slackero/phpwcms v1.9.52

phpwcms v1.9.52

on GitHub

Security release for the legacy 1.9 line (PHP 7.4).

🔒 Security

• PHP injection via translation tokens (GHSA-xw8p-7592-hg99): @@Text@@ entries are written with var_export() instead of hand-made escaping. Tokens containing control characters or more than 1024 characters are rejected, and generated language files stop receiving entries above 1 MiB. Both limits are configurable through i18n_token_max_length and i18n_lang_file_max_size. After upgrading, inspect and delete poisoned files in template/template_lang/ — the advisory has the exact commands.

✨ Added

• Native WebP support: WebP files can be uploaded, processed and used like JPEG or PNG; image extension integrity checks cover the format.

🛠️ Changed

• Setup config writer: write_conf_file() emits string values with var_export(); the local escape_quote() helper is removed.
• IPTC charset handling: validity is checked once and the data converted once.

🐛 Fixed

• Legacy IPTC charset: data without a 1:90 tag is decoded as Windows-1252 through makeCharsetConversion() instead of the deprecated utf8_encode().
• PHP 8.5 deprecations: imagedestroy(), finfo_close() and curl_close() replaced with unset(); FEUSER_LOGIN_STATUS guarded against redeclaration; non-array article image data normalized; unused dynamic FeedItem::$updateDate write removed.
• Forms and replacers: custom form anchors are honored, parse_markdown() passes UTF-8 to CommonMark, captured {IMAGE*} / {RANDOM_*} values are escaped.

📦 Dependency Updates

• phpmailer/phpmailer 7.2.0, phpoffice/phpspreadsheet 1.30.8, netcarver/textile 4.1.9, plus the current simplepie/simplepie snapshot.

Requires PHP 7.4+ and MySQL 5.5+ / MariaDB. Ships database revision r554.