• I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

YES I KNOW, 5.4 is in security only mode, but those sites still receive auto updates so providing them a working mechanism is in everybodies best interest.

That being said:

• the com_joomlaupdate UI checks "update readiness" via two sources:
  • 1. is the condition of the current system ok in terms of PHP version, PHP flags and DB schema
  • 2. do the requirements of the update match the current system - that essentially again PHP versions but this one also checks DB versions
• the autoupdate endpoint did only check source 1 and therefore autoupdates could have been triggered for sites that don't match the requirements.

Testing Instructions

• set up a 5.4 site with the latest version
• enable auto updates
• we need to trick Joomla into thinking that the already installed version still can be updated, we do so by commenting out the respective version number check in libraries/src/Updater/Update.php - find the line saying // Check if this target is newer than the current version and comment out the continue in the following if statement
• call the health check endpoint (/api/index.php/v1/joomlaupdate/healthcheck) using the respective updateserver token; see that update_requirement_state is true
• go edit libraries/src/Updater/ConstraintChecker.php, find the line saying // Do we have an entry for the database and below, convert the if (!$result) { into an if (true || !$result) {- that change will cause the constraint check to ALWAYS fail
• call the health check endpoint again

Actual result BEFORE applying this Pull Request

• update_requirement_state is true

Expected result AFTER applying this Pull Request

• update_requirement_state is false - which is expected as the contraints aren't met

Link to documentations

Please select:

• Documentation link for guide.joomla.org:

• No documentation changes for guide.joomla.org needed

• Pull Request link for manual.joomla.org:

• No documentation changes for manual.joomla.org needed