The marketplace

The marketplace is used to update your addons and to install those that are not on your server. It only offers the official NeoFrag Reborn addons, which the installation package already contains in full: so it is mostly for updates, and for getting back an addon you had deleted. It comes into play after installation, from the administration.

The catalogue and the archives are served from neofrag-reborn.xyz, over HTTPS; every archive is checked by its SHA-256 fingerprint when downloaded. Each release also publishes them, with the catalogue, on the releases page of the optional addons repository.

Your site receives the catalogue for its version: a site that is not up to date yet is offered the addons built for the version it runs, not those of the latest one, which might call functions its core does not have yet. And if an addon needs a newer version of NeoFrag, the marketplace window does not offer it: it tells you to update your site first.

Installing an addon

Two ways:

1. In one click from the administration

Admin → Themes & Addons → Marketplace. The window lists the available addons that are not installed; tick them and click Install — NeoFrag downloads, checks the SHA-256 fingerprint, extracts and registers the addon (and its paired widget, if any).

2. By hand (ZIP archive)

The (public) Marketplace page presents each addon on a card with a Download button. You can also download the .zip, then Admin → Themes & Addons → Add and upload the archive (the upload is validated: archives with unsafe content are refused). It is also the way for an addon you wrote yourself: zip its folder and upload it.

Updating or removing

• Update: Admin → Themes & Addons → Updates compares the installed version of each addon with the catalogue's and lists those to update; apply them in one click (download + SHA-256, files replaced, pending schema migrations applied). Otherwise, uploading a new .zip through Add also updates (a higher version replaces the old one).
• Remove: from its card's menu in Themes & Addons. A module or a widget: Uninstall — its tables, its data and its files are removed, after a backup taken just before (the backups/addons folder on the server); a module that another addon needs is refused, and the window names them. A theme: Delete (not the active theme). Core addons cannot be removed.
• Reset to zero (a module): its data is erased and it starts again as on the day it was installed; its settings, its permissions and the links that lead to it remain. A backup of its tables is taken first.

The authentication connectors (Discord, GitHub, Google) are part of the core: they are already there, to be configured in the settings — they do not go through the marketplace.

Marketplace unreachable? If the “Updates” screen shows “Marketplace unreachable”, check that your server can make outgoing HTTPS connections to neofrag-reborn.xyz. The catalogue is pinned to that origin: the list of allowed hosts is written in the code (MARKETPLACE_HOSTS, neofrag/installer.php), and the nf_marketplace_url setting, which has no administration screen, can only point to an HTTPS address on those hosts.

Security

The marketplace only downloads from a fixed origin over HTTPS (never a URL typed by the user), checks the SHA-256 of every archive against the catalogue, and refuses any booby-trapped archive (anti zip-slip: absolute paths, .., symlinks). No remote code is run when an addon is added or updated (extraction + idempotent install.sql/SQL migrations only).

For addon authors

The code of the optional addons lives in NeoFragReborn/extensions: proposing an addon or a fix means opening a pull request there. The catalogue is generated by tools/package-addons.php, which zips each addon (a <name>/ folder at the root of the archive) and produces marketplace/catalog.json. A real entry, shortened:

{
  "schema": 1, "base_version": "1.2.22",
  "addons": [{
    "type": "module", "name": "quotes", "tier": 2, "category": "contenu",
    "title": "Citations", "description": "Recueil de citations classées, avec leur auteur et leur source.",
    "i18n": { "en": { "title": "Quotes", "description": "…" } },
    "version": "1.0", "author": "NeoFrag Reborn", "license": "LGPLv3 <https://neofr.ag/license>",
    "file": "modules/quotes.zip", "preview": "modules/quotes.jpg", "size": 60556, "sha256": "…",
    "requires": { "base": ">=1.2.22", "addons": [] }, "provides_widgets": [], "install": "zip"
  }]
}

catalog.json and the .zip files are published together: the SHA-256 fingerprints are only valid for the archives of the same run. The official catalogue is published with each release, and a site cannot follow another one without changing MARKETPLACE_HOSTS. An addon you write — guides: create a module, a widget, a theme — installs on any site through Themes & Addons → Add.

Updating the core (NeoFrag itself)

Admin → Themes & Addons → Updates reports a new core version when there is one: the one announced by the update channel (Monitoring checks it), and otherwise the catalogue's base_version, the CMS version it was built for.

Two ways to apply it.

In one click from Monitoring

Admin → Monitoring → Update. The site first takes a backup, then downloads the update package, checks its fingerprint, lays the files over the old ones, applies pending migrations and recompiles the style sheets.

The button only accepts the right update, through four guarantees:

1. the origin comes from the same allow-list as the marketplace, and a value injected into the database cannot leave it;
2. version.json only provides a file name, never a URL: no host, no path, so no redirection and no directory traversal;
3. the SHA-256 fingerprint is checked before a single file of the site is touched;
4. the archive is checked entry by entry (anti zip-slip, symlinks refused).

Files already present in config/ and the install/db.txt lock are never rewritten: the configuration of a live site is preserved. The rest of install/ is product code, and follows releases.

By hand

Download neofrag-reborn-public-<version>.zip from the releases page and replace the files (except config/, upload/, backups/), then visit the site — migrations apply themselves (deployment guide).

What each release publishes

Each release publishes three files on the update origin (https://neofrag-reborn.xyz/update/) that form a consistent set: the update package, version.json (the version, the package name, its SHA-256 and its size) and checksum.json (one fingerprint per shipped file, for Monitoring's integrity check). The button checks each one against the others: publishing one without the others makes the update fail, without touching the site.