Backsies: label snapshots that may contain malware (Arx)
Imported from GitHub issue El-SaMa/oma#227 by @El-SaMa.
When a site has both Arx and Backsies, Arx should mark Backsies snapshots that may contain the infection.
Why: 2026-10-15 puunhoito.fi / risumesta.fi had a live WSO webshell + htaccess-lock malware. Restoring a backup from after the infection date brings the backdoor back.
Scope
- When Arx confirms an infection (webshell, unexpected PHP in core, htaccess lock, malware finding), record the earliest evidence time (file mtime / first seen).
- Backsies snapshot list (portal +
oma.backsies_list+ staff tools) shows a small label "May contain malware (Arx)" on snapshots taken on or after that time, and "Clean (before infection)" on the newest one before it. - Restore flow warns before restoring a flagged snapshot and suggests the last clean one.
- Label clears for new snapshots once Arx marks the site clean.
- Only when both products are active on the same site.
Done = UI + customer and staff MCP fields + handbook (arx, backsies) + tests, fi/en and all portal locales.