slackero/phpwcms v1.12.6

phpwcms v1.12.6

on GitHub

Security release for the 1.12 line.

🔒 Security

• PHP injection via translation tokens (GHSA-xw8p-7592-hg99): @@Text@@ entries are written with var_export() instead of hand-made escaping. Tokens containing control characters or more than 1024 characters are rejected, and generated language files stop receiving entries above 1 MiB. Both limits are configurable through i18n_token_max_length and i18n_lang_file_max_size. After upgrading, inspect and delete poisoned files in template/template_lang/ — the advisory has the exact commands.

✨ Added

• Native WebP support: WebP files can be uploaded, processed and used like JPEG or PNG; image extension integrity checks cover the format.

🛠️ Changed

• Setup config writer: write_conf_file() emits string values with var_export(); the local escape_quote() helper is removed.
• IPTC charset handling: validity is checked once and the data converted once.

🐛 Fixed

• Legacy IPTC charset: data without a 1:90 tag is decoded as Windows-1252 through makeCharsetConversion() instead of the deprecated utf8_encode().
• PHP 8.5 deprecations: imagedestroy(), finfo_close() and curl_close() replaced with unset(); FEUSER_LOGIN_STATUS guarded against redeclaration; non-array article image data normalized; unused dynamic FeedItem::$updateDate write removed.
• Forms and replacers: custom form anchors are honored, parse_markdown() passes UTF-8 to CommonMark, captured {IMAGE*} / {RANDOM_*} values are escaped.

📦 Dependency Updates

• phpmailer/phpmailer 7.2.0, phpoffice/phpspreadsheet 5.11.0, netcarver/textile 4.1.9, tinymce/tinymce 8.10.2, guzzlehttp/psr7 2.13.3, symfony/deprecation-contracts 3.8.1, plus current simplepie/simplepie and mklkj/tinymce-i18n snapshots.

Requires PHP 8.2+ and MySQL 5.5+ / MariaDB. Ships database revision r555.