new script file. By the time any incoming code runs the tables are gone. Verified against Joomla 5.4.7. The only remaining place to intervene is code already resident on the site, running before the installer. plg_system_proclaim does this for Proclaim sites; the library carries its own update server and is listed separately in the Update Manager, so a library-only update runs no package code at all. This plugin covers the stacks that ship the library without Proclaim — Living Word, and any third-party consumer. It blanks the file on onAfterRoute while the admin is on com_installer, before they click Update. Detection distinguishes executable statements from mentions inside -- comments, so the already-disarmed 1.1.5 and 1.1.6 files (which describe the problem in prose) are left alone; checked against all three released versions. The file is rewritten rather than deleted: an older manifest still references it by path and parseSQLFiles() resolves it against the installed extension root. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(package): wire the install script, enable the protection plugin, bump the library Reconciles the package work that was split across two checkouts and adds the missing piece that made plg_system_cwmscripture inert. Brings in from the working branch: - build/script.install.php — blanks the installed library's legacy uninstall SQL in preflight, before the library child installs, plus dropScriptureTablesIfLastConsumer() which asks the library's ConsumerRegistry whether anything outside this package still uses the shared tables before removing them - <scriptfile> and blockChildUninstall in build/pkg_cwmscripture.xml - package.installer and script.install.php in cwm-build.config.json - the CLAUDE.md note explaining why the preflight disarm exists Adds enablePlugin('cwmscripture', 'system') to postflight. Joomla installs plugins disabled, and a disabled plg_system_cwmscripture never fires — its whole job is to disarm the legacy SQL before an admin runs a library-only update, so shipping it off by default would leave the protection absent on exactly the sites least recently touched, which are the ones most likely to still carry a destructive 1.1.4 library. It only flips a plugin that is currently disabled, so an admin who deliberately turned it off is not overridden on the next update. Bumps the nested libraries/lib_cwmscripture pointer from 3babb2a (v1.1.4-14) to v1.1.6, which carries the manifest with no <uninstall><sql> at all, ConsumerRegistry, and the uninstall dependency guard. Until this moved, the package shipped a pre-fix library and re-armed the destructive SQL on every site it touched. Supersedes PR #11, which targeted v1.1.5. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * test(plugin): cover the disarm detection in plg_system_cwmscripture Extracts the armed/not-armed decision into a pure, public Cwmscripture::sqlIsArmed() so it can be tested without a real JPATH_LIBRARIES path, and covers it. The subtle case is the one the naive check gets wrong: the already- disarmed 1.1.5 and 1.1.6 files describe the old behaviour in prose, so they contain the words "DROP TABLE" inside comments. A substring search flags them as dangerous and rewrites files that are perfectly fine. Tests pin both directions plus lowercase, indentation, CRLF endings, an unrelated DELETE, and a live statement appended below the reassuring comment block. Registers the plugin namespace for autoloading and adds its src to the phpunit source set. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(installer): register both plugins as scripture library consumers Joomla tracks no dependencies between extensions, so lib_cwmscripture cannot discover who relies on it. Both plugins were protected only by the library's hardcoded FIRST_PARTY list, which exists as a fallback for versions predating the registry API rather than as the intended mechanism. Registering means the library refuses to be uninstalled while either plugin is installed, and the shared #__bsms_bible_* tables are not dropped while they still read them. Uses the library's own entry point (new in 1.1.7), so each plugin needs four lines rather than the ~50 that hand-rolled autoloading, guards and error handling would take. The group is passed explicitly: it is part of the registry's unique key, and a plugin registered without it never matches on lookup. Closes #12 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ti98Cc63bmWcXva2G4GdNq * chore(submodule): bump lib_cwmscripture to v1.1.7 v1.1.7 adds src/consumer.php, the entry point both plugins' install scripts call to register themselves as consumers (#12). Until this pointer moved, the package shipped a library without it: the is_file() guard meant those calls no-opped silently, so neither plugin actually registered and both stayed covered only by the library's hardcoded FIRST_PARTY fallback. Also brings ConsumerScanner, so an extension that never registers is still detected by its references to the library namespace. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ti98Cc63bmWcXva2G4GdNq * chore(submodule): bump lib_cwmscripture to main (#27) Picks up the library's verifyMediaSources config, so building this package also runs the stale-artifact check on the library rather than trusting whatever sits in its media/ directory. lib_cwmscripture#25 is the case that check exists for, and this package is one of the two that bundles the library. No change to what ships. The previous pointer was already v1.1.7, so the bundled library carried src/consumer.php and ConsumerScanner before this; the library's cwm-build.config.json and composer.json are build-time only and are not in the manifest's <files>. Verified: the rebuilt pkg_cwmscripture assembles with all four children and the bundled lib_cwmscripture.zip is 89 files either way. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ti98Cc63bmWcXva2G4GdNq * style: add the missing trailing newline that failed CI php-cs-fixer (single_blank_line_at_eof) failed the PR with exit 8, which skipped the PHPUnit, build and verify steps behind it. Nothing else in the file changes. Slightly pointed: the file it landed in is the one asserting a disarmed SQL file is still recognised, and its own final line was missing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ti98Cc63bmWcXva2G4GdNq --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Moves the nested
libraries/lib_cwmscripturepointer from3babb2a(v1.1.4-14) to v1.1.5 (db35140).v1.1.5 contains Joomla-Bible-Study/lib_cwmscripture#18, which removes the three
DROP TABLEstatements fromsql/uninstall.mysql.utf8.sql.Why this matters
Until this pointer moves,
pkg_cwmscriptureships the pre-fix library. Installing the package reinstalls the old manifest (with<uninstall><sql>) and the old destructive SQL file onto the site — re-arming the exact failure the package'sdisarmLegacyScriptureUninstallSql()preflight exists to defuse.That re-arming was observed directly in run 3 of Joomla-Bible-Study/lib_cwmscripture#17: immediately after a successful package install, the on-disk uninstall SQL was destructive again.
The disarm preflight still has to stay
This bump does not make the preflight redundant. A fixed library cannot protect an upgrade from a pre-fix install, because the uninstall SQL that executes during an update is the one already on disk — proven by run 2's negative control, where removing the disarm destroyed the probe translation and all 5 probe verses.
The bump stops the package re-arming sites going forward. The preflight protects sites that are already armed. Both are needed until no pre-fix installs remain in the wild.
Scope
Submodule pointer only — one line. No other files.
🤖 Generated with Claude Code