Release Kaleta 1.3.6 (security release) · phprs-cms/kaletacms

Security release. Sites with automatic security updates (the default) install it on their own.

Security fixes

Custom HTML and collection values (medium). A {{field}} value of a collection item or component used inside a Custom HTML element was inserted without escaping. A user who can edit collection items or component values (for example an editor) could put a script into an item name that then ran on the public site and in the administrator's builder. Values are now escaped; formatted-text fields are sanitised. (GHSA-fff6-pmg2-wx3p)
Claude connection section checks (low). Deleting a page now needs the Pages section and creating a category the Categories section (not only the publishing level); listing redirects needs the Redirects section; users without the Pages or Collections section see only published pages and items; only administrators can overwrite shared classes from build_from_html. (GHSA-9v67-9m78-h67v)
Hardening: a site part preview link covers its variant; the thank-you page address rejects backslashes; newsletter service requests do not follow redirects; an MCP batch has at most 50 messages.

Choosing Czech as the admin language works on a site in another language.
News and category addresses in the admin show the site's real address (/news/…).
The Pages list shows "In navigation" according to the custom menu; Import page (JSON) is a proper button.
Pop-up settings: on/off switch and counters at the top, pages as a checkbox list, inactive fields for options that do not apply.
Spacing above the extra actions below forms, clearer wording (default design of site parts, what the site export contains, how Claude saves changes), readable Claude actions in the change log.

News revisions edited over Claude are pruned like in the admin; about 190 lines of unused CSS and 73 unused dictionary entries removed.

Sites update from Kaleta → Updates in the admin (security releases install automatically unless turned off). No database changes.