feat(update): enhance backup filename security with random hash

- Add 8-char hex hash to backup filenames for unpredictability
- Implement caching of generated filename in Update class
- Update tests to validate new filename format with regex

BREAKING CHANGE: Backup filename format changed from
phpmyfaq-config-backup.YYYY-MM-DD.zip to
phpmyfaq-config-backup.YYYY-MM-DD.XXXXXXXX.zip

Author: thorsten

phpmyfaq/src/phpMyFAQ/Setup/Update.php

@@ -29,6 +29,7 @@
 use phpMyFAQ\Forms;
 use phpMyFAQ\System;
 use phpMyFAQ\User;
+use Random\RandomException;
 use RecursiveDirectoryIterator;
 use RecursiveIteratorIterator;
 use SplFileInfo;
@@ -47,6 +48,8 @@ class Update extends AbstractSetup
     /** @var string[] */
     private array $dryRunQueries = [];
 
+    private ?string $backupFilename = null;
+
     public function __construct(
         protected System $system,
         private readonly Configuration $configuration,
@@ -72,6 +75,7 @@ public function isConfigTableNotAvailable(DatabaseDriver $databaseDriver): bool
     /**
      * Creates a backup of the current config files
      * @throws Exception
+     * @throws RandomException
      */
     public function createConfigBackup(string $configDir): string
     {
@@ -113,7 +117,7 @@ public function createConfigBackup(string $configDir): string
                 continue;
             }
 
-            // Compute relative path inside archive
+            // Compute a relative path inside the archive
             $relativePath = str_replace($configDir . DIRECTORY_SEPARATOR, '', $filePath);
             $relativePath = ltrim($relativePath, DIRECTORY_SEPARATOR);
 
@@ -1187,8 +1191,15 @@ private function updateVersion(): void
         $this->configuration->update(['main.currentVersion' => System::getVersion()]);
     }
 
+    /**
+     * @throws RandomException
+     */
     private function getBackupFilename(): string
     {
-        return sprintf('phpmyfaq-config-backup.%s.zip', date(format: 'Y-m-d'));
+        if ($this->backupFilename === null) {
+            $randomHash = bin2hex(random_bytes(4)); // 8-character hex string
+            $this->backupFilename = sprintf('phpmyfaq-config-backup.%s.%s.zip', date(format: 'Y-m-d'), $randomHash);
+        }
+        return $this->backupFilename;
     }
 }

tests/phpMyFAQ/Setup/UpdateTest.php

@@ -8,6 +8,7 @@
 use phpMyFAQ\System;
 use PHPUnit\Framework\TestCase;
 use PHPUnit\Framework\Attributes\AllowMockObjectsWithoutExpectations;
+use Random\RandomException;
 
 #[AllowMockObjectsWithoutExpectations]
 class UpdateTest extends TestCase
@@ -29,19 +30,40 @@ protected function setUp(): void
 
     /**
      * @throws Exception
+     * @throws RandomException
      */
     public function testCreateConfigBackup(): void
     {
         $this->update->setVersion('4.0.0');
         $configPath = PMF_TEST_DIR . '/content/core/config';
 
+        // Clean up any existing backup files before test
+        $existingFiles = glob($configPath . '/phpmyfaq-config-backup.*.zip');
+        foreach ($existingFiles as $file) {
+            if (file_exists($file)) {
+                unlink($file);
+            }
+        }
+
         $this->update->createConfigBackup($configPath);
 
-        $this->assertFileExists(
-            PMF_TEST_DIR . '/content/core/config/phpmyfaq-config-backup.' . date(format: 'Y-m-d') . '.zip'
+        // Find a backup file with a pattern: phpmyfaq-config-backup.YYYY-MM-DD.XXXXXXXX.zip
+        $pattern = PMF_TEST_DIR . '/content/core/config/phpmyfaq-config-backup.' . date(format: 'Y-m-d') . '.*.zip';
+        $files = glob($pattern);
+
+        $this->assertNotEmpty($files, 'Backup file should exist with random hash');
+        $this->assertCount(1, $files, 'Exactly one backup file should exist');
+
+        // Verify filename format: date.hash.zip where hash is 8 hex characters
+        $filename = basename($files[0]);
+        $this->assertMatchesRegularExpression(
+            '/^phpmyfaq-config-backup\.\d{4}-\d{2}-\d{2}\.[0-9a-f]{8}\.zip$/',
+            $filename,
+            'Backup filename should contain 8-character hexadecimal hash'
         );
 
-        unlink(PMF_TEST_DIR . '/content/core/config/phpmyfaq-config-backup.' . date(format: 'Y-m-d') . '.zip');
+        // Cleanup
+        unlink($files[0]);
     }
 
     public function testIsConfigTableNotAvailable(): void