Encrypt CMS Logo
EncryptCMS v1.3.6 Stable
Demo
Version History

Changelog & Release Notes

A documented chronicle of every official release, architectural refinement, and security update for Encrypt CMS.

v1.3.6

Latest Stable

Extension Updater Authorization Fix, HTTP 403 Resolution & Packaging

Resolves commercial extension update authorization by aligning the updater with the Central License Infrastructure authenticated package delivery protocol, adding granular token diagnostics and enforcing pre-extraction integrity.

406 Automated Tests Passing (100% Pass Rate)

Security Enhancements

  • Strict Decoupling: Core CMS updates remain strictly managed by CoreUpdateService and decoupled from commercial licensing.
  • Pre-Extraction SHA-256 Validation: Downloaded archives are verified against the authoritative 64-character checksum before directory replacement.
  • Zip Slip Defenses: Archive member path normalization prevents directory traversal sequences, with atomic pre-update backup and automatic rollback.

Bug Fixes & Corrections

  • Commercial Plugin & Theme Update Authorization: Aligned ExtensionUpdateService with the Central License Infrastructure authenticated package authorization workflow (POST /api/v1/packages/{slug}/download).
  • Resolved HTTP 403 Forbidden when updating commercial ecosystem extensions (such as encrypt-stackcache from v1.0.4 to v1.0.5).
  • Installation-Token Bearer Authentication: Enforced Bearer tokens and domain binding validation for single-use signed download tokens.
  • Enhanced Download Error Diagnostics: Granular handling for token lifecycle states (DOWNLOAD_TOKEN_EXPIRED, DOWNLOAD_TOKEN_ALREADY_USED, NOT_ENTITLED) without credential leakage.

Improvements & Refinements

  • Synchronized authoritative Core version 1.3.6 across application configuration, front controller, services, and layout templates.

v1.3.5

Feature Release

Simple Comment System, Threading, Moderation & Cache Compatibility

Introduces single-level threaded discussion replies, per-post comment moderation controls, session-bound pending comment receipts, and real-time reverse proxy cache revalidation.

383 Automated Tests Passing

New Features & Additions

  • Simple Comment System: Single-level threaded replies via parent_id with database indexing (idx_comments_parent).
  • Per-Post Moderation Controls: Toggle comments open/closed per article via comment_status enum.
  • Session-Bound Pending Receipts: Comment authors can preview their comments awaiting approval while remaining hidden from the public.
  • Async CSRF Lifecycle: Dedicated endpoints (/comments/token, /comments/confirm) allowing public pages to remain edge-cacheable by reverse proxies.
  • Admin Moderation Suite: Comprehensive interface at /admin/comments for approving, rejecting, spam flagging, and direct admin replies.

Security Enhancements

  • Origin Verification: Request origin gates preventing cross-site comment submission attacks.
  • Fail-Closed Entitlement Discovery: Commercial products with unknown authorization status are excluded from Store views.

Bug Fixes & Corrections

  • License Status Page Class Resolution: Resolved class resolution on PHP 8.2 shared hosting, eliminating HTTP 500 error on /admin/license.
  • Plugin Settings Route Prefix: Corrected core router prefix reservation to allow legitimate plugin settings routes to register properly.

v1.3.4

Maintenance & Customizer

Theme Customizer Service, Visual Identity & Sanitization

Implements live visual customizer controls for site branding, typography, and color schemes with strict anti-XSS CSS sanitization.

320+ Automated Tests Passing

New Features & Additions

  • Theme Customizer Engine: ThemeCustomizerService with live visual previews for logos, colors, navigation menus, and typography.

Security Enhancements

  • CSS Sanitization: Anti-XSS validation and sanitization for custom CSS injections.
  • Fail-Closed Entitlements: Prevents unverified commercial products from appearing when upstream responses omit explicit grants.

v1.3.3

Maintenance Release

Core Updater HTTPS Qualification & Atomic Locking

Hardens the core update delivery pipeline with strict HTTPS transport qualification, approved distribution host enforcement, and process locking.

290+ Automated Tests Passing

Security Enhancements

  • HTTPS Download Qualification: Enforced HTTPS for all core update package downloads and restricted hosts to approved distribution servers.
  • Atomic Process Locking: Storage framework update.lock prevents concurrent or interrupted updates.

Bug Fixes & Corrections

  • Pre-Extraction Hash Validation: Aborts update immediately if downloaded archive SHA-256 does not match authoritative manifest.

v1.3.2

Security Hardening

Archive Traversal Defense & Zip Slip Elimination

Implements pre-extraction archive security boundaries, path normalization, expansion bounds, and pre-update rollback snapshots.

260+ Automated Tests Passing

Security Enhancements

  • Zip Slip Prevention: Full path normalization and validation blocking directory traversal (..) sequences in uploaded archives.
  • Decompression Bomb Bounds: Capped compressed archives at 50 MB, expansion at 200 MB, 5,000 files, and max 20:1 ratio.
  • Atomic Rollback: Pre-update snapshot archive creation with automatic restoration if extraction fails.

v1.3.1

Extension Architecture

Central Licensing Integration & Plugin Hook Subsystem

Introduces Ed25519 asymmetric signature verification, offline grace windows, and the App\Core\Hook action and filter event bus.

220+ Automated Tests Passing

New Features & Additions

  • Action & Filter Hook Subsystem: Event bus via App\Core\Hook for modular plugin lifecycle integrations.
  • Central Licensing Integration: Asymmetric Ed25519 signature verification with a 14-day offline grace window.

v1.3.0

Major Release

Production-Ready Architecture & Shared Hosting Deployment

Initial general-purpose production release with full-page content editor, native SEO engine, media library, and 20i StackCP shared hosting readiness.

180+ Automated Tests Passing

New Features & Additions

  • Production Engine: Native PHP 8.2+ with PDO strict prepared statements, zero production Node.js or Composer requirement.
  • Guided Web Installer: 4-step wizard checking PHP extensions, permissions, database setup, and storage/installed.lock.
  • Dedicated Content Editor: Full-page distraction-free post editor with SEO meta box and taxonomy hierarchies.
  • Approved Visual Design: Retains 100% of the approved high-contrast visual design, dark/light theme toggle, and responsive drawer.