Release 0.4.7

Bump the version and add 0.4.7 to the compatibility matrix.

.gitattributes

@@ -9,3 +9,4 @@ composer.json export-ignore
 composer.lock export-ignore
 Makefile export-ignore
 .gitattributes export-ignore
+appinfo/screenshot*.png export-ignore

README.md

@@ -183,6 +183,7 @@ was verified, so a rollback target is obvious if a newer major causes problems.
 | 0.4.4 | (untagged) | 34.0.4 | ✅ Verified (2026-09-30). Brackets in occ output escaped before rendering. |
 | 0.4.5 | `v0.4.5` | 32.0.15, 33.0.9, 34.0.4, 35.0.1 | ✅ Verified (`testbak/`, 2026-09-30). SQL mode hardening, occ output sanitized, first release code-signed with the Nextcloud certificate. |
 | 0.4.6 | `v0.4.6` | 32.0.15, 33.0.9, 34.0.4, 35.0.1 | ✅ Verified (`testbak/`, 2026-09-30). occ commands logged for the audit trail, console built from the container, more SQL guard gaps closed, long values in result tables cut to fit (`--full` shows them). |
+| 0.4.7 | `v0.4.7` | 32.0.15, 33.0.9, 34.0.4, 35.0.1 | ✅ Verified (`testbak/`, 2026-10-01). Dark app icon for the app list and updates page, screenshots no longer in the package. |
 
 Older entries (0.3.5-0.4.2) are in the git history of this file.
 

appinfo/info.xml

@@ -26,7 +26,7 @@
 **Limitations**
 
 - Not an interactive terminal: long-running commands (like `files:scan` on a large instance) time out, and commands that ask questions cannot be answered (use `-n`).]]></description>
-    <version>0.4.6</version>
+    <version>0.4.7</version>
     <licence>agpl</licence>
     <author mail="dillard.blom@ensembia.com" >Dillard Blom</author>
     <namespace>OCCWeb</namespace>

img/app-dark.svg

@@ -0,0 +1,3 @@
+<svg height="1024" width="896" xmlns="http://www.w3.org/2000/svg">
+  <path style="fill:#000000;" d="M831 127H63c-35.35 0-64 28.65-64 64v640c0 35.35 28.65 64 64 64h768c35.35 0 64-28.65 64-64V191C895 155.64999999999998 866.35 127 831 127zM127 575l128-128L127 319l64-64 192 192L191 639 127 575zM639 639H383v-64h256V639z" />
+</svg>

lib/Service/SqlGuard.php

@@ -124,7 +124,7 @@ class SqlGuard
             $end = self::literalEnd($sql, $i);
             if ($end !== null) {
                 $literal = substr($sql, $i, $end - $i);
-                if (preg_match('/^"([A-Za-z_][A-Za-z0-9_$]*)"$/', $literal, $m) && preg_match('/\G\s*\(/', $sql, $unused, 0, $end)) {
+                if (preg_match('/^"([A-Za-z_][A-Za-z0-9_$]*)"$/', $literal, $m) && preg_match('/\G(?:\s|--[^\n]*(?:\n|$)|\/\*[\s\S]*?\*\/)*\(/', $sql, $unused, 0, $end)) {
                     // A quoted function name ("setval"(...)) calls the same
                     // function as the bare word, so check it as one
                     $result .= $m[1];

tests/Unit/Service/SqlGuardTest.php

@@ -26,6 +26,8 @@ class SqlGuardTest extends TestCase
             ["SELECT dblink_exec('host=x', 'DROP TABLE t')"],
             ["SELECT \"pg_read_file\"('/etc/passwd')"],
             ["SELECT pg_catalog.\"pg_read_file\"('/etc/passwd')"],
+            ["SELECT \"pg_read_file\" /* x */ ('/etc/passwd')"],
+            ["SELECT \"pg_read_file\"-- x\n('/etc/passwd')"],
             ["SELECT dblink_send_query('c', 'SELECT 1')"],
             ["SELECT * FROM dblink('host=x', 'SELECT 1') AS t(a int)"],
             ["SELECT * FROM t INTO OUTFILE '/tmp/x'"],
@@ -127,6 +129,7 @@ class SqlGuardTest extends TestCase
             ["SELECT \"setval\"('seq', 1)"],
             ["SELECT pg_catalog.\"setval\"('seq', 1)"],
             ["SELECT pg_catalog.setval('seq', 1)"],
+            ["SELECT \"setval\" /* x */ ('seq', 1)"],
             ['MERGE INTO t USING s ON true WHEN MATCHED THEN DELETE'],
             ['VACUUM'],
             ['PRAGMA journal_mode = WAL'],