- Own CSS is parsed on write only. A page whose stored CSS no longer
passes a stricter rule answers 200 and opens in the editor; that one
block loses its CSS. A document read several times in one request is
validated once.
- Settings and theme refuse a write from an outdated form.
- A backup fails when a media file does not arrive completely and
leaves no half directory behind; rotation counts intact backups only.
- The archive update takes its backup behind the maintenance page.
- A package import puts all media in place before removing the old
ones, reports honestly when that fails and keeps a maintenance state
that was already on.
- Restoring replaces the SQLite file in one move and points at pending
migrations.
- Six irreversible actions ask first, in a dialog of the admin's own.
- Ctrl+S in the editor takes the field being typed in along; Delete
no longer removes a block while a dialog is open.
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Update Symfony to 7.4.23 (12 advisories in 8 packages).
- A form can be sent from /beitraege, /kategorie/... and /schlagwort/...;
it answered 404 before anything was stored or mailed.
- Booleans reach the database as integers, so MySQL in strict mode
accepts form submissions, task switches and plugin states.
- A stepped form with a required multiple choice shows its message
instead of stopping on a TypeError.
- The second update step runs under the update lock; a concurrent
finish no longer rolls a successful update back.
- Accordion entries and gallery images can be selected from the
editor panel again.
- Category and tag names are escaped in the archive heading.
- Restoring a published page from the bin needs the publisher role.
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
- The installer only opens with a per-installation key that install.php
creates and shows; the key is deleted with the first account.
- Lock files keep .env, the database, backups and logs out of reach when a
domain points at the project folder instead of public/.
- Linked sections render by their own schema version, so an old section
cannot carry unfiltered HTML into a newer page.
- Editors no longer move, trash or change areas and post data of published
pages; a scheduled publication goes live with the revision that was
scheduled (migration 20261012000100).
- Form stamps are bound to their form, IPv6 senders count per /64, and a
flood per form or overall stops storing with a visible message.
- The consent redirect rejects control characters, update targets must look
like 1.2.3, and own CSS cannot reach outside its block.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Forms gained steps, conditions, image choices, number fields with units and a
summary step; the DEEG price finder uses all of it. Plugins are manifest plus
Twig: blocks, settings, containers, routes, presets and theme packs, switched
per installation. The review backlog is done: archive pages render through the
normal page pipeline, forms and post lists work inside areas and sections,
repeated sections get their own ids, breakpoints and colours come from the
palette, backup and update work on MySQL and lock each other out.
The task worker no longer shortens a process that has no time limit:
set_time_limit() sets the limit instead of extending it, which turned an
unlimited CLI run into eighty seconds and killed the full test suite far away
from the scheduler.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kantarciandClaude Fable 5.2