Changelog — PrestaWard Snapshot

0.1.8

• The panel is divided into tabs (Summary, Changes, Jobs, Checks, Settings and Activity Logs) and only loads the currently open tab, so it opens more quickly in large shops. The GO ON Agency support panel has its own tab, ‘Support’, which is always the last one, and the Integrity section appears at the very end of all the tabs.
• Minimum summary: the current baseline, the latest comparison and its result, one main action and, at most, one line detailing the most important work in progress or alert (changes pending review, new or previously unaccounted-for folders requiring a new baseline, a maintenance window due to close, a cron job that has never run or is running late, backups in the web root). If there are further alerts, the line adds ‘and N more’.
• ‘Jobs’ tab: the job in progress is displayed as a card showing its stages (discover, calculate fingerprints, validate, compare or publish, attestation), file count, elapsed time, last update and who is running it (Back Office, cron or command line). A job requiring a command-line process appears in amber, with the reason stated in plain language and the exact command accompanied by a button to copy it; in the browser, there is no ‘Resume’ button.
• A 90-day job history in a single table (type, source, employee, start date, duration, status, result and notifications) with filters by type, status and dates, and pagination, instead of the previous limit of the last 20 jobs or 7 days. The result of a comparison links to the changes it found, and a kernel file check links to the Checks tab.
• Details of each job: timeline, files, maximum memory, policy hash, linked baseline and comparison, notifications with sample folders, a translated error message if it failed, and a diagnostic download. When the file details for a completed job are cleared, a summary is retained (alert counts with example folders and folders not fully covered) and the page indicates that the details have been cleared.
• Coverage by category has been moved to the end of ‘Changes’; shop checks (backups, core files, configuration audit and module health) are now grouped together under ‘Checks’; and settings for email, cron, analytics policy, maintenance window and storage are under ‘Configuration’.
• The security configuration audit now comprises 14 checks. New: PHP hardening (allow_url_include and expose_php), version control folders and environment files (.git, .svn, .hg, .env and variants) in the web root and within modules and themes, web service keys with write access to numerous resources (only the number of such files is counted; keys are never read or displayed), cookie IP checks, and inactive accounts retaining the SuperAdmin profile (these are only counted, without names or addresses). Each has an explanation and a solution, and anything that cannot be read is listed as ‘not checked’. .git, .svn and .env files in the web root are moved from the ‘installation files and copies’ check to the new one, so as not to count them twice.
• Card skimmer heuristics for JavaScript: new or modified JavaScript in the active theme and payment modules is also checked for three indicators: code that reads the card number, expiry date or security code and sends data to another website (high risk), data sent to another site from order or payment code (needs review) and heavily obfuscated code alongside order or payment code (needs review). The shops’ own URLs, payment gateways and, for weaker indicators, known analytics servers do not count as a third-party site. A match is a reason to examine the file, not proof of compromise, and a URL that the code constructs whilst running is not detected.
• Multimedia volume estimate: for each baseline and comparison, it counts, for each multimedia folder (img, upload, uploads and download), the files and bytes already processed, without accessing further files or saving data per file. ‘Checks’ displays the total per folder, the growth since the baseline and whether a limit has been exceeded. ‘Settings’ has three limits: maximum number of files, maximum size in GB and maximum growth since the baseline as a percentage (50% by default; 0 disables a limit). Any limit that has been exceeded appears in the Summary and in the alert email, which is also sent when no single file has changed enough to trigger the alert on its own.
• Visible monitoring limit: a scan reads a maximum of 250,000 names in the excluded folders, and subsequent folders were recorded as not covered but were only displayed within the job. Now, this is indicated by an alert line in the Summary and a warning in Checks showing the number of unmonitored folders, and the multimedia volume is marked as partial if it was measured below that limit.
• Fixes an issue where the connection with Integrity would fail in the Back Office within the ‘all shops’ context or when a shop other than the first one was serving the registration test: the connected shop would change to ‘registration pending’ and the test could not be signed. The installation ID is now read as a single unit from the global scope (or from the shop where it is stored) in any context; the update passes an ID stored in a shop to the global scope without regenerating it, and if it cannot be read, Integrity’s status is left as it was.
• New: shared filter bar. The change review and work history use this layout: the selectors are arranged in a grid of equal width, the search box and the ‘Filter’ button are in the same row, and secondary actions, such as exporting the audit to CSV, are right-aligned. Previously, the filters were crammed together and the buttons overlapped.
• Alert, maintenance summary and test emails display your shop’s logo in the header (with the shop name as alternative text) and a standard footer featuring the GO ON Agency logo and the signature ‘PrestaWard by GO ON Agency’, without any links or contact details. The footer logo is a file from the module itself, served from your shop.
• Corrects the issue where the subject line of emails included the shop name twice.
• Unified design of the dashboard across the four PrestaWard modules: section headers, form cards with neutral borders and standard collapsible blocks, statistics displayed on a single line, and a larger GO ON Agency logo in the header. The main button is now a solid brand colour, without a gradient.
• Fixes an issue where, in PrestaShop 9, the admin theme displayed tabs with underlines as links and section titles in capital letters. The common styles override this only within the PrestaWard panel, so PrestaShop 1.7 and 8 look the same as before.
• Fixes an issue where, in PrestaShop 1.7, the module’s stylesheet was ignored when registered with the version number in the URL. The file is now checked and registered without parameters, so that the new styling appears in versions 1.7, 8 and 9.
• Fixes an issue where, in PrestaShop 9, dashboard actions (job requests and downloading the support report, as well as synchronisation with Integrity) would check the security token using a method not supported by PrestaShop 9, which could result in them being rejected. Validation now takes place via the PrestaShop 9 service; in PrestaShop 1.7 and 8, the validation process remains unchanged.
• When the connection to Integrity cannot be updated at that moment, the panel displays a single message: the saved connection remains valid and will be retried automatically. The labels on all tabs have been translated into all nine languages.
• The product header once again displays the GO ON Agency logo and the signature ‘PrestaWard by GO ON Agency’, without any links. The baseline format, the manifest bytes and the contract with the Integrity API remain unchanged; the update adds columns (two to the jobs table and those for media volume by folder, job and baseline).

0.1.7

• It analyses suspicious code in new or modified PHP and JavaScript files (up to 512 KB each) for patterns typical of web shells and obfuscated code, and explains the result in plain language. A match means ‘check this file’, not proof of an attack; a file with no matches is not proven to be secure, and one that exceeds the limit is marked as only partially checked.
• Detects disguised images (with an incorrect header or containing PHP) in all folders: included, excluded and, subject to time and size constraints, temporary ones such as img/tmp, which the scan has not yet processed.
• Assigns a risk level to each change (high, needs review or low), which is visible and filterable in the change review and included in the audit CSV and alert emails.
• Groups module and theme updates into a single item, including the previous and new versions. The modified PHP code within a detected update is low-risk and no longer triggers alert emails. Requires a baseline created with this version.
• New core files panel: compares them against the official checksum list for your version of PrestaShop, in resumable batches. A difference does not prove an intrusion; if the list does not exist or cannot be downloaded, the panel indicates that the core has not been verified and never presents it as having passed.
• New security configuration audit with a score from 0 to 100 (debug mode, administration folder, configuration permissions, installation folders, dumps and compressed files in the web root, PHP version, HTTPS and visible PHP errors, amongst other points). Each point includes an explanation and a solution; items that cannot be checked are listed as ‘not checked’ and do not count towards the score.
• It alerts you to a cron job that has never been run and, via a separate alert, to any backup folders and module copies present in the web root.
• New installations exclude module backups and the downloads folder by default. In existing installations, these exclusions are available in the dashboard and are only applied if you enable them, which creates a new baseline.
• Maintenance window of 1 to 4 hours: silences alert emails but continues to log changes, and when it closes sends a consolidated summary with the options ‘Accept these changes’ or ‘Dismiss’. ‘Accept’ simply marks them as reviewed; Snapshot never creates a baseline on its own.
• When analysis coverage increases between versions, files in folders that were not covered by the previous baseline are reported as new coverage rather than as thousands of added files with critical alerts.
• The change review feature handles very large result sets: pagination with page navigation, summaries grouped by folder, status and risk, and pending changes from previous baselines marked as superseded.
• Reduces the time taken to create the baseline and validate directories in large shops with retained previous jobs (minutes rather than tens of minutes) and deletes the temporary rows of completed jobs in bounded batches.
• Fixes several warnings: Snapshot no longer detects its own files as high-risk changes; PrestaShop’s standard protection file index.php is no longer flagged as a suspicious executable; ‘Recent Changes’ displays the totals from the last comparison; and, after creating a baseline, the dashboard no longer displays the previous comparison as current.
• The Back Office displays ‘Processing from the console’ whilst the console process is running; refreshing the page after clicking a button no longer resubmits it, and a rejected start indicates which job is in progress. The console process outputs a brief progress message rather than one per step.
• Back Office consistency: the jobs panel and its buttons have the same appearance as the rest of the panel, and the status messages for the cron and activity log are displayed in the Back Office language across all nine languages.
• The support and diagnostics panel is positioned just before the Integrity section, as in all other PrestaWard modules, and in the ‘all shops’ context it no longer disappears: it indicates that a shop must be selected.
• The style sheets are loaded with the module version, so the new look appears after updating without clearing the browser cache.
• Synchronise with Integrity every time you open the dashboard, using a background request that never slows down the page, and no more than once per minute per shop.

0.1.6

• A symbolic link no longer interrupts the scan: it is skipped without being followed or having its fingerprint calculated (and therefore does not form part of the baseline) and is reported in the dashboard, with an alert when it points outside the shop or to a non-existent destination.
• During the scan, exclude any files that cannot be included in the manifest.
• It never scans PrestaShop’s volatile folders (img/tmp and the theme’s combined resource caches), which are constantly regenerated and could interrupt a scan with directory_changed.
• Apply the exclusions before entering each folder: excluded folders are no longer part of the integrity check and are only monitored for executable files in a separate pass that never halts the process and is limited to 250,000 filenames per job.
• It re-reads an included folder that changes during the analysis up to three times. If it continues to change, the core, configuration, administration, payment gateway modules and active theme folders halt the job as before; the rest are skipped with a warning and the job ends.
• The cron job processes several consecutive batches per call (up to around 20 seconds) and reports the status cli_required with an HTTP 409 response when a job requires the command-line process. A monitoring tool that treats any response other than a 2xx as a failure will flag this, as is to be expected. This process is run manually by the server administrator: the module never initiates it on its own.
• Strengthens the lock that prevents simultaneous cron runs, even if the first two runs coincide.
• Moves the temporary manifest files to a private directory within the shop, compatible with open_basedir and with the system’s temporary directory clean-up. In Nginx, it is advisable to block access to var/prestaward-snapshot/.
• Detects tables that do not use InnoDB, displays a clear message in all nine languages and converts the module’s tables upon updating, logging each conversion.
• Adds a read-only status check panel in the Back Office: private staging folder, database storage engine, cron frequency and jobs awaiting processing via the command line.
• Corrects the totals in the jobs report: links are counted separately from excluded files.
• Each module is analysed only once, either within the payments scope or the modules scope, so that a module which is not a payment gateway and changes during the analysis no longer halts the job.
• If a job cannot fully cover a folder, the snapshot is shown as having partial coverage and the comparison marks the files in those folders as ‘unverified’ rather than ‘deleted’.
• The jobs panel shows the folders affected by each type of alert and what to do, in all nine languages. Uninstallation also removes the jobs tables.
• PrestaShop 9: the command-line process and cron no longer fail due to confusion between the core’s ‘admin-api’ folder and that of the Back Office.
• When the command-line process fails, it ends with a diagnostic line containing a fixed reason code, without paths or internal messages.
• Reduces the cost of analysis in shops with a large number of files.
• PHP 7.1 and 7.2: Integrity’s registration, attestation and heartbeat are no longer halted by a syntax error.
• Fixes the update from version 0.1.5 when the snapshots table is missing.
• Tested in-house on PrestaShop 1.7, 8 and 9, including a test with 300,000 files that change during the analysis.

0.1.5

• Resets automatic Integrity attestation retries, pending heartbeats and retention following asynchronous cron responses. Maintenance is carried out in limited batches and is coordinated separately from scan progress.
• If a previous baseline included several administration folders, the next comparison may show additional entries: check the differences and create a new baseline where appropriate, without automatically deleting the previous one.
• Allows valid filenames containing consecutive full stops and maintains Protection against insecure paths.
• Retains all files in the additional administration folders without confusing them with those in the active Back Office.
• Saves the progress of baselines and comparisons so that you can continue after closing the panel or cancelling a request.
• Processes and verifies files in batches; results are only displayed once the job is complete, and the last valid baseline is retained if the job is cancelled or fails.
• Corrects the comparison of administration files against previous baselines and retains the exclusions for unchecked folders.
• Adds a downloadable diagnostic report to be manually attached to a support request, without automatically sending any data. It is only downloaded by an employee with editing permissions and with a selected shop, and does not include paths, file contents or credentials.
• Completes the dashboard statuses, notifications and alert templates in nine languages.
• Retains the registration and update fixes from version 0.1.4.

0.1.4

• Corrects Integrity registration errors in PrestaShop 9 and preserves the existing registration when updating shops that are not multi-shop.
• Resets automatic registration retries and logs the actual cause of the failures.
• Updates the standard Back Office design and adds information on data processing.
• Adjusts number and duration formats to the administrator’s language and translates the dashboard statuses and labels.
• Corrects the version number of the installed version during the update.
• Prepares the AFL-3.0 package for Addons: removes the update checker and calculates the identity from the installed files.

0.1.3

• Security patch: the scan now covers the entire PrestaShop installation, including the folders override, src, vendor, upload, download, img, js and the files in the root directory.
• Security patch: files with security implications are always monitored, regardless of their file extension.
• Security patch: strengthens the verification of remote attestations and stops automatic retries when the shop’s registration key changes.

0.1.2

• Automatic heartbeat without cron, triggered non-blockingly by the shop’s normal traffic.
• The browser request remains within the same domain and Integrity credentials are used solely on the server.
• Per-shop locking, a six-hour interval and a delay following failures to prevent duplicates.
• Manual synchronisation with Integrity also updates the installation’s presence.

0.1.1

• Integrity heartbeat and cron health monitoring.
• Secure incremental hashing with periodic full checks and critical areas always recalculated.
• Classification of routine, suspicious and critical changes.
• Filters, pagination, review with notes and CSV export of audit reports.
• Metadata diff without stored content and retention with protected cleanup.
• Dashboard visually aligned with the PrestaWard ecosystem.

0.1.0

• Automatic, non-blocking registration in the PrestaWard Integrity API.
• Local queue with retries to attest each manifest without sending files or content.
• Remote receipts signed, chained and verified within the shop.
• Connection and delivery status visible from the Dashboard.

0.0.9

• Contextual help links from the configuration fields to the public guide.
• Public guide reorganised by objective and field, with a practical explanation of each setting.
• The redundant display of the update source has been removed from the settings.

0.0.8

• Configurable exclusions by exact name and relative path, with an immutable policy and SHA-256 hash.
• Mandatory preview before activating a policy and creating its new baseline.
• Blocking comparisons between different policies.
• Non-configurable monitoring of executables and configuration files within excluded zones.
• Limited detection of PHP headers and dangerous interpreters in files with misleading extensions.
• Fully tested on PrestaShop 1.7, 8 and 9, including a mixed test with 100,000 files.

0.0.7

• The full product and technical module identity has been renamed to PrestaWard Snapshot.
• Initial access restricted to the administrator profile.
• Explicit authorisation of additional profiles using PrestaShop’s native permissions.
• Read separation, snapshot creation and configuration using READ, CREATE and UPDATE permissions.
• Hiding of settings, cron tokens and sensitive actions for read-only profiles.
• Clarification to the documentation: the module monitors integrity, but does not store or restore backups.

0.0.6

• Product, guide, supplier and support links remain intact after a clean installation.
• Metadata update from the public manifest.
• GO ON Agency logos linked in the Back Office and emails.
• Alternative URL visible in HTML and plain text emails.
• Test email action and reproducible release tooling.

0.0.5

• Legacy controller autoload fixed.
• Access moved to the PrestaWard Snapshot root section.

0.0.4

• Clickable Back Office menu.
• Full validation of the clean installation and uninstallation cycle.

0.0.3

• Explicit multi-shop context.
• Support for dynamic properties in PHP 8.5.

0.0.2

• Authorisation roles and explicit access permissions.

0.0.1

• Baseline, comparison, alerts, cron, logs, update checks and initial dashboard.