2.8.0 — Script Editor with Raspberry Pi examples

The headline: a Script Editor with syntax highlighting and 18 Raspberry Pi example scripts — plus a fix for a 2.7.0 visual regression and a security fix for upgraders. After updating, reinstall your optional modules from Actions (fixes the "NOT protected" warning and TinyFileManager's second login), and click the System Check Fix button if user_scripts/ shows as exposed.

New — Script Editor (System → Scripts)

• Write shell and Python scripts in the browser with CodeMirror syntax highlighting (bundled locally — works offline, CSP-clean), save to user_scripts/, and run over SSH with output inline
• 18 ready-to-adapt examples, grouped into GPIO / Motors / Sensors / System: LED blink, button input, servo & DC-motor control (gpiozero), DHT11/DHT22, BME280, DS18B20, HC-SR04, PIR, LDR, I2C scan, sound playback, system info, config backup, WiFi scan, disk cleanup, CPU-temp alert. Examples needing a library fail with the exact pip3 install line, and each has wiring notes
• Schedule button creates a cron job for the current script in one dialog; the Command Button and Cron pages gained an Insert a saved script picker — write once, then run by button or schedule without typing paths
• Unsaved-changes protection, Ctrl+S saves, translated into de/uk/es/fr
• Safety: strict filename validation, interpreter chosen by extension only, symlink containment (planted-symlink read/write attacks are integration-tested), user_scripts/ web-denied at both .htaccess and server level

Security

• Stale Apache deny rules are detected and fixable: the conf copied to /etc/apache2 at install time goes stale on git pull, leaving newly protected directories (like user_scripts/, which can contain credentials you wrote into scripts) web-readable on default Apache. System Check now probes user_scripts/ over HTTP and every exposure row has a one-click Fix that re-installs the conf; check.sh --fix detects conf drift too

Fixed

• Icons and loading spinners vanished (2.7.0 regression): FontAwesome was still loaded from a CDN, which the new CSP rightly blocked — buttons swapping their label for a spinner just went blank. FontAwesome is now bundled and served locally
• Month-old JS/CSS after updates: js.php/css.php are cached 30 days with unchanging URLs, so every update left browsers on the old bundle until a hard refresh. Bundle links now carry a version and bust the cache exactly once per update
• "Installed, but NOT protected — reinstall the module" could never clear: old installs vendored modules as executable vendor/*.php; reinstalling added the protected copy without removing the stale one. The installer now cleans it up — one reinstall fixes it for good
• TinyFileManager asked for a second login after GumCP's own: the entry point now uses TFM's official embed mode, so the GumCP login is the single gate (anonymous requests still redirect to login)
• Module Fix buttons for user_scripts/ writability and Apache conf reinstall added to System Check

Testing

• Integration suite grown to 33 checks (symlink attacks, script CRUD, updater lockout), 49 self-tests; all run in CI on real PHP 7.0

Full details in CHANGELOG.md.