Security & permissions
How JoomShift protects your site: Joomla permissions, Super User rule, CSRF, media checks, dry-run safety and cleanup.
- Joomla permissions — every export, import and dry run requires the Access Administration Interface (
core.manage) permission on JoomShift. Set it under Options → Permissions or in System → Global Configuration, like any other component. - Super User accounts — only a Super User can import user accounts that would have Super User rights, or overwrite an existing Super User. Anyone else with access to JoomShift gets those accounts skipped with a warning.
- CSRF protection — every form and download link carries Joomla's session token.
- Media checks — imported media must be an allowed image type, inside the site's image folder, under 10 MB, and every path is checked so a crafted ZIP cannot write outside that folder. SVG files containing scripts or embedded content are rejected.
- Safe dry runs — a dry run runs the import inside a database transaction that is always undone, writes no media, and is refused on tables that could not be undone (MyISAM).
- Private dry-run files — the file kept for Import now is stored in Joomla's temporary folder, readable only by the person who uploaded it, and deleted after the import, on Discard, or after one hour.
- Cleanup — temporary files from exports and imports are removed automatically.