Skip to content

phpwcms v1.12.3

Latest
Latest

Choose a tag to compare

View all tags
@slackero slackero released this 19 Jul 17:45
v1.12.3
b8ebd5c
This commit was signed with the committer’s verified signature.
slackero Oliver Georgi
GPG key ID: 0D2C22650381B310
Verified
Learn about vigilant mode.

This release consolidates security enhancements, performance optimizations, modernized libraries, and bug fixes accumulated since v1.12.0.

🛠️ Editor & Session Fixes

  • WYSIWYG Editor Config Override: Fixed a bug where session initialization forced the global configured default editor (e.g. TinyMCE 8 / value 2) to legacy CKEditor (1), causing wrong options to be loaded and saved.
  • Profile Selection Persistence: Corrected session storage typing logic to ensure profile editor selections (e.g., selecting CKEditor vs. TinyMCE 8) persist correctly across logins instead of always reverting.

🔒 Security Enhancements

  • Secure User Password Hashing: Migrated authentication to use PHP's modern password_hash() instead of legacy MD5 hashing in the setup process, new user creation, account profile updates, and login validation.
  • Email Validation ReDoS Fix: Optimized the email address regex pattern in client-side script validation (phpwcms.js) to prevent potential Regular Expression Denial of Service (ReDoS) backtracking vulnerabilities, while adding plus-addressing (e.g., user+tag@domain.com) support.
  • DOM XSS Mitigation: Sanitized and cast dimensions (width and height) using parseInt() in the Ads module templates (ads.js) before outputting to the page via document.write().
  • Stored XSS Prevention: Escaped subscriber email inputs in verify.php to prevent stored XSS vulnerabilities.
  • Modernized Caching Policies: Upgraded Cache-Control header settings to prevent pages from caching incorrectly and secure CSRF redirect targets.

⚡ Modernization & Optimizations (CDN Migration)

  • Code Highlighting (Prism.js): Added modern Prism.js highlighting templates (JavaScript-Prism.tmpl and PHP-Prism.tmpl).
  • CDN Migration & Bloat Reduction: Migrated several third-party libraries to load from CDN by default (with automatic fallbacks to local files if present) and deleted obsolete assets to shrink repository size:
    • Removed local SyntaxHighlighter files (template/lib/syntaxhighlighter/*).
    • Removed local legacy IE polyfills html5shiv and respond (template/lib/html5shiv/* and template/lib/respond/*).
    • Removed local swfobject files (template/lib/swfobject/*).
    • Removed local ie7-js files (template/lib/ie7-js/*).
    • Removed local NonverBlaster Flash player (template/lib/nonverblaster/*).
  • CodeQL Configuration: Configured CodeQL scanning to exclude third-party library vendor files (Mootools, jQuery, TinyMCE, etc.) to keep automated security scans clean.

📦 Dependency & System Updates

  • Composer Dependency Updates: Synchronized and updated vendor production dependencies (include/vendor).
  • PHP 8.2+ Compatibility: Added safeguard checks (like WebP detection in USER_AGENT) to prevent warnings in PHP 8.2+.
  • Version Check Validation: Aligned SSL validation and timeout improvements in the system version checker.

⚙️ Changelog Comparison

For a line-by-line code view of all changes:
Comparing v1.12.0...v1.12.3

Assets 2
Loading