Release Kaleta 3.9.2 – security and fixes · phprs-cms/kaletacms

A security and fix release. Updating is recommended for every site.

Security

Media files from a Kaleta export (Medium): importing a site export could place a file with a script extension inside its name, such as photo.php.jpg, into Media. On some Apache hosts such a file could run. The import now refuses these names, and media/.htaccess blocks a script extension wherever it stands in a file name, in upper or lower case. System status names any such file already in Media – check it and delete it over FTP. Existing sites get the new media/.htaccess automatically with this update; if you changed that file yourself, it stays and System status asks you to carry the new rule over.
nginx: the example configuration (system/nginx.example.conf) now also blocks the files of add-ons outside their public/ folder and script extensions inside media file names. If your site runs on nginx, copy the changed media/ and extensions/ rules into your server configuration by hand.

Found while moving a real WordPress + Breakdance site:

SVG logos keep their colours.
Images and links in formatted text work on item pages.
{{obrazek}} in a template shows the item's image.
The pre-publish check and the site audit report a list of a missing collection or category.
An image with a maximum width never overflows a phone screen.
Links in dark bands keep a readable colour.
A list set to a hidden category still shows its items.

A collection created from a preset (jobs, team, services…) – over Claude or in the admin – is now written in the site's language, with about 90 texts translated into Czech, German, Spanish, French, Italian, Polish and Slovak.

Update from Settings → Backups and updates.