feat(settings): introduce UpdateService library with rollback management

- Add UpdateService library centralizing GitHub API version check,
  atomic file patching, and automated backup/rollback operations
- Refactor checkVersion, downloadPatch, and autoUpdate controller
  methods to delegate logic to UpdateService
- Add listBackups and rollbackUpdate endpoints with SweetAlert2 UI
- Add concurrency control via ci4ms_update.lock
- Add 12 new i18n keys for backup/rollback features across all 11 supported languages
- Acknowledge dapickle in Security Hall of Fame
- Bump version to 0.31.7.0

Author: bertugfahriozer

CHANGELOG.md

@@ -4,13 +4,31 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html) conventions adapted to the existing four-component version numbers.
 
+## [0.31.7.0] - 2026-04-17
+
+### Added
+
+- **UpdateService Library:** Introduced a comprehensive `UpdateService` library (`modules/Settings/Libraries/UpdateService.php`) to centralize all update logic. Features include GitHub Releases API integration (via `releases/latest`), atomic file writing with `rename()`, automatic backup of modified files, concurrency control via `ci4ms_update.lock`, and pagination-aware file comparison (bypassing GitHub's 300-file API limit).
+- **Rollback Management:** Added `listBackups()` and `rollbackUpdate()` endpoints with a SweetAlert2-based interactive UI for browsing and restoring system backups from the Settings dashboard.
+- **Security Advisory:** Added `security-advisory.md` documenting the authenticated RCE vulnerability via theme upload (GHSA-fw49-9xq4-gmx6).
+
+### Changed
+
+- **Settings Controller:** Refactored `checkVersion()`, `downloadPatch()`, and `autoUpdate()` methods to delegate all logic to the new `UpdateService` library, reducing controller complexity and improving testability.
+- **Setup Command:** Updated version reference in `Ci4msSetup.php` to `0.31.7.0`.
+- **Settings Routes:** Added new `listBackups` and `rollbackUpdate` POST routes under the `backend/settings` group.
+- **Settings UI:** Added "Backups" button to the settings header and integrated rollback confirmation workflow with progress feedback.
+- **Localization:** Added 12 new translation keys for backup and rollback features across English and Turkish language files.
+
 ## [0.31.6.0] - 2026-04-15
 
 ### Added
 
-- **Automatic Update:** Introduced a new "One-Click Update" (Auto-Update) system in the Settings module. Features include automated GitHub version discovery, secure file-by-file patching, and automatic database migration.
-- **Backup Support:** Updates now automatically trigger a full backup of modified files before applying patches.
-- **Refactored DevGate:** Improved the integration of developer access credentials during the setup process with a more robust and modular logic.
+- **Automatic Update:** Introduced a comprehensive `UpdateService` library in the Settings module. Features include automated GitHub version discovery via `releases/latest` endpoint, secure file-by-file patching (bypassing 300-file API limits), and automatic database migration support.
+- **Atomic Operations:** Implemented atomic file writing using temporary storage and `rename()` to prevent partial updates.
+- **Backup & Rollback:** Integrated an automatic backup mechanism that captures modified files before patching, with a new manual rollback management interface in the Settings dashboard.
+- **Concurrency Control:** Added `ci4ms_update.lock` to prevent concurrent update attempts.
+- **Update UI:** Modernized the version check and update workflow with an interactive SweetAlert2-based interface and detailed progress feedback.
 
 ### Changed
 
@@ -268,6 +286,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 
 - Expanded database migrations and introduced new supporting libraries.
 
+[0.31.7.0]: https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.7.0
 [0.31.6.0]: https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.6.0
 [0.31.5.0]: https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.5.0
 [0.31.4.0]: https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.4.0

README.md

@@ -11,7 +11,8 @@ CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo
 - **Modular backend:** Each feature ships as an independent module (Blog, Pages, Menu, Media, Users, Settings, Theme, etc.) under `modules/*`.
 - **Flexible content management:** Page and blog entries include SEO metadata, categories, tags, and full comment workflows.
 - **Media & files:** Includes elFinder-powered media management, a built-in file editor, and an in-panel log viewer.
-- **Automatic Updates:** New "One-Click Update" system allows seamless system upgrades with automatic backups and migration support.
+- **Automatic Updates:** Modernized `UpdateService` provides a "One-Click Update" system with atomic file operations, automated GitHub version discovery (bypassing 300-file limits), and secure rollback management.
+- **Backup Support:** Updates automatically trigger a full backup of modified files before applying patches, with a dedicated management interface for restores.
 - **Theme system:** The `public/templates/*` structure and the `Modules\Theme` module enable installing or upgrading themes from ZIP packages.
 - **Setup & automation:** Offers a web-based installer (`/install`) plus a single CLI command (`php spark ci4ms:setup`) for automated installation, default data seeding, and route generation. Module scaffolding is available via `php spark make:module`.
 - **Docker support:** Ships with a production-ready `Dockerfile`, `docker-compose.yml`, and a GitHub Actions CI workflow out of the box.
@@ -200,5 +201,6 @@ A huge thank you to the security researchers who have helped make **ci4ms** more
 | **[offset](https://github.com/offset)** | Identified Critical vulnerabilities including multiple Stored XSS, Authorization Bypass in Fileeditor, Install Guard Bypass, and CRLF Injection. | Apr 2026 |
 | **[fg0x0](https://github.com/fg0x0)** | Identified Critical Arbitrary File Write (Zip Slip RCE) vulnerabilities in Theme::upload and Backup::restore modules. | Apr 2026 |
 | **[0xAlchemist](https://github.com/bugmithlegend)** , **[peeefour](https://github.com/peeefour)** and **[DexterHK](https://github.com/DexterHK)** | Identified Critical Full Account Takeover and Privilege Escalation via Stored DOM Blind XSS in Backup Management (v2). | Apr 2026 |
+| **[dapickle](https://github.com/dapickle)** | Identified Critical Authenticated Remote Code Execution (RCE) via unrestricted PHP file upload in Theme installation | Apr 2026 |
 
 > If you find a security vulnerability, please report it via [Security Policy](SECURITY.md).

modules/Backend/Commands/Ci4msSetup.php

@@ -218,7 +218,7 @@ public function run(array $params)
             'app.supportedLocales'               => '["ar","de","en","es","fr","hi","ja","pt","ru","tr","zh"]',
             'app.negotiateLocale'                => 'true',
             'app.appTimezone'                    => '\'Europe/Istanbul\'',
-            'app.version'                        => '0.31.5.0',
+            'app.version'                        => '0.31.7.0',
         ];
 
         if (!$this->updateEnvSettings($updates)) {

modules/Install/Controllers/Install.php

@@ -66,7 +66,7 @@ public function index()
                 'app.supportedLocales' => '["ar","de","en","es","fr","hi","ja","pt","ru","tr","zh"]',
                 'app.negotiateLocale' => 'true',
                 'app.appTimezone' => '\'Europe/Istanbul\'',
-                'app.version' => '0.31.6.0'
+                'app.version' => '0.31.7.0'
             ];
             if ($this->copyEnvFile() && $this->updateEnvSettings($updates)) $this->generateEncryptionKey();
 
@@ -186,7 +186,7 @@ public function dbsetup()
 
     /**
      * Updates DevGate configuration with the initial admin credentials.
-     * 
+     *
      * @param string $username
      * @param string $password
      * @return bool

modules/Settings/Config/Routes.php

@@ -15,4 +15,6 @@
     $routes->post('saveLanguageMode', 'Settings::saveLanguageMode', ['as' => 'saveLanguageMode','role'=>'update']);
     $routes->post('downloadPatch', 'Settings::downloadPatch', ['as' => 'downloadPatch','role'=>'update']);
     $routes->post('autoUpdate', 'Settings::autoUpdate', ['as' => 'autoUpdate','role'=>'update']);
+    $routes->post('listBackups', 'Settings::listBackups', ['as' => 'listBackups','role'=>'update']);
+    $routes->post('rollbackUpdate', 'Settings::rollbackUpdate', ['as' => 'rollbackUpdate','role'=>'update']);
 });