Installing a module or theme from an archive
How to put in a module or theme as a .zip file and why it is done in two steps and only by the owner.
A module or theme can be installed from a .zip file. An archive is someone else’s code that then runs on your server, so everything is done carefully: only the owner installs, with the password entered again, and the archive is first only inspected.
Turning the feature on
The “Install from archive” button is on the Add-ons → Modules page. The feature itself is off by default: on the install page the owner turns it on with the “Turn on” button. Turn it on only if you know where the archives come from.
Two steps
1. Inspection. Choose what you are installing (a module or a theme) and upload the .zip file (up to 20 MB). The archive is unpacked into a closed temporary folder, the description is read and the signature checked; in reply you get a “What is in the archive” report. Nothing is installed or run.
2. Installation. If the report suits you, tick “I understand that this archive’s code will run on my server” and press “Install”. The files are checked once more before installing: if they changed between inspection and installation, the installation refuses and the archive has to be uploaded again.
Signature
An archive signed by Nex1on is installed at once. An unsigned archive only if the owner separately allowed “archives without a signature” on the install page and ticked in the report that they understand the risk: we do not know who built it or what is inside, and its code gets full access to the site and database. If the server cannot verify signatures, signed archives are not accepted.
Replacing and rolling back a version
If such a module is already installed, the old folder is saved in storage/backups, and a replacement with an older version or with an archive signed differently has to be confirmed separately. A running version cannot be replaced: switch it off first. A built-in module can only be replaced by a newer archive signed by Nex1on.
After installing
The module stays off and its migrations are not run: switch the module on separately when you are ready. Switching on runs the module’s code with the same rights as the site, so make a database backup first.