StageIt for Joomla 4 & 3 ChangeLog

StageIt for Joomla 4

v4.2.2 4th November 2026

• Security: Restoring a backup copied the backup's database file (sql.sql.gz) into your site's main folder and left it there, so anyone who requested /sql.sql.gz could download your whole database, including user email addresses and password hashes. A restore no longer copies it, and installing this version deletes any copy a restore left in your site's main folder or in stageit/ and tells you when it does. Only StageIt's own database backup is deleted. If a copy is deleted on your site, someone may have downloaded it, so think about asking your users to change their passwords.
• Security: A staging site runs its own copy of StageIt from the day it was built, and the Restore and Push buttons on it use that copy. So installing this version also updates StageIt's files on an existing staging site, leaving its settings and log as they are. Otherwise an older staging site could still put the database in the public folder on a restore, or copy an older StageIt back over your live site on a push. A staging site on a newer version is left alone. If some files can't be updated, or the staging site runs a different line of StageIt (for example while you rehearse a move to Joomla 6), StageIt tells you, and you should update or rebuild the staging site before you restore a backup or push from it.
• Security: When part of a restore failed, StageIt wrote the whole database statement to its log file, which can include user email addresses and password hashes. It now logs only the table's name and the statement's size.
• Fixed: Restoring a backup failed part-way, leaving the live site half restored, on sites whose extensions link their tables with foreign keys ("Cannot delete or update a parent row: a foreign key constraint fails").
• Fixed: Building and pushing a stage removed those links from the staging tables, and from live tables changed on the staging site. They are now copied. A push from a staging site built with an earlier version keeps the live site's links.
• Fixed: StageIt turned the database's foreign key checks off instead of back on after copying a table.
• Fixed: A failed database read no longer stops StageIt with "Call to undefined method getErrorMsg()".

v4.2.1 29th October 2026

• Security: Every StageIt action (build, push to live, remove, restore, delete a backup) now needs a valid form token, so a link or page on another site can't run it while you're logged in.
• Security: Deleting or restoring a backup now only works on StageIt's own backup folders.
• Security: Fixed two cross-site scripting holes: the switch link in the StageIt bar, and the tab name in StageIt's admin address.
• Security: New backup folders get a random name, a blank index page, and an access rule that also works on Apache 2.4.
• Security: The folder list on the Configuration page stays inside your site.
• Fixed: A user without access to StageIt now gets Joomla's normal "not authorised" message instead of an error page.

v4.2.0 29th October 2026

• Added: One-click updates with your PHP Web Design membership email (Components > StageIt > Updates).
• Changed: Updates now come from the new php-web-design.com update server. The old update server entry is removed.
• Removed: The unused License ID field and the sample license expiry line.
• Fixed: An old StageIt version number left behind by an earlier install is now updated, so site scanners such as mySites.guru show the version you really have.
• Security: Configuration is now saved only with a valid form token, and saved settings can no longer break out of the params file.

v4.1.6 23rd October 2025

• Fixed: Correct log_path handling when creating staging site (now uses /stageit/administrator/logs).
• Note: tmp_path already correctly targets /stageit/administrator/tmp.

v4.1.4 25th September 2023

• Fixed bug with building config on slow filesystems

v4.1.5 26th September 2023

• Auto Clear Cache

v4.1.3 18th September 2023

• Fixed a bug with strict MySql queries
• Fixed a bug with NULL values in tables
• Added new J!4 core folders to compatibilty list

v4.1.2 15th September 2023

• Improved error reporting

v4.1.1 15th May 2023

• Minor fixes

v4.1.0 21-03-2023

• Joomla 4.x compatbiility improved
• Plugin position changed slightly

v4.0.3 09-11-2022

• Additional Akeeba compatibility

v4.0.2.1 13-10-2021

• Added backwards compatibility for older versions of Joomla 3.x

v4.0.2 01-10-2021

• Improved speed for removing backups

v4.0.1 01-09-2021

• Minor bug fix with checking POST size

v4.0.0 19-08-2021

• Fully compatible with Joomla 4.0.0 stable

v2.1.12 04-09-2020

• Fixed issue with ACL

v2.1.11 04-01-2018

• Fixed bug with excluding directories from initial deployment

v2.1.10 12-12-2018

• Improved speed and memory usage

v2.1.8 04-12-2018

• Refined the Remove Staging function with better feedback and functionality

v2.1.8 04-12-2018

• Refined the Remove Staging function with better feedback and functionality

v2.1.7 29-11-2018

• Added RecursiveDirectoryIterator for faster, more reliable file search

v2.1.6 27-11-2018

• Added fix for where glob() function is not available

v2.1.5 28-05-2018

• Added error logging where database tables can not be read for various reasons

v2.1.4 28-05-2018

• Fixed a bug where part of Staging deployment was skipped

v2.1.3 22-05-2018

• Added user access permissions so you can define which user groups can use StageIt

v2.1.2 25-04-2018

• Added further feedback during deployment phase

v2.1.1 20-04-2018

• Fixed a minor bug

StageIt for Joomla 3

v2.2.2 4th November 2026

• Security: Restoring a backup copied the backup's database file (sql.sql.gz) into your site's main folder and left it there, so anyone who requested /sql.sql.gz could download your whole database, including user email addresses and password hashes. A restore no longer copies it, and installing this version deletes any copy a restore left in your site's main folder or in stageit/ and tells you when it does. Only StageIt's own database backup is deleted. If a copy is deleted on your site, someone may have downloaded it, so think about asking your users to change their passwords.
• Security: A staging site runs its own copy of StageIt from the day it was built, and the Restore and Push buttons on it use that copy. So installing this version also updates StageIt's files on an existing staging site, leaving its settings and log as they are. Otherwise an older staging site could still put the database in the public folder on a restore, or copy an older StageIt back over your live site on a push. A staging site on a newer version is left alone. If some files can't be updated, or the staging site runs a different line of StageIt (for example while you rehearse a move to Joomla 6), StageIt tells you, and you should update or rebuild the staging site before you restore a backup or push from it.
• Security: When part of a restore failed, StageIt wrote the whole database statement to its log file, which can include user email addresses and password hashes. It now logs only the table's name and the statement's size.
• Fixed: Restoring a backup failed part-way, leaving the live site half restored, on sites whose extensions link their tables with foreign keys ("Cannot delete or update a parent row: a foreign key constraint fails").
• Fixed: Building and pushing a stage removed those links from the staging tables, and from live tables changed on the staging site. They are now copied. A push from a staging site built with an earlier version keeps the live site's links.
• Fixed: StageIt turned the database's foreign key checks off instead of back on after copying a table.
• Fixed: A failed database read no longer stops StageIt with "Call to undefined method getErrorMsg()".

v2.2.1 29th October 2026

• Security: Every StageIt action (build, push to live, remove, restore, delete a backup) now needs a valid form token, so a link or page on another site can't run it while you're logged in.
• Security: Deleting or restoring a backup now only works on StageIt's own backup folders.
• Security: Fixed two cross-site scripting holes: the switch link in the StageIt bar, and the tab name in StageIt's admin address.
• Security: New backup folders get a random name, a blank index page, and an access rule that also works on Apache 2.4.
• Security: The folder list on the Configuration page stays inside your site.
• Fixed: Restoring a backup could take hours on a normal-sized site. It now maps the backup folder by folder, as StageIt 4 does.

v2.2.0 29th October 2026

• Added: One-click updates with your PHP Web Design membership email (Components > StageIt > Updates).
• Added: StageIt now has an update server, so Joomla can tell you when a new version is out.
• Fixed: An old StageIt version number left behind by an earlier install is now updated, so site scanners such as mySites.guru show the version you really have.
• Security: Saved settings can no longer break out of the params file.

v2.1.12 04-09-2020

• Fixed issue with ACL

v2.1.11 04-01-2018

• Fixed bug with excluding directories from initial deployment

v2.1.10 12-12-2018

• Improved speed and memory usage

v2.1.8 04-12-2018

• Refined the Remove Staging function with better feedback and functionality

v2.1.8 04-12-2018

• Refined the Remove Staging function with better feedback and functionality

v2.1.7 29-11-2018

• Added RecursiveDirectoryIterator for faster, more reliable file search

v2.1.6 27-11-2018

• Added fix for where glob() function is not available

v2.1.5 28-05-2018

• Added error logging where database tables can not be read for various reasons

v2.1.4 28-05-2018

• Fixed a bug where part of Staging deployment was skipped

v2.1.3 22-05-2018

• Added user access permissions so you can define which user groups can use StageIt

v2.1.2 25-04-2018

• Added further feedback during deployment phase

v2.1.1 20-04-2018

• Fixed a minor bug