Pull Request resolves # .

• I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

The test can not rename to malicious file in tests/System/integration/administrator/components/com_media/Media.cy.js checks that powered.php wasn't created with cy.readFile('images/powered.php'). cy.readFile resolves relative paths against the Cypress project root, i.e. the git checkout, not the Joomla site under test. In CI the site is /tests/www/<test group> (cmsPath), so the assertion could never fail there.

This PR uses ${Cypress.expose('cmsPath')}/images/powered.php, as the config_setParameter command and the fs tasks do already. Locally, with the default cmsPath: '.', nothing changes.

Testing Instructions

npx cypress run --spec 'tests/System/integration/install/Installation.cy.js,tests/System/integration/administrator/components/com_media/Media.cy.js'

To check that the assertion now works: with cmsPath pointing to a separate site folder (like in CI), create images/powered.php in that site. The old assertion still passes, the new one fails.

Actual result BEFORE applying this Pull Request

In CI the assertion checks the checkout instead of the test site, so it always passes.

Expected result AFTER applying this Pull Request

The assertion checks the site under test. The test passes.

Tested locally in the joomlaprojects/docker-images:cypress8.5 image (PHP 8.5) with MySQL 8.4 and Chrome. The negative check above was run as well: the old path didn't see the file, the new one did.

Link to documentations

Please select:

• Documentation link for guide.joomla.org:

• No documentation changes for guide.joomla.org needed

• Pull Request link for manual.joomla.org:

• No documentation changes for manual.joomla.org needed