AnonymousFox

//var/softaculous/cmssimple/changelog.txt

Version 2.2.23 - Wunnumin
-------------------------------

Core - General
 - Security hardening in Smarty template identifier handling to prevent a potential SSTI/LFI/RCE attack chain;
 - Restored frontend rendering of valid module database/file templates while keeping Smarty template identifier hardening against unsafe resource/path access;
 - Restored valid frontend Smarty string/eval rendering for modules using parsed template content while keeping unsafe path-style template identifiers blocked;
 - Compatibility fixes for PHP 8.1, 8.2, 8.3, 8.4 and 8.5 in active runtime paths;
 - Hardened session and authentication-related cookies with explicit HttpOnly, Secure-on-HTTPS and SameSite handling, with a config opt-out for SameSite if needed for legacy integrations;
 - PHPMailer upgraded to version 6.12.0;

Content Manager 1.1.15
 - Content copy flow now uses content_id 0 for new unsaved copied content while keeping backward compatibility;
 - Added a missing default-page content type error message;
 - Changing the page design now keeps the template selector usable even when the selected design has no explicit page-template associations;

DesignManager 1.2.0
 - Export now skips missing or unreadable referenced assets, writes an export report and records warnings in the audit log;
 - Import now handles malformed or non-design uploads more gracefully instead of triggering fatal errors or breaking the admin flow;

FileManager 1.6.17
 - Add support for WEBP and AVIF image types for thumbnails generation, rotation or crop operations. Note: AVIF operations will not work on PHP7

MicroTiny 2.2.6
 - Removed stale TinyMCE plugin loader references that could trigger missing plugin warnings;

ModuleManager 2.2.0
 - Finalized the refreshed ModuleManager release line for CMSMS 2.2.23;

Search 1.55
 - Finalized the Search module version for this release line;

News 2.51.14
 - Fixed BR #12794 - News-fields typo item_orderr;

UserGuide 1.1
 - Finalized the UserGuide module version for this release line;
 
Version 2.2.22 - Saskatoon
-------------------------------

Core - General
- Fixed BR12711 - replace FILTER_SANITIZE_STRING in admin/siteprefs.php
- Fixed BR12701 - Internal Page Link fixed to now include section headers that have children
- Fixed BR12704 - User tag correctly updated message now automatically hides after 10 seconds
- Fixed BR12658 - removed redundant string & other language file tweaks
- Fixed BR12749 - Saving an UDT error fixed - saving the UDT parses the code but no longer executes
- in case the php headers fail to be correctly interpreted fallback on pure HTML
- make sure login form doesn't cache at all to avoid redirect loop on some server configurations
- re-enforce the no caching of backend pages for some server configurations and browsers
- upgraded to Smarty 4.5.5;
- fixed the UserOperations::IsSuperuser method when $uid is not 1 (default for an installation) but not necessarily kept the same during the lifecycle of the site;
- Removed MenuManager from the package;

Content Manager 1.1.14
- Default page deletion bug on copy fixed

Search Module 1.54
- Fixed BR12727 - Search Module bug fix to remove error if no result found

FilePicker 1.0.9
- Fixed BR #12666 - Logs display problem in Admin Log

Phar Installer 1.4.3
- Upgraded Smarty to version 4.5.5;
- Regular Phar still doesn't support Windows at this point while Expanded Phar does because of a Smarty issue while being served from the phar installer;
- Updated the installer README file;

Version 2.2.21 - Sherbrooke
-------------------------------

Core - General
 - Fixes BR 12714 inherited content Fields from a base templates are missing in child templates (backend edit);
 - Fixes BR 12713 Pages extended of a page base can't be edited, if they don't contain a {content} tag;
 - Fixes a typo in class ErrorPage: missing line break after #[\AllowDynamicProperties] directive;

Version 2.2.20 - Saguenay
-------------------------------

Core - General
 - Compatibility fixes for PHP 8.2 and 8.3;
 - Smarty upgraded to version 4.5.2 (latest of the stable 4.5.x branch);
 - Made some changes to keep backward compatibility with previous versions of Smarty;
 - Fixed BR #12683: we now truncate the item_name at 50 characters;
 - Moved php files with functions to a specific folder tidying up for further changes;
 - Deprecated cms_html_entity_decode: scheduled to be removed; PHP native html_entity_decode now supports UTF-8 properly;
 - Fixed BRs #12677 and #12703: UDTs errors are now handled more gracefully - the error being triggered is shown on the popup;
 - News module is no longer mandatory;
 - New module added to core (UserGuide);
 - Installer now supports optional modules (News and UserGuide);
 - MenuManager is no longer installed back on upgrades;
 
Content Manager 1.1.13
 - Fixed a typo in admin_editcontent.tpl;
 
CmsJobManager 1.0.0
 - Considered a stable release, version is now 1.0.0;
 - Compatibility fixes for PHP 8.2 and 8.3;
 
DesignManager 1.1.11
 - Compatibility fixes for PHP 8.2 and 8.3;
 
FilePicker 1.0.8
 - BR #12671 - fix FilePicker prefix error;
  
MicroTiny 1.6.5
 - Compatibility fixes for PHP 8.2 and 8.3;
 - Removed mt_jsbool as it is not needed any longer and was breaking Smarty compatibility; 
 
Navigator 1.0.11
 - Compatibility fixes for PHP 8.2 and 8.3;

News 2.51.13
 - Compatibility fixes for PHP 8.2 and 8.3;
 - News is now an optional module, no longer installed by default;
 
UserGuide 1.0.0
 - Initial release;
 
Phar Installer Not SET
 - Compatibility fixes for PHP 8.2 and 8.3;
 - Supports core optional modules selection on advanced mode (currently News and UserGuide);
 - Modified Smarty 4.2.1 enough to work with PHP 8.3;
 - Regular Phar doesn't support Windows at this point while Expanded Phar does;

Version 2.2.19 - Selkirk
-------------------------------

Core - General
 - BR #12647 - Wrong default action value in get_pageid_or_alias_from_url
 - FR #12638 - ability to add CSP headers on the backend: currently weak restrictions: self with script-src and script-src-elem set to unsafe-inline (optionally set on config admin_csp_header);
 - BR #12661 - fix page_selector allow_all parameter and set default to false;
 
Content Manager 1.1.12
 - BR #12635 - Apply button is shown for non-existing page;
 - BR #12474 Taking the default page down by accident through the content type;

File Manager 1.6.16
 - BR #12659 - FileManager upload Warning bug fix;

FilePicker 1.0.7
 - BR #12621 - FilePicker upload bug;
 - BR #12659 - FilePicker upload Warning bug fix;

Navigator 1.0.10
 - BR #12528 Navigator call doesn't clear excluded prefixes in some situations