1.25.1

Maintenance release for Backdrop CMS. This update contains bug fixes and usability improvements only.

Notes for Updating

• No changes have been made to the .htaccess, robots.txt or default settings.php files in this release. Updating customized versions of those files is not necessary.
• The database update script does not need to be run.

Changes since version 1.25.0 are listed below.

Bug fixes

• Fix regression: double encoding of option values #6126
• Fix PR sandboxes provisioned with PHP 7.2 instead of 8.1 #6133
• Fix install.sh with PHP 8.1 causes deprecation notices #6087
• Fix "Back to site" link does not respect selected language #6080
• Fix fatal error when submitting a form that has a hidden date field and uses the HTML5 Date widget #6027
• Restore definitions of variables $v_version and $v_magic in Archive_Tar #3492

Miscellaneous changes

• Replace "Users'" in contact module permissions #6112

1.25.0

The Backdrop community is proud to release version 1.25.0 of Backdrop CMS, following our 4-month release cycle.

Notes for updating

• It will be necessary to run the update script (located at /core/update.php) for this release.
• No changes have been made to the .htaccess, robots.txt or default settings.php files in this release. Updating customized versions of those files is not necessary.

Changes since version 1.24.2 are listed below.

New features

• Allow alt attribute field to be required on image uploads. #3006
• Add the option to limit text formats for each field instance. #2615
• Add context from Layouts to be passed into to Views blocks. #5995
• Allow theme JavaScript to specify header or footer scope. #5677
• Add a changed (last updated/last modified) property to the User object. #5944
• Add an option to change parent link behavior for responsive dropdown menus. #2370
• Add WebP support to all image and file fields (including hero block). #4937
• Add a mini pager option to Search module results. #6083
• Add a language switcher to the admin bar when locale is enabled. #5983

User Experience Improvements

• When a new content type is created, automatically assign permissions to the Editor role. #5885
• Add #indentation property to FAPI elements. #5999
• Add proper indentation to taxonomy checkboxes/radios to denote child terms. #3292

Bug fixes

• Fixed: Ensure that layout conditions have all required contexts. #4594
• Fixed: Don't empty node cache when creating a new node. #6081

Miscellaneous changes

• Add more words to the CSpell dictionary to avoid false positives. #6047
• Remove default permission that allows editors to delete all pages, posts, and cards in new installs. #6078

1.25.0-preview

This is the preview release of Backdrop 1.25.0. Please use this version if you would like to help us test the features in the new version of Backdrop prior to the official release on May 15th, 2023.

Notes for updating

• It will be necessary to run the update script (located at /core/update.php) for this release.
• No changes have been made to the .htaccess, robots.txt or default settings.php files in this release. Updating customized versions of those files is not necessary.

Changes since version 1.24.2 are listed below.

New features

• Allow "alt" attribute field to be required on image uploads. #3006
• Add the option to limit text formats for each field instance. #2615
• Add a mini pager option to Search module results. #6083
• Add a language switcher to the admin bar when locale is enabled. #5983
• Add context from Layouts to be passed into to Views blocks. #5995
• Add an option to change parent link behavior for responsive dropdown menus. #2370
• Add WebP support to all image and file fields (including hero block). #4937
• Follow-up to 4937: Add a backward-compatible fallback for image_TOOLKIT_supported_extensions(). #6092

User Experience Improvements

• When a new content type is created, automatically assign permissions to the Editor role. #5885
• Add proper indentation to taxonomy checkboxes/radios to denote child terms. #3292

Bug fixes

• Fixed: Ensure that layout conditions have all required contexts. #4594

Miscellaneous changes

• Add more words to the CSpell dictionary to avoid false positives. #6047
• Allow theme JavaScript to specify header/footer scope. #5677
• Add a changed (last updated/last modified) property to the User object. #5944
• Add #indentation property to FAPI elements. #5999
• Follow-up to 5999: Cleanup & optimization of the #indentation FAPI property. #6028
• Follow-up to 5999: Fixed indentation issues appearing on some forms. #6090

1.24.2

Security release for Backdrop CMS. This release fixes 1 security vulnerability:

• Backdrop core - Moderately critical - Access bypass - BACKDROP-SA-CORE-2023-005

This release also includes a handful of bug fixes and other improvements.

Notes for updating

• This release does modify the settings.php file located outside the core directory. Updating your customized copy of this file is recommended, but not necessary. To update, copy the new section onfile_not_normalized_schemes from the latest file to your site's settings.php file.
• It will be necessary to run the update script (located at /core/update.php) for this release.

Changes to site-owner-managed files

Following this release, Backdrop will block access to private files at certain specially crafted paths. Previous versions of Backdrop allowed access to these paths, and in most cases blocking access is the correct behavior.

There may be some sites that rely on allowing access to these paths. It is also possible that the changes in this release may cause other problems with file access. Sites that experience problems with private files after this change should add the following line to settings.php:

$config['system.core']['file_not_normalized_schemes'] = array('private');`

This will preserve the old behavior for files saved in the private files directory, using the private stream wrapper from Backdrop core. Sites that need to preserve the old behavior for files using other stream wrappers, from contributed or custom modules, should list those stream wrappers instead of 'private'.

The comments in the default settings.php file have additional information.

Using this setting will bypass the access checks added in this release, which may allow public access to files that are meant to be private. This setting is a temporary backward-compatibility layer for misconfigured sites. It will be removed in a future release since it is insecure.

Changes since version 1.24.1 are listed below.

Bug Fixes

• Fixed: Adjust autocomplete dropdown positioning on iPad and iPhone #6050
• Fixed: "More" link on permissions page should toggle description. #6053
• Fixed: Sanitize text format names in hint below editor #6065
• Fixed: Message type not set properly for deprecated system message #6041
• Fixed: EntityReference invokes deprecated Drupal function instead of Backdrop alternative. #6036

Documentation updates

• Docblocks updated with Proper @return statements. #6042
• Document $require_settings for find_conf_path(). #6002

User experience improvements

• Display container style on rows in flexible layout template builder. #5523

Miscellaneous changes

• Disable the Drupal compatibility layer when running tests. #6037
• Update l() to use the provided arguments instead of a new $variables array. #5996
• Add a GitHub Action to run cspell. #5811
• Remove the position key from hook_menu(). #5903

1.23.4

Security release for Backdrop CMS. This release fixes 1 security vulnerability:

• Backdrop core - Moderately critical - Access bypass - BACKDROP-SA-CORE-2023-005

Notes for updating

• This release does modify the settings.php file located outside the core directory. Updating your customized copy of this file is recommended, but not necessary. To update, copy the new section onfile_not_normalized_schemes from the latest file to your site's settings.php file.
• It will be necessary to run the update script (located at /core/update.php) for this release.

1.24.1

This is a security release for Backdrop CMS. This release fixes 1 security vulnerability:

• BACKDROP-SA-CORE-2023-004

This release also includes a handful of bug fixes and other improvements.

Notes for updating

• No changes have been made to the .htaccess, robots.txt or default settings.php files in this release. Updating customized versions of those files is not necessary.
• The database update script does not need to be run.

Changes since version 1.24.0 are listed below.

Bug fixes

• Fixed: On a localized site, the Default image is not removable unless in the default language. #6003
• Fix numerous spelling errors in documentation. #5987
• Fixed: PHP Error: Class name must be a valid object or a string in entity_get_controller(). #5953
• Fixed: Node layout is not being used when viewing a node revision. #5915
• Fixed: Adding URL redirects from node form causes a PHP warning. #5878
• Fixed: During Drupal 7 upgrade switch to the standard installation profile if previous profile is not available. #2518

User experience improvements

• Increase the size of the token browser modal to prevent "more" link wrapping. #1038
• Disambiguate "Layouts" vs "Layout templates" in the admin interface. #3607

Documentation updates

• Cleanup the documentation in the diff.inc file. #6026
• Add a link to the $_SESSIONS documentation from the documentation in sessions.inc. #5998
• Add documentation for the global $conf. #5902
• Update documentation for node_load_multiple(FALSE). #5889
• Add documentation to explain the use of t() around the ellipsis for truncate_utf8(). #4545

Miscellaneous changes

• Provide a method to get the pager's element ID. #5958
• Remove the unnecessary return statements from hook_form_FORM_ID_alter() implementations in System module. #5994
• Remove the username from the message displayed when accessing another account's password reset URL. #5971
• Bring entity reference module up to date with Drupal 7.x-1.6 release. #5952
• Use the testing profile for CommentViewsHandlerArgumentUserUidTest. #5839
• Remove the 'article' role attribute from 'article' html elements. #4033

1.23.3

Security release for Backdrop CMS. This release fixes 1 security vulnerability:

• BACKDROP-SA-CORE-2023-004

Notes for updating

• No changes have been made to the .htaccess, robots.txt or default settings.php files in this release. Updating customized versions of those files is not necessary.
• The database update script does not need to be run.

1.24.0

The Backdrop community is proud to release version 1.24.0 of Backdrop CMS, following our 4-month release cycle.

Notes for updating

• The .htaccess files have been modified to include support for PHP 8. This includes the .htaccess files in the project root, in the files directory, and the private files directory. See #5906
• No changes have been made to the robots.txt or default settings.php files in this release. Updating customized versions of those files is not necessary.
• It will be necessary to run the update script (located at /core/update.php) for this release.

Changes since version 1.23.2 are listed below.**

New features

• Add a views field handler for project properties from the database. #5820
• Add descriptions for user roles. #5748
• Add a configuration option for database log message length. #5553
• Make File::access consistent with other entity classes. #5480
• Add "Rebuild search index" process to replace "Invalidate search index". #4182
• Add a "Back to site" button into the Admin Bar. #2709
• Add an instant search filter to the permissions page. #980

1.23.2

Maintenance release for Backdrop CMS. This update contains bug fixes and usability improvements only.

• The .htaccess files have been modified to include support for PHP 8. This includes the .htaccess files in the project root, in the files directory, and the private files directory. See #5906
• No changes have been made to the robots.txt or default settings.php files in this release. Updating customized versions of those files is not necessary.
• The database update script does not need to be run.

Changes since version 1.23.1 are listed below.

Bug fixes

• PHP 8: Fix .htaccess PHP overrides #5906
• PHP 8: Fix deprecated function: Passing null to parameter 1 of type string is deprecated in mb_strlen()`#5890
• PHP 8.1: Fix deprecated function: preg_replace(): Passing null to parameter 3 in system_requirements() #5925
• PHP 8.1: Fix backdrop_is_cli() detection #5872
• Fix PHP notice: Undefined index: position in views_plugin_display_block->options_form(). #5882
• Fix multiple image browsers in CKEditor's insert image functionality #5867
• Fix typo in Redirect module: it's "update", not "upadte" #5826
• Fix creation of table backdrop_install_test fails upon installation without a pre-created database #5817
• Fix creation of database during installation fails #5816
• Fix Simpletest semi-silently ignoring wrong file paths in .tests.info file #5491

Miscellaneous changes

• User edit/create form: render the "Account settings" fieldset as non-collapsible if it is the only one #5783
• Add Requirements check for max_input_vars to status report #5771
• Link to the Layouts admin page from the Custom blocks admin page. #1360
• Switch pull request sandboxes to PHP 8.1 #5926
• Fix indentation in layout_list_page() in layout.admin.inc #5888
• Switch to Checkout V3 in GitHub Actions to prevent node.js nagging #5880
• Switch to using random_bytes() where available (built into php7) #5813

1.24.0-preview

This is the preview release of Backdrop 1.24.0. Please use this version if you would like to help us test the features in the new version of Backdrop prior to the official release on January 15th, 2023.

Notes for updating

• The .htaccess file has been modified to include settings for PHP 8. (See #5906)
• No changes have been made to the robots.txt or default settings.php files in this release. Updating customized versions of those files is not necessary.
• It will be necessary to run the update script (located at /core/update.php) for this release.

Changes since version 1.23.1 are listed below.**

New features

• Add a views field handler for project properties from the database. #5820
• Add descriptions for user roles. #5748
• Add a configuration option for database log message length. #5553
• Make File::access consistent with other entity classes. #5480
• Add "Rebuild search index" process to replace "Invalidate search index". #4182
• Add a "Back to site" button into the Admin Bar. #2709
• Add an instant search filter to the permissions page. #980

Bug fixes

• Instant search filter for the permissions page doesn't reset on role-specific pages #5909