Commander v6.1 File editing not possible

[rogerco]

Have I made a terrible mistake by updating to v6.1.2 on a Joomla 5.4.7 site? It was offered as a standard extension update from 6.0. but now editing any file is not working. The editor window opens but when you click Save I get a yello box at the top of the screen with the message "Save failed with the following error:" in bold white and no further text.
In the console with dev tools inspect is the following message:
==================
"editors.js?45c778:31 Direct access to Joomla.editors.instances is deprecated. Use JoomlaEditor.getActive() or JoomlaEditor.get(id) to retrieve the editor instance.
get @ editors.js?45c778:31
phSaveEdit @ phocacommander.js?45c778:92
Joomla.submitbutton @ index.php?option=com…2RlZmF1bHQucGhw:231
executeTask @ joomla-toolbar-button.js?623aee:119
==================
Save and Close gives the slightly more informative message which I can screenshot but don't seem to be able to paste here (imgur as per your documentation gives a not available in your region error (I'm in GB). The top lines are
===================:
danger
Error - this file type is not allowed
An error has occurred.
0 Call to undefined method PhocaCommanderCpControllerPhocaCommanderEdit::setError()
=====================
The call stack is
=====================
# Function Location
1 () JROOT/administrator/components/com_phocacommander/controllers/phocacommanderedit.php:313
2 PhocaCommanderCpControllerPhocaCommanderEdit->save() JROOT/libraries/src/MVC/Controller/BaseController.php:730
3 Joomla\CMS\MVC\Controller\BaseController->execute() JROOT/administrator/components/com_phocacommander/phocacommander.php:33
4 require_once() JROOT/libraries/src/Dispatcher/LegacyComponentDispatcher.php:71
5 Joomla\CMS\Dispatcher\LegacyComponentDispatcher::Joomla\CMS\Dispatcher\{closure}() JROOT/libraries/src/Dispatcher/LegacyComponentDispatcher.php:73
6 Joomla\CMS\Dispatcher\LegacyComponentDispatcher->dispatch() JROOT/libraries/src/Component/ComponentHelper.php:361
7 Joomla\CMS\Component\ComponentHelper::renderComponent() JROOT/libraries/src/Application/AdministratorApplication.php:150
8 Joomla\CMS\Application\AdministratorApplication->dispatch() JROOT/libraries/src/Application/AdministratorApplication.php:206
9 Joomla\CMS\Application\AdministratorApplication->doExecute() JROOT/libraries/src/Application/CMSApplication.php:304
10 Joomla\CMS\Application\CMSApplication->execute() JROOT/administrator/includes/app.php:58
11 require_once() JROOT/administrator/index.php:32
=======================
and the console says
=======================
POST http://j5.localhost/administrator/index ... F1bHQucGhw 500 (Internal Server Error)
=======================

Everything was working normally just before the update. I have tried turning it off and turning it on again (TIO&TIOA). The file I am trying to edit is a php one with permissions 644 - which is exactly the same as before the update and was working normally.

I have reinstalled v6.0.o over the top of 6.1.2 and all is fine again. I don't currently have a J6 site to test against but Commander 6.1.2 is broken on J5.4.7

[Jan]

Hi, Phoca Commander does not store any data, so you can easily install the previous working version on Joomla 5 and ithis is all. The only one problem could be the security, the latest Joomla 6 and Phoca Commander solves security problems. So in case you need to run old version be sure, noone other than you can use Phoca Commander on your site.

[rogerco]

Thanks Jan, v6.0.0 reinstalled and works fine. I wonder what the security problem can be. Seems to me that it has caused a problem not solved it. Commander has always be restricted to SuperUsers only on my sites since I first started using it (about J3.1).

Is there a changelog between 6.0 and 6.1 ? Doing a diff on GitHub shows "Showing with 623 additions and 10,793 deletions" which is way too much to trawl through. I find using the (newish) Joomla Changelog facility really useful for providing an easily documented and and accessed summary of key changes. By default it shows up on the extension update view so you can see it before updating and also the extension manage view, but I also show it during postflight on the install script and in a dashboard view for a component.

There are various minor enhancements to it that I implement, but the core facility is adequate and I'd urge you to consider using it. I save the changelog xml file in the GitHub repo which makes it easy to access. See https://manual.joomla.org/docs/building ... hange-log/ for details. I'd encourage all developers to use it - it is really useful!

Roger

[Jan]

See: viewtopic.php?p=187832#p187832

[rogerco]

OMG that explains it. 6.1.2 has introduced a completely new config restriction that wasn't in 6.0.0 - a box with a pre-populated list of file types that can't be edited - which includes .php .htaccess and a whole load of others. Even more annoyingly if you delete the contents of the box, save & close, and try it again, it still doesn't work because it has put the defaults back.

Editing php files to introduce tweaks and improvements to both one's own code and also to core files and 3rd party files is an essential function in Commander - without it it becomes pointless and its back to SSH and sudo.

eg I run a fairly substantially hacked version of phoca download on some sites (and never update Download there), and also some minor adjustments to core files - the overrides system allows this. That my choice and the nature of FOSS software. I take responsibility.

Commander is a really useful component, and only a fool would allow anyone other than super users to access it, and only an idiot super user would give super user privileges to someone they didn't trust to know what they were doing.

Still at least you can get rid of the editing restrictions by replacing them with the word "nada" rather than simply doing the obvious thing and deleting them without first checking the Toggle Inline Help info - which of course I didn't do as it seemed logical that deleting the contents would remove the restrictions

Perhaps you need to add a yes/no button to ignore editing restrictions as there is for "Ignore File Types Checking" and "Edit Not Writable Files". Then it would be crystal clear that file type editing restrictions were turned off, and you could turn them off temporally without loosing your careful crafted custom list of non-editable file types.

Sorry for wasting your time on a non-issue.
Roger