Lumora Gallery v1.18.4 Release Notes

🚀 What's New in v1.18.4

Release Date: September 11, 2026

A small one: a handier way to shortcode multiple albums at once, plus a Markdown option in the lightbox's copy-paste panel for anyone who'd rather skip typing HTML by hand.

🧩 Multi-Album Shortcode Tool (LG-059)

The Lumora Press Shortcodes plugin gains a new Admin → Multi-Album
Shortcode page: check off any number of albums and get back one combined
[lumora_gallery_album album_id="1,2,3"] shortcode, instead of typing album
IDs by hand. This pairs with a matching change on the companion Lumora
Press project, whose [lumora_gallery_album] shortcode renderer now
resolves a comma-separated album_id list into a single combined gallery
block.

📋 Embed Markdown in the Lightbox (LG-060)

The frontend lightbox's admin/staff-only info panel — which already
offered a direct image URL and a ready-to-paste Embed HTML snippet — now
also offers an Embed Markdown field, with its own Copy Markdown
button alongside the existing Copy HTML button. Handy for pasting a linked
thumbnail straight into a Markdown-based post or README.

🧪 Quality

Full PHP Test Suite run (870 tests, 1,619 assertions, 1 intentional skip)
passed cleanly on PHP 8.2, 8.3, and 8.4 via the Docker matrix harness,
including performance tests against a 500,000-image dataset.

Lumora Gallery v1.18.3 Release Notes

🚀 What's New in v1.18.3

Release Date: September 11, 2026

🐛 Folder Discovery Fix (LG-058)

The New Album page's "Folders already on disk" scan could miss real
subfolders when a folder also held a stray file alongside them — for
example an unrelated .zip upload sitting loose next to genuine episode
subfolders. The scanner treated that folder as a finished leaf album and
never looked inside it, silently hiding the subfolders it contained from
the suggestion list. It now only skips scanning folders already claimed by
an existing album, and always looks inside anything unclaimed.

🧹 Bundled Theme Cleanup (LG-057)

The classic-fansite bundled theme has been removed. default is now the
only bundled, non-deletable theme and the project's reference
implementation for theme authors. Custom themes under custom themes/ are
completely unaffected.

🧪 Quality

Full PHP Test Suite run (864 tests, 1,609 assertions) passed cleanly on
PHP 8.2, 8.3, and 8.4 via the Docker matrix harness, including performance
tests against a 500,000-image dataset.

Lumora Gallery v1.18.2 Release Notes

🚀 What's New in v1.18.2

Release Date: September 9, 2026

💾 Full Backups: Download Button (LG-056)

The Full Backups panel on the admin Updates page can now download a
retained backup directly from the browser — a new Download button sits
alongside the existing Restore and Delete buttons for each backup entry.
Downloading streams the full ZIP snapshot (application code, configuration,
and an embedded database dump) with no intermediate copy step, and it's
gated by the same Site Configuration permission as the other backup
actions, so only administrators who can already create or restore backups
can pull one down.

🧪 Quality

Full PHP Test Suite run (863 tests, 1,608 assertions) passed cleanly on
PHP 8.2, 8.3, and 8.4 via the Docker matrix harness, including performance
tests against a 500,000-image dataset.

Lumora Gallery v1.18.1 Release Notes

🚀 What's New in v1.18.1

🧩 Delete Disabled Plugins

The Plugins admin page can now permanently remove a disabled feature plugin's files from disk — no more reaching for FTP/SSH just to clean up something you've turned off. Delete a single plugin from its row, or select several with the new bulk checkboxes and "Delete Selected" toolbar button, matching the same select-all/live-count pattern already used on the Images page. An enabled plugin can never be deleted from either path, and anything that's already gone or got re-enabled by the time a bulk request lands is simply skipped rather than erroring.

🖼️ Cover Image Upload for Categories & Albums

New/Edit Category and New/Edit Album now let you upload a dedicated cover image directly, instead of only picking an existing gallery image by ID. Uploads go through the same validation as any other image upload (allowed extension, size limit, real-image check) and get their own thumbnail. An uploaded cover always takes priority over a picked image, which in turn still falls back to auto-picking the first image when neither is set — nothing changes for existing covers. The image edit page also gained a "Use as Album Cover" button as a quick alternate way to set a cover from an image you're already looking at.

🔒 Ticket ID Cleanup

A codebase-wide audit turned up two admin-facing strings in the Lumora Press Shortcodes plugin that referenced an internal ticket ID (LPP-015) directly — both now describe the companion plugin by name only. No other live UI strings were found to have the same issue.

🧪 Quality

Full PHP Test Suite passing on PHP 8.2, 8.3, and 8.4 — 863 tests (1 intentional skip), 1608 assertions, including the security suite.

Lumora Gallery v1.18.0 Release Notes

🚀 What's New in Lumora Gallery v1.18.0

Release Date: August 31, 2026

---

🧩 Lumora Press Shortcodes Plugin (LG-052)

A new optional feature plugin — disabled by default — for sites that also run [Lumora Press](https://coding.unloved-heart.net/scripts/lumorapress):

• Shows a ready-to-copy [lumora_gallery_album album_id="…"] shortcode right on each album's own admin edit page, and the equivalent [lumora_gallery_album image_id="…"] shortcode on each image's admin edit page.
• The same two snippets also appear on the public-facing side — on the album page, and as a new "Shortcode" field in the image lightbox's existing "Direct image URL" info panel — visible to logged-in users only, never to an anonymous visitor.
• Companion to Lumora Press's own LPP-015 ("Lumora Gallery Shortcodes") plugin, which reads this app's database read-only to actually render those shortcodes in posts/pages. This plugin only generates the text — no live connection to a Lumora Press install, no settings screen of its own, and it changes nothing on a site that doesn't enable it.
• Four new hook points (admin_album_edit_extra_fields, admin_image_edit_extra_fields, public_album_info_html, public_image_shortcode) were added to core for this plugin to listen on, following the same "hooks in core, logic in the plugin" split already used by the Visitor Stats plugin.

---

🛠️ Fixed: A Sibling App's .htaccess Could Hijack /admin/

On a shared domain where Lumora Gallery lives alongside another app under the same parent directory, a bare /admin/ request could be silently swallowed by that other app's own .htaccess rewrite rules — in one real case, a sibling Lumora Press install's root .htaccess (which deliberately excludes its own admin/ from direct serving) ended up catching Gallery's unrelated admin/ folder too, serving the wrong app's homepage. A new root .htaccess (RewriteEngine Off, since every Gallery URL is already query-string based) stops any ancestor .htaccess from reaching into a Gallery install this way.

---

🧪 Quality

Full test suite (826 tests) passing on PHP 8.2, 8.3, and 8.4 before this release.

---

Full Changelog: see docs/CHANGELOG.md in the repository.

Lumora Gallery v1.17.1 Release Notes

🚀 What's New in Lumora Gallery v1.17.1

Release Date: August 28, 2026

---

🐛 Fixed: "Check for Updates Now" Could Silently Fail

GitHubUpdateProvider::mapRelease() truncated long release notes with a byte-based substr(). Release notes routinely contain multi-byte UTF-8 emoji, and when the truncation's 1,997-byte cutoff landed in the middle of one, the result was invalid UTF-8 — which made json_encode() return false for the entire update-check payload. admin/ajax_update_check.php then returned a completely empty response, surfacing in the admin panel as a bare Unexpected end of JSON input with no indication of the real cause. This is what shipped in v1.17.0's own release notes.

Fixed by truncating with mb_strcut() instead, which enforces the same byte cap but always stops on a character boundary. Added a regression test reproducing the exact mid-character cutoff.

---

🧪 Quality

Full test suite (823 tests) passing on PHP 8.2, 8.3, and 8.4 before this release.

---

Full Changelog: see docs/CHANGELOG.md in the repository.

Lumora Gallery v1.17.0 Release Notes

🚀 What's New in Lumora Gallery v1.17.0

Release Date: August 28, 2026

---

🔒 Self-Deleting Emergency Password Reset (LG-051)

Password recovery on a mail-free host no longer relies on a live reset link sitting in a predictable, web-reachable file:

• Removed: admin/forgot_password.php's lumora_recovery.txt fallback — a single-use reset token written to the gallery root, guessable and reachable by anyone before the real admin ever saw it. That page is now email-only.
• Added: reset-password.php in the gallery root — an unauthenticated emergency reset with the same trust model as install/index.php (reaching the file at all already means you have filesystem/FTP access). It lists every account eligible for recovery (any group holding both User Management and Configuration permissions, not just the literal admin slug) and deletes itself after a successful reset.
• Shares the admin-login rate limiter with admin/login.php via a new RateLimitService, so both surfaces are covered by one lockout.
• The admin panel now warns — with a one-click delete — while reset-password.php is still present, mirroring the existing install/ warning, and the built-in updater auto-removes a reappeared copy after every update the same way it already handles install/.

---

🧭 Expand/Collapse All for the Admin Sidebar (LG-048)

Two synced toggles — one above Dashboard/Gallery, one below Users/Groups — expand or collapse every collapsible sidebar section (Settings, Maintenance, Users) at once, reachable without scrolling a long sidebar either way. Both buttons stay in sync with each other and with manual per-section clicks. Also fixes a follow-up bug where expanding everything clipped the gallery name at the top of the sidebar down to a sliver.

---

📂 Persistent Folder-Scan Heading on New Album (LG-050)

The "Searching for folders on disk…" spinner on the New Album page was easy to miss — especially now that scans resolve fast (LG-049) — so a small always-visible 📂 Folders already on disk heading now stays put above it regardless of which state (searching, suggestions, or "none found") is showing underneath.

---

⚡ Fixed: Folder-Scan Notice Could Silently Never Appear on Large Galleries (LG-049)

On a gallery with hundreds of thousands of images, the New Album folder scan could exceed PHP's execution time limit and abort with no response — so neither the folder suggestions nor the "No unclaimed folders found" notice ever appeared, with no visible error either. Root cause: the scan kept recursing into album folders it had already confirmed held image files, re-scanning every image just to rule out subdirectories that couldn't exist there. Fixed by stopping recursion into a folder as soon as it's known to directly hold a file, plus an independent hard cap on total directories visited as a backstop.

---

🧪 Quality

Full test suite (822 tests) passing on PHP 8.2, 8.3, and 8.4 before this release.

---

Full Changelog: see docs/CHANGELOG.md in the repository.

Lumora Gallery 1.16.0 Release Notes

🚀 What's New in Lumora Gallery v1.16.0

Release Date: August 20, 2026

---

🧩 Feature Plugin Architecture & Visitor Stats (LG-045)

A new plugin type — feature plugins — can now extend Lumora's core behaviour without patching any core files, via a minimal hook system:

• HookService — addAction()/doAction() and addFilter()/applyFilters(), priority-ordered.
• PluginService — discovers plugins/*/plugin.json manifests, tracks enable/disable state, and loads every enabled, compatible plugin's bootstrap.php each request.
• New Admin → Plugins page lists every discovered feature plugin with an Enable/Disable toggle. Every feature plugin ships disabled by default.
• Three extension points: lumora_pageview, admin_nav_sections, and admin_dashboard_widgets_html.

The first plugin built on this system — Visitor Stats — adds a Jetpack-style traffic overview: a 7/30/90-day pageview trend chart, Today/Week/Month/All-Time totals, Top Images, Top Albums, Top Referrers, and a compact Dashboard widget. Pageviews are logged with bot traffic filtered out, and only a SHA-256 hash of the visitor's IP plus the referring host (never a full URL) are stored — pruned automatically after 90 days.

---

📱 Mobile-Friendly Admin Panel (LG-046)

The admin panel previously had almost no real mobile styling. This release fills that in properly, verified against a real dev preview install with production data rather than guesswork:

• Topbar brand truncates instead of overflowing on narrow screens.
• Mobile nav links and collapsible-section chevrons now have full touch targets.
• Fixed a layout bug where the sidebar and main content stayed side-by-side on mobile instead of stacking.
• All five admin list tables — Categories, Images, Albums, Users, Groups — now render as clean stacked cards on phones instead of forcing an awkward horizontal scroll.
• Plugin descriptions on the Plugins page clamp to 3 lines on mobile instead of dwarfing the card controls.
• Assorted polish: Updates page source tabs wrap, the Appearance theme grid collapses to one column, and modal/card padding tightens on small screens.

---

↕️ Mobile Reorder Fallback for Categories/Albums (LG-047)

Drag-and-drop reordering on the Categories tree and Albums hierarchy view relies on native HTML5 drag-and-drop, which never fires from touch input — so reordering was silently unusable on mobile. Both pages now show Up/Down buttons on mobile in place of the drag handle, swapping a row with its immediate sibling using the same reorder endpoints drag-and-drop already uses. (Reparenting — dragging a category into another — remains a desktop-only action.)

---

🧪 Quality

Full test suite (806 tests, 1,498 assertions) passing on PHP 8.2, 8.3, and 8.4 before this release.

---

Full Changelog: see docs/CHANGELOG.md in the repository.

Lumora Gallery v1.15.0 + v1.15.1 Release Notes

Release Date: August 10, 2026

Release notes for Lumora Gallery v1.15.1 and v1.15.1 (released August 10, 2026):

---

🚀 What's New in 1.15.1

Added

• No Unclaimed Folders Notice (LG-044): Added a clear notice when the automated on-disk album folder scan (LG-040) finds zero unclaimed folders in the albums/ directory.
• Previously, after the "Searching for folders on disk…" spinner disappeared, a scan that legitimately found zero unclaimed folders left the path field silent, making it indistinguishable from a scan that hadn't run.
• A small "No unclaimed folders found on disk" notice now appears upon a successful empty scan.
• Network errors or non-JSON responses continue to fail silently and fall back to free-text input without displaying an error message.

---

🚀 What's New in 1.15.0

Lumora Gallery 1.15.0 introduces dedicated visual theme management with ZIP uploads and updating, extends full ZIP upload capabilities to the core update system, and adds responsive progress indicators to album folder creation.

---

🎨 Visual Theme Manager & ZIP Uploads (LG-043)

Admin → Configuration's plain theme selection dropdown has been retired in favor of a full-featured Admin → Appearance management hub (admin/appearance.php):

• Visual Theme Grid: Every installed theme is rendered as a visual card complete with automated thumbnail discovery (preview.*, thumbnail.*, or screenshot.* variants with numbered support and placeholders), author info, active badge status, and action controls.

• Detailed Screenshot Modal: Click Details on any theme to inspect its full screenshot gallery, author info, design URI, and theme folder name.

• Install Themes via ZIP Upload: Upload theme ZIPs directly. Every upload is rigorously validated against ZIP structure integrity, entry caps, uncompressed size limits, missing template.html files, unsafe path traversal, and automatic flattening of single top-level wrapper directories (such as GitHub exports). Folder names are automatically derived from the declared Theme Name header.

• In-Place Theme Updates: Re-uploading a .zip for an existing theme folder allows safe in-place updates after explicit user confirmation. Staged extractions use temp directories and atomic swaps (rename()), ensuring a failed or corrupted upload can never leave a broken live theme.

• Theme Deletion: Non-active, non-bundled themes can be uninstalled in one click. The two bundled themes (default and classic-fansite) as well as the currently active theme remain permanently protected against accidental deletion.

• Service Layer Refactor: All theme management logic is now clean and modular inside include/services/ThemeService.php. Centralized Zip path security logic now runs through lumora_is_unsafe_zip_entry_name() in include/functions.php, shared identically across ThemeService and UpdaterService.

---

📦 Install Core Updates from Uploaded ZIPs (LG-042)

Admin → Updates now supports manual release installations via direct ZIP upload alongside the existing GitHub updater:

• Offline & Custom Build Installation: Host environments restricted from outbound HTTPS calls or installations running custom builds can now upload release archives through the 📦 Install from Uploaded ZIP panel.

• Shared 10-Stage Pipeline Protection: Uploaded packages undergo strict integrity, disk space, and minimum PHP compatibility checks against version.php/LUMORA_MIN_PHP. Once accepted, UpdaterService::acquireLockFromUpload() stages the release directly into the existing preflight → download → verify → backup → maintenance → extract → validate → replace → migrate → cleanup pipeline—retaining full automatic backups, progress indicators, stuck-session recovery UI, and rollback protection on failure.

• Powered by a new site_configuration-gated, CSRF-protected admin/ajax_update_upload.php endpoint.

---

⚡ Folder Scan Indicator for Album Creation (LG-040)

• Visual Progress Feedback: When creating a new album (admin/albums.php?action=new), a "Searching for folders on disk…" spinner and placeholder indicator now appear while the on-disk folder scan runs across large albums/ trees, giving immediate feedback until the scan completes.

---

🔄 Changes

• Anonymous Install Ping Endpoint Path: InstallPingService::ENDPOINT now targets [https://coding.unloved-heart.net/lumoragallery/install-tracking-server/ping.php](https://coding.unloved-heart.net/lumoragallery/install-tracking-server/ping.php). This is purely a server-side route adjustment; payload structure, opt-in gating, and failure handling remain identical.

Lumora Gallery 1.14.0 Release Notes

🌟 Lumora Gallery 1.14.0 Release Notes

Release Date: August 7, 2026

Lumora Gallery 1.14.0 introduces new gallery discovery features, workflow improvements for album setup, codebase-wide documentation standardization, and essential fixes for context scoping across themes.

🚀 Added

• Configurable "Latest Additions" Image Count (LG-31)

  • Fixed-grid layouts previously left stranded, partial thumbnail rows on the home page when using the hardcoded default of 8 images.
  • Added a new latest_images_count configuration option (Admin → Configuration; default 8, range 0–50, 0 = hide section).
  • Administrators can now select a count that cleanly aligns with their theme's column count.
  • The setting also uniformly governs the "Latest Additions" section on category pages.

• Sub-Category Image Surface on Category Pages (LG-041)

  • Category pages now show a "Latest Additions" section that aggregates recently added approved images across the entire category subtree.
  • Images added deep within nested sub-categories now surface on top-level category pages without altering existing permission gates.

• Folder Path Suggestions for New Albums (LG-040)

  • When creating a new album (admin/albums.php?action=new), the Folder Path field now offers clickable suggestions and <datalist> autocomplete for unclaimed on-disk folders under albums/.
  • Powered by a secure AJAX endpoint (admin/ajax_list_folders.php) backed by GalleryService::listAvailableAlbumFolders().
  • Filters out hidden directories, verifies paths via realpath(), enforces strict folder sanitization, and skips container folders holding only subdirectories.

• Standardized Codebase File Headers (LG-039)

  • Applied standardized PHPDoc headers (@package, @author, @since, etc.) across all PHP source files.
  • Marked legacy forwarding wrappers (include/template.php, include/thumb.php) as @deprecated in favor of service classes.
  • Added verified @see cross-references across service layers, migrations, and legacy wrapper files.

🐛 Fixed

• Category Scoping in "Most Viewed" Query (LG-33 gap)

  • Fixed an issue where querying ?view=most_viewed&cat=N returned "No images to display" on parent categories that only contain sub-categories and no direct albums.
  • GalleryService::getMostViewedImages() now scopes to the category's complete descendant subtree at any depth.

• Classic Fansite Context Preservation (LG-33 gap)

  • Fixed an issue where the classic-fansite theme dropped album and category navigation context when clicking the "Most Viewed" link.
  • Updated classic-fansite’s template.html to utilize the standard {NAVIGATION} token override, aligning link logic with the default theme while preserving custom styling.