- Own CSS is parsed on write only. A page whose stored CSS no longer
passes a stricter rule answers 200 and opens in the editor; that one
block loses its CSS. A document read several times in one request is
validated once.
- Settings and theme refuse a write from an outdated form.
- A backup fails when a media file does not arrive completely and
leaves no half directory behind; rotation counts intact backups only.
- The archive update takes its backup behind the maintenance page.
- A package import puts all media in place before removing the old
ones, reports honestly when that fails and keeps a maintenance state
that was already on.
- Restoring replaces the SQLite file in one move and points at pending
migrations.
- Six irreversible actions ask first, in a dialog of the admin's own.
- Ctrl+S in the editor takes the field being typed in along; Delete
no longer removes a block while a dialog is open.
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Update Symfony to 7.4.23 (12 advisories in 8 packages).
- A form can be sent from /beitraege, /kategorie/... and /schlagwort/...;
it answered 404 before anything was stored or mailed.
- Booleans reach the database as integers, so MySQL in strict mode
accepts form submissions, task switches and plugin states.
- A stepped form with a required multiple choice shows its message
instead of stopping on a TypeError.
- The second update step runs under the update lock; a concurrent
finish no longer rolls a successful update back.
- Accordion entries and gallery images can be selected from the
editor panel again.
- Category and tag names are escaped in the archive heading.
- Restoring a published page from the bin needs the publisher role.
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Seed, asset and reset scripts for Becker - Just In Time e. Kfm.
(Wiernsheim): logo cut from the PDF raster, logo-free photos generated
with ChatGPT, before/after slider, service pages, contact form, legal
pages. Launch configs on ports 8116/8117, Manrope 800 and Montserrat
700/800 fetched locally.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
"house" is a closed house shape with the door cut out, next to the
existing line-drawn "home". Written through scripts/build-icons.mjs
into the Twig template and the validator allowlist.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Phones turn glyphs such as arrows and crosses into emoji. The viewer, scroll button, video toggle, menus, breadcrumbs, pagers and quote stars now draw SVG.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A plugin can now bring a plugin.php that registers hooks, scheduled tasks, its own tables, public pages and admin screens. Failures stay contained to the plugin; a form on a plugin page can be submitted.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Three optional settings extend LocalBusiness: a subtype from a fixed list, coordinates as a pair, and a logo from the media library. Without them the output stays as it was, and stored settings need no migration.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The pause and play labels were missing from the kant_t dictionary, so
English and Turkish pages showed them in German. video.js now skips a
data-video-loop without its toggle instead of throwing and leaving every
later video still, and the design panel puts size and spacing first for
the video block.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Videos join the media library as their own table (schema v28), with a
video block and a looping background on sections. video.js starts loops
only while visible, offers a pause button and leaves the still image for
reduced motion and data saving.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PWYm8kjAWmZaB2QB2xuBhU
KantTresor instances (from 1.82.0) report to /api/kanttresor/melden with the
same key-then-HMAC protocol. The new tab lists them with tenants, disk usage
and failing services; it never offers or accepts an update order, since
KantTresor is updated with ./update.sh on the server. See ADR 124.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Mark sites reporting a PHP release without the php2shell fixes
(CVE-2026-109618/-109619; patched in 8.2.35, 8.3.36, 8.4.27, 8.5.12)
or an end-of-life branch (8.1 and older). The overview gets a counter
tile that doubles as a filter, a status pill per row and PHP in the
search; the detail page explains that the hoster has to update.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every installation now reports address and version to sites.kant-it.de
every 15 minutes and picks up update orders there (ADR 123). Reports and
answers are HMAC-signed with a per-installation key sent on first
contact; an order can only install a published release with checksum.
The next request after the file swap runs the migrations, so a remote
update finishes without anyone in the admin.
The platform itself lives in zentrale/ (plain PHP + SQLite, not part of
the release archive): overview with outdated, silent and unassigned
installations, single and bulk updates, per-site detail and history.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Rebuild of ebi-immobilien.de (Karlsruhe) in its own installation on
ports 8106/8107: home page, search request and valuation as step forms,
contact, legal pages and redirects for the old WordPress addresses.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Text in admin cards had no size of its own, so 16px browser default sat
next to 13px notes; cards now use 13px throughout while fields stay at
16px for iOS. The mail page gets option cards, a 2x2 SMTP grid, a styled
save button in the card foot and a log with status pills and collapsed
server messages, plus "Protokoll leeren". The package card uses the same
sections and a styled file picker. The E-Mail-Versand subitem only shows
inside System and sits beside it in the horizontal strip.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The mail page under System tries SMTP, PHP mail() and both sendmail
modes one by one or all at once, and saves the chosen way to .env
without ever showing the password. IONOS answers everything under
/.well-known/ itself with 403, so the address and HTTPS checks never
reached the installation; the probe now lives at /kantsites-origin
(ADR 122).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Form submissions marked as not sent gave no reason: the transport
exception was swallowed. Every send now goes through MailCheck, which
logs the server's answer and a hint in German to var/log/mail.log
(server lines only, no credentials). The system screen shows the mail
route, sends a test mail to any address and lists recent attempts
(ADR 121).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
