slackero/phpwcms v2.0.0-beta.3

phpwcms v2.0.0-beta.3

on GitHub

Third beta of the phpwcms 2.x line.

🔒 Security

• PHP injection via translation tokens (GHSA-xw8p-7592-hg99): @@Text@@ entries are written with var_export() instead of hand-made escaping. Tokens containing control characters or more than 1024 characters are rejected, and generated language files stop receiving entries above 1 MiB. Both limits are configurable through i18n_token_max_length and i18n_lang_file_max_size. After upgrading, inspect and delete poisoned files in template/template_lang/ — the advisory has the exact commands.
• Setup config writer: write_conf_file() emits string values with var_export(); the local escape_quote() helper is removed.

✨ Added

• Index page as article category: the index page is the regular article category row acat_id = 0, editable and orderable like any other category. Revision r562 seeds the row for existing installations; conf.indexpage.inc.php stays a fallback and readable mirror.
• Native AVIF and WebP support: both formats can be uploaded, processed and used like JPEG or PNG; image extension integrity checks cover them.
• Required PHP extensions enforced: setup and the updater verify the extensions listed in composer.json and abort before changing files or the database. Setup now requires PHP 8.4, matching the Composer platform check.
• clean_plain_utf8() helper for UTF-8 and JSON output paths.
• Docker: bcmath installed in the web image.

🛠️ Changed

• voku/portable-utf8 modernization: charset converters, strip_tags() wrappers and entity decoding in core and setup use the UTF-8 helpers; URL alias and slug generation is rebuilt on the same library. The legacy ConvertCharset class is dropped.
• voku/anti-xss filtering for XSS cleanup.
• Image zoom: image_zoom.php modernized, ships its recommended CSS, adds lang to the HTML tag.
• Duplicate definitions removed, obsolete function_exists() guards dropped.

🐛 Fixed

• Filebrowser 500 on upload: missing Tom Select assets included, file tags passed through a hidden input, file_tags, file_longinfo and file_copyright sanitized against literal undefined. Fixes #394.
• PHP 8.5 deprecations: $http_response_header replaced with http_get_last_response_headers(); imagedestroy(), finfo_close() and curl_close() replaced with unset(); dynamic FeedItem::$updateDate write removed.
• Forms, Markdown and replacers: custom form anchors honored, parse_markdown() passes UTF-8 to CommonMark, captured {IMAGE*} / {RANDOM_*} values escaped.
• Legacy IPTC charset: data without a 1:90 tag is decoded as Windows-1252 instead of the deprecated utf8_encode().
• Deprecated replacers hardened, no notices.

📦 Dependency Updates

• Composer: phpmailer/phpmailer 7.2.0, phpoffice/phpspreadsheet 5.11.0, tinymce/tinymce 8.10.2, netcarver/textile 4.1.9, guzzlehttp/psr7 2.13.3, current simplepie/simplepie and roave/security-advisories snapshots.

Requires PHP 8.4+ and MySQL 5.5+ / MariaDB. Ships database revision r562.