slackero/phpwcms v2.0.0-beta.4

phpwcms v2.0.0-beta.4

on GitHub

Fourth beta of the phpwcms 2.x line.

🔒 Security

• Host header poisoning of mailed links (GHSA-x5fx-f274-39p8): get_url_origin() believes X-Forwarded-Host only when the request comes from a trusted_proxies entry, validates the resulting host and honours the new $phpwcms['trusted_hosts'] allowlist. Every mailer that embeds an absolute link — password reminder, form double opt-in, newsletter verification, guestbook notification, e-card, profile notifications, feed import status and the backend newsletter send — uses phpwcms_mail_site_url() and skips the mail when the site URL came from an unverified request host. The setup wizard stores the detected URL in site when the field is empty; a multi-domain installation should clear site again and use trusted_hosts.
• Local file disclosure via form attachments (GHSA-9mvh-hxj5-9fgg): only a field declared as upload may carry folder, name and attachment metadata, the resolved file must exist and pass realpath() containment inside PHPWCMS_ROOT. Array POST values keep their values but never their keys; the same gate protects the error-path file deletion.
• Inline download of uploaded files (GHSA-rmf4-vf3j-hq8g): inline rendering is limited to an extension allowlist (raster images, PDF, plain text/CSV, audio and video), everything else is delivered as attachment. The stored MIME type, client controlled at upload, no longer decides the disposition — dl_file_resume() re-detects the type with fileinfo and downgrades to attachment when it can execute scripts. download.php?file= ignores ?type= for inline responses and both delivery paths send X-Content-Type-Options: nosniff.
• SVG metadata parsing: SVGMetadataExtractor::getMetadata() strips the DOCTYPE before a parser sees the file and passes LIBXML_NONET; external, parameter and notation entities are refused. Illustrator files declaring their namespaces as inline entities keep working.
• Newsletter recipient values: ###RECIPIENT_NAME### and ###RECIPIENT_EMAIL### are escaped when building the HTML part, so a subscriber name cannot inject markup into the newsletter body.

✨ Added

• PHP 8.5 analysis target: make phpstan-analyse-85, composer phpstan:8.5 and .phpstan/phpstan-php85.neon analyse against PHP 8.5; the single stub-induced finding is tracked in .phpstan/phpstan-baseline-php85.neon.
• Changed-files archive targets: make changed-archive FROM=<ref> plus scripts/changed-archive.sh and scripts/changed-archive.ps1 pack every file changed since a tag or commit, skipping deleted files, for lean release uploads. ARCHIVE_FORMAT=zip selects ZIP.

🛠️ Changed

• Vendor patches: build/patches/ carries unreleased upstream HTML Purifier fixes (PHP 8.4 E_USER_ERROR deprecation, spaced aspect-ratio and border-radius, data: URI rejection without a temp file, list-style image URL case) and the UniversalFeedCreator fix that renders <enclosure> for RSS 2.0. Each patch documents upstream commits, excluded changes and the apply command; re-apply after composer install or composer update.

🐛 Fixed

• Shop checkout payment methods: the preferences expose six methods but the frontend whitelist knew four, so enabling only PayPal or credit card left checkout without any option. Every enabled method is offered, labels for both ship with the templates and fall back to a readable key, orders re-check the chosen method against the current options, and accepted card brands are whitelisted before storage. Prepayment is labelled "Advance payment".
• Form fallback subject: a form saved without a subject passed the site URL as substr() length, a TypeError on PHP 8 that returned HTTP 500, sent no mail and left the upload orphaned in content/form/. The fallback subject is the parsed site host now.

Requires PHP 8.4+ and MySQL 5.5+ / MariaDB. Ships database revision r562.