WonderCMS 3.7.1

WonderCMS 3.7.1

Features and fixes

A maintenance release, two days after 3.7.0. It carries every small item the 3.7.0 review found and left for later, plus NorfolkGreg's Sky menu work. They are small edge cases, mostly on the admin and update paths; together they make the updater, deletes and saves a little more careful. Every change carries its own test.

Changes

• Core (index.php)
  • Updater: from 3.7.1 on, a core that needs a newer PHP than your host runs is refused before anything is written, with an alert naming your PHP version; your site keeps working (#368, PR #380). The update to 3.7.1 itself still runs through your current version's updater. Found by the 3.7.0 review.
  • Updater: on PHP 7.x a truncated download is still refused, now without a PHP warning that could break the redirect after the Update click (PR #389). Found by the PHP 7.4 test run of PR #380.
  • Deleting a theme, plugin or file: a hand-crafted array parameter is ignored instead of answering with an error (#369, PR #381). Admin-only. Found by the 3.7.0 review.
  • Saves: the hour-old cleanup next to database.js removes only the temporary copies the core itself creates, so a file of your own such as database.js.bak.tmp is kept (#370, PR #383). Found by the 3.7.0 review.
  • Reading database.js no longer writes a warning to the server log when the file vanishes in the instant between the check and the read (#371, PR #385). Found by the 3.7.0 review.
  • Files tab: names sort by their letter, accents included (Édith.jpg among the e's), where the host has PHP's intl extension (with intl, plain names with punctuation can also sort a little differently than before); without it the sort is as before. The refusal to remove Sky or the active theme now uses Unicode case folding, so a folder name that the disk resolves to sky/ is refused too (#372, PR #386). Found by the 3.7.0 review.
  • A dangling symlink in data/files, themes/ or plugins/ can be removed from the UI: it is listed with a Remove button and the link is removed, never followed (#373, PRs #387 and #395). Found by the 3.7.0 review.
  • Alerts: a plugin's alert listener may return a replacement text, and that text is what is shown, once. This is now the documented contract, and the translation plugins use it instead of writing into the session (#377, PR #388). Found by the 3.7.0 review.
  • First install: when the data or data/files folder cannot be created or written, the message says so and names the folder (the old text read "Could write to data folder" and always said data) (PR #403). Found in the final 3.7.1 check.
• Sky theme
  • Sky 3.7.13 (PRs #391 and #397): the tap menu works on every device: touch laptops, touchscreen Chromebooks, iPads with a trackpad and a tablet driven by a mouse (the first tap or click opens, the second follows the link; a desktop mouse keeps hover); a tap outside, Escape or leaving the menu closes the submenu, on iPhone and iPad too; a closed menu never widens the page, long names wrap, and the third level opens where there is room (inward for the last items), so it can be reached on phones, tablets and desktops; on phones a tapped menu opens as a panel under the bar. Existing sites update Sky in Settings -> Themes (copy your own edits to Sky first). Thanks to NorfolkGreg (#361).
• Project
  • DownloadTest stops its php -S servers after each test, so the suite no longer hangs a pipe on Linux (#392, PR #393). Found during the night's test runs.
  • RELEASING.md step 6 says what "a save" means on the canary and who clicks; step 4 checks the branch's commit messages for closing keywords too (PRs #394, #401, #402).

Around the release

• All 21 translation plugins reviewed twice and bumped: the Delete, Remove and Activate confirmations are translated, and the plugins no longer touch the session's alert queue on 3.7.0 and newer (a version check keeps 3.6.0 sites showing each alert once). Update them in Settings -> Plugins.
• GregCustom 2.6.3 by NorfolkGreg (offered back as NorfolkGreg/GregCustom#2): submenus open on iPhone and iPad, each parent keeps its link with a separate submenu button, search fixes, and the check() JavaScript error is gone.
• Adivvyo 20261030B by hightowe: synced with his repository, and a fix for cores before 3.2.0.
• Oliva Blocks by SteveAlink, a new plugin on the official list, served from a robiso fork with two blank-page fixes and a CSRF fix.
• simple-blog 3.5.3: an RSS feed at blog/feed.xml, announced to feed readers through the page head, from a pull request by kitoy30 (robiso/simple-blog#8).
• additional-contents 3.3.1: a header area on each page (robdell, #1) and a Move up button to reorder areas (eisteeverschluss, #2).
• Privatus Analytics 1.0.2 by ja-andrews, a new plugin on the official list (WonderCMS/wondercms-cdn-files#20, listed through #22), served from a robiso fork: the script loads without the vendor's cookie, the login page is not counted, and the extra tracker modules start unticked.
• CI installs PHPUnit through Composer, since phar.phpunit.de serves a stub, and fails when PHPUnit did not run (PR #390).

Backwards compatibility

• No plugin or theme API changes, and the database.js format is unchanged. The alert hook behaves exactly as in 3.7.0; 3.7.1 only documents that the returned text replaces the alert.
• Minimum PHP stays 7.4; tested in CI on 7.4, 8.1, 8.3, 8.4 and 8.5.

How to update

• Log into your WonderCMS website and create a backup through Settings -> Security.
• Click "Update".
  • If the update is not visible, open Settings -> Themes and click "Check for updates".
• Then update Sky and your translation plugins from Settings -> Themes and Settings -> Plugins.

Installation

• Unzip and upload the files wherever you want WonderCMS installed and visit that URL.
• SHA-256: 5d3a4d42a335c329479df1aced16532cd56c870493d482e4d21997ab33308d29