Document the GA4 Ads-feature CSP hosts
Document page-text search and the save warning Search indexes the text visitors read instead of the stored HTML, including pages written outside oCMS. Links keep target="_blank", and the page editor warns when a save loses markup (issue #203).
Document page sanitization on save and kept styles Page HTML sanitization runs on save as well as before rendering, and keeps the page editor's value-checked inline formatting instead of removing every style attribute (issue #202).
Document draft preview for admins and editors Admins and editors can open a draft at its URL from the page's title in the admin list or the editor's Preview button; public users and visitors get 404.
Document the .StatusPageURL template variable Themes can link the new Status Page URL site setting (ocms-go #199). The bundled themes render it as a nofollow "Status" footer link.
Document the sync restart and health check states sync-prod-to-dev.sh restarts production after a failed or interrupted sync, and healthcheck-multi.sh reports crash-looping and failed units without restarting them, once per outage (PR #196).
Document the deploy health check deploy-binary.sh and deploy.sh now wait for each restarted instance to report healthy and exit 1 naming the ones that do not (PR #195).
Document two-factor authentication and the password gates Add two-factor authentication (authenticator apps with recovery codes): OCMS_MFA_KEY and OCMS_REQUIRE_MFA, the two-step sign-in, the account security page, administrator and command-line resets, recovery after the key changes, and demo mode leaving it off. Document the acting administrator's password for account-handing user changes and second-factor resets, the password needed to activate DB Manager, import overwrites never changing the admin role, the new event log entries, and Go 1.27.3 as the minimum version. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Describe health auth with API key policies An API key gets the authenticated /health answer only when it passes the checks the REST API applies, key policies and source CIDRs included.
Document deploy-multi failures and delete events Describe how deploy-multi.sh handles a site that fails to stop or start, that page.published is sent once when a manual and a scheduled publish race, and that media.deleted is sent when files stay on disk.
Document compose, checkbox, webhook and deploy fixes Describe the compose variables a production container needs, the checkbox storage and checkedOption, the events REST writes and scheduled publishing send, the new deploy order, and the category form's position.
Correct wiki pages against the code Fix statements the code contradicts across the module, security, configuration, deployment and reference pages, and document OCMS_ENV_FILE and the site.mk env guard.
Add module pages and fix reversed wiki links Add pages for the Internal and External Analytics, Privacy, Embed and MCP Server modules and for video embedding, resync Agent-Ready with the MCP transport, document ocms migrate and fix links whose page and text were swapped.
Raise Fly and Docker stop timeouts to 60 seconds The app now gives its shutdown steps a time budget after the request drain, so kill_timeout and --stop-timeout cover both.
Document stop timeouts and the settings retry
Document the hCaptcha fallback warning
Document hCaptcha behaviour when settings cannot be read
Correct the reserved alias example
Document route-owned aliases and CSP host rules
Document CSP reporting, read-only Docker and provenance Describe the /csp-report endpoint and headers on early redirects, the read-only Docker filesystem with TMPDIR on the data volume, the csp-report reserved name, and verifying release archives with gh attestation verify.
Document the account dashboard and audit fixes Add the Account Dashboard page and role-based login destinations (#188). Document reserved route names for slugs, the module-aware CSP with COOP/CORP headers, CSPSourcer for custom modules, and the loopback-only Docker publish address.
Note that the first theme import creates the custom directory
Require the form page template in theme archives
Note that content imports are staged per instance
Link the sample theme from the import card
Describe IPv6 lockout scoping and DB Manager history truncation Note that IPv6 clients are keyed on their /64 with the distributed attacker budget, and that the DB Manager history records truncated results and names the statement timeout.
Clarify session scope and the module admin-route drift test Say that the idle timeout applies to every session and that the editor opt-in list is kept by a drift test, not a startup check.
Document scoped login lockout, session idle timeout and secret role Describe the email-plus-address lockout with its account-wide ceiling, the two-hour idle session timeout, and the session secret's role as the CSRF key with server-side sessions.
Document admin-only module routes and hardened defaults Describe the registry's admin-only gate with the editor opt-in, the DB Manager's inactive default and query limits, placeholder secret rejection, the seed guard for the default admin, and the theme import password confirmation.
Document admin theme import and deletion Describe the Admin > Themes archive upload, packaging rules and limits, inactive custom theme deletion, demo-mode restrictions and the bundled Tiny Sample archive on the Theme System, Admin Interface, Demo Mode and Home pages.