🚀 FanUpdate Redux v2.5.0 + v2.5.1 Release Notes

🚀 FanUpdate Redux v2.5.1 Release Notes

• 🛠️ Fix: FP-25 entry_template migration never matching real installs
  install.php's interactive install form round-trips every template
  default through a <textarea> the browser submits back with CRLF line
  endings, so entryTemplateMigrationPending()'s raw === against an
  LF-only constant never matched any real, interactively-installed site
  -- discovered live on a production install that updated to 2.5.0 but
  never received the migration. Fixed by normalizing CRLF/CR to LF (and
  trimming) on both sides of the comparison before matching.

🚀 FanUpdate Redux v2.5.0 Release Notes

Released: August 14, 2026 — fu- Naming Convention for Entries, Comments & Archives

🔄 Changed

• 🏷️ **The default entry_template now wraps each post in <div class="fu-entry">...</div>** instead of printing {{title}}, the catfile line, and {{body}} directly into div#fanupdate with no container. This gives every install a hook for styling entries as individual cards (background, border, shadow) without having to hand-edit the template first. Updated in all three places the default lives: FanUpdate::__construct() (in-memory fallback), FanUpdate_Post::printPost() (empty-string fallback), and install.php's seeded entry_template row for fresh installs. Added a matching #fanupdate .fu-entry {} starter rule to the CSS snippet on Admin → Category → Get Code, and updated the README's "Templates" section accordingly.

• 🛠️ FP-25: existing installations are migrated to the new .fu-entry wrapper automatically, without ever touching a genuinely customized template. UpgradeRunner gained an entry_template migration (entryTemplateMigrationPending()/migrateLegacyEntryTemplateWrapper()), following the same independent-of-_db_version pattern as the FP-19 timezone migration: it runs whenever the stored entry_template option is byte-for-byte identical to the pre-FP-25 stock default, and does nothing otherwise — any admin edit, however small, permanently exempts that installation from the automatic swap. Detected on every admin page load via the existing pending-upgrades banner and applied the same way as the schema/collective-script/timezone migrations (Admin Update Manager's post-install step, or Dashboard's "Run Upgrades" action) — no new UI or separate mechanism needed.

• 💬 FanUpdate_Comment::printComment()'s per-comment wrapper now also carries a fu-comment class, following the same fu- prefix convention as fu-entry/fu-lightbox: <div id="comment{{id}}" class="comment fu-comment">. Unlike entry_template, this wrapper is hardcoded (not part of comment_template) and prints unconditionally on every installation immediately after updating — so, unlike the entry_template change above, the original comment class is kept on the same element permanently rather than migrated away, and no UpgradeRunner migration is needed or possible here. Added a matching #fanupdate .fu-comment {} starter rule (alongside the existing div.comment rules) to the CSS snippet on Admin → Category → Get Code, and updated the README's "Comment template variables" section.

• 📚 The Archives view (?view=archive) now carries fu- prefixed classes too, extending the same naming convention to the one remaining page that had none: show-blog.php's Month/Category Archives lists and show-cat.php's per-category year-grouped listing. Each <ul> gets class="fu-archive-list", each <li> gets class="fu-archive-item", and show-blog.php's two lists additionally wrap their "(N)" entry count in <span class="fu-archive-count">. Like the comment wrapper, this markup is hardcoded rather than template-driven, so these classes are purely additive — no existing selector is renamed or removed, and no UpgradeRunner migration applies. Added matching (empty) starter rules to Admin → Category → Get Code's CSS snippet and a new "Archives" subsection to the README.

FanUpdate Redux v2.4.1 Release Notes

FanUpdate Redux v2.4.1

Released: August 14, 2026

Fixed

• Restored multi-category assignment for blog entries. A regression in the admin category picker limited each entry to a single category, breaking multi-category tagging, including under the Fanatically integration. The original checkbox-based category selector has been restored, and the entry creation, editing, and repository logic now correctly reads and saves all selected categories.

Upgrade Notes

No database migration is required. Existing category assignments remain intact; the fix restores the ability to assign and edit multiple categories through the admin interface.

FanUpdate Redux v2.4.0 Release Notes

FanUpdate Redux v2.4.0

Release date: August 13, 2026.

🛠️ Fixed

• CAPTCHA Comparison Security Hardening (process.php): Switched CAPTCHA verification from loose (!=) comparison to hash_equals() for timing-safe, strict comparisons. Inputs are now normalized with strtolower(trim()) to fix silent failures when typing lowercase-only CAPTCHA codes in uppercase.

• Post/Comment Render Fatal Error Fix: Resolved a same-day issue ("Call to undefined function doLists()") caused by overly aggressive dead-code deletion during a third-party credits audit. Standardized functions used by wpautop() were restored, third-party PHP Markdown credits re-established, and regression unit test coverage (Unit/TextFormattingFunctionsTest.php) was added.

• Table Sorting ISO Date Handling: Replaced Standardista's legacy date sorting regex (which failed on yyyy-mm-dd ISO dates) with Tablesort (v5.7.1). Raw UTC timestamps are now passed via data-sort attributes on admin/blog.php Date columns to ensure correct sorting regardless of selected date presets.

• Admin Asset Cache-Busting: Added ?v=<FU_VERSION> query parameters to CSS and JS asset tags in admin/header.php to prevent stale browser-cached scripts from corrupting admin panel UI elements during upgrades.

• Admin Bulk Action Buttons: Standardized bulk-delete and bulk-delete-confirmed submit inputs on admin/blog.php into proper <button> elements, displaying clear labels ("Delete Selected" / "Permanently Delete") instead of raw action slugs.

• Multi-Installation Admin Session Conflicts: Fixed an issue where multiple FanUpdate Redux installations on the same domain overwrote each other's session cookies (path=/). Cookies are now dynamically scoped to individual installation subdirectories using FanUpdate::cookiePath().

• Category Filter Query Error (show-blog.php): Fixed a SELECT COUNT(*) pagination bug ("Duplicate column name 'entry_id'") on category-filtered blog listings by qualifying queries to SELECT b.*.

• Unconfigured Media Gallery Banner: Added a global admin warning banner prompting admins to complete configuration if media_table is missing in blog-config.php following an upgrade.

• Automatic install.php Post-Update Cleanup: Updated InstallManager to delete install.php immediately after applying update packages via the Admin Update Manager to eliminate leftover installation script security risks.

---

🔄 Changed

• Credits & Third-Party Code Audit (FU_LIBRARIES):

• Removed: Silk icon set (replaced by Tabler Icons CDN).

• Added: Parsedown (GFlavored Markdown renderer) and TinyMCE.

• Updated: Contributor credits for Ariane to reflect recent updates (Admin Update Manager, Categories Support, Media Manager, InnoDB migration, etc.).

• Updated Link: FU_URL_REDUX now points directly to [https://coding.unloved-heart.net/scripts/fanupdate-redux](https://coding.unloved-heart.net/scripts/fanupdate-redux). Defunct prism-perfect.net links were removed across documentation and codebase header comments while maintaining original author attribution for Jenny Ferenc.

---

✨ Added

• FanUpdate Redux News Feed Widget: Added a Dashboard news widget powered by a configurable RSS feed URL (news_feed_url option in Admin → Options → Main). Features cache-first architecture (NewsFeedService/NewsFeedRepository), cache invalidation upon URL change, and automatic fallbacks if external feeds are down.

• Date Format Preset Dropdown: Replaced plain text input for the date_format option in Admin → Options → Main and install.php with a dropdown featuring common presets and a live preview (e.g., M j, Y (Aug 13, 2026)), with a "Custom..." fallback option.

• Emergency Password Reset Script (reset-password.php): Introduced a standalone, unauthenticated rate-limited script for resetting lost admin credentials. Matches install.php's trust model (requires direct file access/FTP access) and auto-deletes upon success. Handles both existing database credentials and missing admin_password option rows.

• Template Wrapping Guidance: Updated README.md documentation to demonstrate wrapping entry_template inside container <div> tags for individual entry styling in host site stylesheets.

FanUpdate Redux v2.3.0 Release

FanUpdate Redux 2.3.0 — Database Architecture, Media Manager & TinyMCE Editor

Release date: July 27, 2026

FanUpdate Redux 2.3.0 is the largest release to date, focusing on modernizing the project's architecture, improving the editing experience, and laying the groundwork for future development. This release introduces a fully integrated TinyMCE editor and Media Manager, extensive database and upgrade infrastructure improvements, better timezone handling, and numerous usability and stability enhancements throughout the admin panel.

Highlights

• ✨ TinyMCE 7 editor

  • Replaced the legacy custom WYSIWYG editor with a self-hosted TinyMCE 7.9.3 installation.
  • Integrated image uploads and media browsing directly into the editor.
  • Dark mode support and configurable editor sizing.

• 🖼️ New Media Manager

  • Browse, reuse, and delete uploaded images from a dedicated Admin → Media section.
  • Database-backed media indexing for fast performance on large sites.
  • Insert existing images without re-uploading them.

• 🗄️ Major database modernization

  • Added an admin-accessible database upgrade runner.
  • Fresh installations now use InnoDB and utf8mb4.
  • Support for automatic schema updates after manual uploads.

• 🌍 Modern timezone support

  • Replaced fixed GMT offsets with proper IANA timezone selection.
  • Automatic daylight saving time handling.
  • Automatic migration from legacy timezone offsets.

• 🔧 Configuration improvements

  • Collective script configuration moved into the database.
  • Admin credentials are now stored in the database instead of blog-config.php.
  • Support for using a collective script located in a separate database on the same MySQL server.

Improvements

• Full GitHub Flavored Markdown rendering for release notes.
• Copy buttons for generated PHP and CSS snippets.
• Global admin notices for pending database updates and leftover install.php.
• Improved installer with modern toggle switches and automatic blog URL detection.
• Dedicated Collective Source configuration page.
• Numerous admin UI refinements and cleanup.

Fixes

• Fixed multiple TinyMCE integration issues.
• Fixed image URL generation after uploading through the editor.
• Fixed standalone category date display.
• Fixed footer template rendering.
• Fixed fresh-install login persistence.
• Fixed blank admin pages caused by missing service loading.
• Numerous additional bug fixes, cleanup, and internal improvements across the codebase.

Verification

Release archives now include a SHA-256 checksum for integrity verification.

Checksum: FanUpdateRedux-v2.3.0.zip.sha256 (SHA-256) — see the release assets for the checksum file corresponding to the release archive.

Verifying the checksum after downloading helps ensure the archive has not been corrupted or modified during transfer.

FanUpdate Redux v2.2.0 Release Notes

FanUpdate Redux v2.2.0

FanUpdate Redux can now update itself. Admin → Updates checks GitHub for
new releases and walks you through downloading, backing up, and installing
them — no SSH, Composer, Git, or cron needed, so it works on typical
shared hosting.

Highlights

• One-click updates. Check → Download → Review & Install, all from
  the admin panel. A backup is taken automatically before every install
  and restored automatically if the install fails.
• Manual rollback, any time. Restore any previous backup from the
  Backups table, independent of whether an install ever ran.
• Live progress. The confirm-install/confirm-rollback pages show a
  real progress bar and current phase while the update runs.
• System Status panel. See at a glance whether this server has what
  it needs — PHP version, ZIP/cURL availability, file permissions, free
  disk space — before you install.
• Persisted update log. Every check, download, install, and rollback
  is recorded, downloadable as JSON, clearable from the UI.
• Safe cleanup. Installs can remove files left behind by a previous
  version, using a manifest that guarantees an admin-added file is never
  touched.
• Hardened update source. Release metadata and version strings from
  GitHub are validated before anything is trusted or written to disk.

Also in this release

• Automatic install_path re-detection after a server move.
• The last three admin domains (Templates, Account, Options) migrated to
  the Repository/Service architecture, completing Milestone 4 across all
  seven domains.
• Full-codebase audit against project coding standards — no critical or
  security issues found.
• Removed stale changelog-style header comments from all 56 PHP files.

Verification

270 tests, 811 assertions, zero failures — PHPUnit 11.5.56 on PHP 8.4.23.
PHPStan level 6 clean; PHP-CS-Fixer @PSR12 clean on class/.

Upgrading

Standard upgrade: back up your files and database, upload the new
release over your existing installation (everything except
blog-config.php), and you're done — no database migration is required
for this release. Existing installs can also use the new in-app updater
for all future releases.

Full changelog: see docs/CHANGELOG.md.

FanUpdate Redux v2.1.0

[Redux 2.1.0] — July 1, 2026

Initial release of FanUpdate Redux.

Security, Database & Admin UI Modernisation

This milestone release addresses major underlying architecture, focusing on robust security enhancements, modern database interactions, and an improved administrative workflow.

Key Enhancements & Security Patches

• CSRF Protection Across Admin POST Requests: A central Anti-CSRF API has been added to FanUpdate.php. A separate, secure PHP session (fu_session) handles token storage. All administrative forms and AJAX request bodies now validate against these tokens before processing changes.
• Complete Database Migration (ext/mysqli → PDO): The entire data layer has been overhauled to use PDO (pdo_mysql) with prepared statements enforced by default. Dynamic values are handled strictly through ? placeholders to fully protect the system against SQL injection vectors.
• Invalid Nested Form Fixes (HTML5 Compliance): The main entry list form nesting conflict has been resolved. Destructive actions (like post and comment deletions) have been separated from list views and routed through dedicated server-side verification views, providing a safer user experience that functions seamlessly without JavaScript enabled.
• Static Analysis & Strict Type Enforcement: Applied declare(strict_types=1) to all remaining core files, added explicit type-casting for database operations, and corrected multiple loose comparison operators to strict comparison operators (===/!==) across public-facing and administrative environments.
• Corrected Content Sanitization Filters: Fixed an issue where text markup templates and custom comment edits were stripped of safe structural HTML elements (like <a>, <p>, <strong>) upon updating.

---

[Redux 2.0.1] — June 4 to June 10, 2026

Image Handling, Spam Mitigation & Bug Fixes

A series of iterative stability updates introducing built-in image media workflows, visual polish, and advanced bot prevention mechanisms.

Core Features Added

• WYSIWYG Media Upload Integration: Admins can now upload image files (JPEG, PNG, GIF, WebP) straight from the toolbar picker. Uploads are structured in date-partitioned paths (uploads/images/YYYY/MM/) with automated thumbnail generation via the GD extension. A security-hardening .htaccess file is generated inside the directory automatically.

• Built-in Lightbox & CSS Layout Utilities: Responsive styling properties, float styles (fu-img-left, fu-img-right), and layout alignments were added for inline images. Front-end visitors can seamlessly expand post images via a lightweight, keyboard-accessible lightbox overlay.

• Four-Layer Anti-Spam Framework:

• Honeypot Field: A hidden form field that trips malicious automated scripts.

• Time Gate: Blocks instant form submissions completing under a 3-second threshold.

• IP Rate Limiter: Restricts abuse by capping entries to 5 comments per hour per user IP address.

• Duplicate Guard: Uses temporal file hashing to block identical repetitive text submissions within a 5-minute window.

• Theme Toggle Options: Introduced a "Midnight Night" dark theme alongside a persistent UI toggle button positioned inside the administration dashboard header.

Critical Fixes

• Front-end Timezone Sync Fix: Resolved a critical timezone offset bug where servers operating ahead of UTC unintentionally pushed new entries into the future relative to UTC_TIMESTAMP(), hiding posts from front-end queries until real-world time caught up.
• WYSIWYG Caret Reset Fix: Textarea cursor positioning is now cached correctly before native system file dialog windows break focus, avoiding an issue where inserted images defaulted to the top of a document.
• RSS Stream Repair: Replaced missing method calls in the FeedWriter layer with proper raw XML elements (pubDate/lastBuildDate), restoring functionality to dynamic news feeds.

---

[Redux 2.0] — June 2, 2026

Admin UI Redesign & HTML Modernisation

• Complete Visual Redesign: The admin panel interface was entirely rewritten with a modern aesthetic and restructured using semantic HTML5 markup layouts.

---

[Redux 1.1 to 1.9] — May 28 to June 1, 2026

Foundation Reconstruction

• PHP 8.2 Compatibility Pass: Addressed codebase technical debt to ensure complete compliance under PHP 8.2+ runtimes.
• Authentication Hardening: Upgraded underlying login structures to deploy secure bcrypt password hashing alongside cryptographically sound HMAC authentication token validation.
• Architectural Refactoring: Completed directory layout restructuring, cleaned up legacy email options, and moved system filesystem mechanics into a dedicated FileHandler component.

---

Legacy History (2005 – 2020)

• [Robotess Fork 1.0] (2020): Modernized legacy functions to PHP 7 benchmarks (e.g., migrating obsolete mysql_* functions to mysqli_* extensions).
• [1.x to 2.2.1] (2005 – 2008): Original foundation releases authored by Jenny Ferenc.