The mail page under System tries SMTP, PHP mail() and both sendmail
modes one by one or all at once, and saves the chosen way to .env
without ever showing the password. IONOS answers everything under
/.well-known/ itself with 403, so the address and HTTPS checks never
reached the installation; the probe now lives at /kantsites-origin
(ADR 122).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Form submissions marked as not sent gave no reason: the transport
exception was swallowed. Every send now goes through MailCheck, which
logs the server's answer and a hint in German to var/log/mail.log
(server lines only, no credentials). The system screen shows the mail
route, sends a test mail to any address and lists recent attempts
(ADR 121).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
System > HTTPS and cms:https switch the redirect lines in public/.htaccess
only when the site answers over HTTPS, and take them back on a loop. HSTS
is a separate second switch. The redirect block moves before the front
controller rules, where it never reached pages, and .well-known is no
longer denied, so the origin probe works on Apache. The Git updater keeps
switched-on lines like the archive update.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Same-page anchors kept the details menu open. scrolled.js closes it on
any link click and loads only where a collapsible menu holds such links.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
System now exports a content package and imports one, by upload or from
var/pakete. Pages with their revisions, areas, menus, media, forms,
redirects, terms, translations, design and settings are replaced;
submissions, statistics, tasks, plugin state and service keys stay, and
accounts only come along when that is chosen explicitly. A backup comes
first, the site is in maintenance meanwhile, and every file and document
in the package is checked before anything is written.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The open burger menu now closes when someone clicks elsewhere, without a
script: an invisible layer that belongs to the menu button covers the
page while the menu is open. Facebook, Instagram and WhatsApp join the
icon set, so menu buttons can carry them. The stroke attributes of every
icon move into the stylesheet, which saves about 4 KB per page.
Hüfner gets a right-aligned menu with the quote button, Facebook and
Instagram as menu buttons.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- The installer only opens with a per-installation key that install.php
creates and shows; the key is deleted with the first account.
- Lock files keep .env, the database, backups and logs out of reach when a
domain points at the project folder instead of public/.
- Linked sections render by their own schema version, so an old section
cannot carry unfiltered HTML into a newer page.
- Editors no longer move, trash or change areas and post data of published
pages; a scheduled publication goes live with the revision that was
scheduled (migration 20261012000100).
- Form stamps are bound to their form, IPv6 senders count per /64, and a
flood per form or overall stops storing with a visible message.
- The consent redirect rejects control characters, update targets must look
like 1.2.3, and own CSS cannot reach outside its block.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
consent.js posts the consent form in the background, the server answers
204 with the cookie, and the script swaps in the embeds and the legal line
from a fresh copy of the page. Embed hosts are in frame-src from the start,
the content address still only after consent. Without JavaScript the form
keeps working with a reload.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Tree green from the logo everywhere, the 100 emoji inline wherever 100
appears, downloads for the exemption certificates and the PQ certificate,
the image video behind consent, Google reviews, a 48-hour quote promise,
WhatsApp, two job cards and a page for the alpacas.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
IONOS answered every rewritten address with a blank Apache 500: the
!-f condition did not recognise the already rewritten index.php, so the
rule fired again until Apache gave up. RewriteBase and an explicit stop
for index.php, as in WordPress, fix it (ADR 114).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Emergency layer logs fatal errors to var/log/notfall.log and answers 503.
The system page checks for a new release on load, shows its notes, runs
backup, download, switch, migration and health check in one flow with live
progress, and switches back automatically when the new version fails.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The request that swaps the files now ends with a plain page instead of running on through the
framework with old code in memory and new code on disk - that is what answered with a 500 after
a successful update. The page calls the second step itself with a one-time key: migrations,
clean-up, maintenance off, back to the system screen (ADR 112).
Turkish is complete in the fixed template texts and form messages. Two language switches on one
page get distinct landmark names. Kantarci Reisen gets a Turkish version of every page, the
header, footer, menu and enquiry form, with a DE · TR switch; the reset script applies it.
The DM Sans 600 files are needed after all and are committed with fonts.css.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A site can have further languages (Settings → Languages). A page is built once; each language
adds only its texts, keyed by the stable block IDs, plus its own address under /en/… (ADR 111,
document schema v27, migration 20261009000100 for page_translation).
- Editor: DE | EN switch, a list of all texts with original, state (missing, translated,
original changed) and filter; structure stays with the main language. Undo, drafts,
publishing and revisions cover all languages at once.
- Website: /en and translated slugs, lang, canonical, hreflang with x-default, og:locale,
sitemap; links to translated pages follow the language; a language switch block.
- Header, footer and linked sections translate the same way; menu entries carry labels per
language; fixed template texts come from a small dictionary.
- Forms: labels, help, options, button and success message per language; messages and the
step script speak the language, the submission and the email stay in the main language.
- Posts, archives, category names, consent text and the 404 page follow the language.
- Single-language sites see none of it and never touch the new table.
The forms administration becomes an overview with one row per form and its own edit page;
fields are one line each with details collapsed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Seed, reset and asset scripts for the tenth installation, plus dev and prod launch entries
for it and for the multilingual test copy.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Check labels spanned the full width, so a click in the empty middle of
"Als Button darstellen" unticked it and folded the menu button settings.
The label now ends after its text.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The menu editor gets "Als Button darstellen" per entry: shape, appearance and
size from the button design, fill and ink with hover and palette, icon colour,
icon from the dialog, motion, icon-only and where the button sits on the phone
(in the opened menu, beside the burger, or there as an icon only). Colours go
into the page stylesheet under a stable per-button id because the CSP forbids
inline styles. ADR 110.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Since 1.25.0 the icon set has a truck, so the fleet advantage no longer needs
an own-HTML block with the template's SVG. The seed builds it like its three
neighbours (icon block, 32 px, light green); the local Hüfner database was
patched the same way and republished.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The icon set grows from 33 to 98 drawings in seven categories (arrows,
contact, commerce, files and media, people and security, house and trade,
general), including truck, cart, euro, camera, tools and solar. icons.js is
the single source; npm run build:icons writes the Twig drawings and the
validator list, and a test keeps them equal.
Choosing an icon no longer fills the panel with tiles: the panel shows the
current icon with "Change", which opens a modal with category tabs and named
tiles, keyboard navigable, closing with Escape. Button, icon and icon card
share it.
A new style group "Symbol" targets the icon inside a button per device and
on hover: colour, background, size, padding, radius, rotation, plus the gap
to the text. Schema v26 adds hover motion (slide, reveal) and an icon-only
button whose label stays as the accessible name and keeps the line height.
ADR 109.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Schema v25: a button takes an optional icon (any name from the shared set or
"none") and an icon position (start or end). Without a choice it keeps the
diagonal arrow behind the text, still with the button-arrow class, so stored
pages and their own CSS look exactly as before.
Thirteen everyday icons join the set (arrow down, chevron, calendar, message,
send, download, document, play, search, heart, info, plus, person). Button,
icon and icon card choose from a tile picker with a drawing per icon, grouped,
keyboard navigable, instead of a select with English keys. icons.js holds the
paths for the editor; a test keeps them equal to the Twig drawings and the
validator list. ADR 108.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Website of Garten- und Landschaftsbau Hüfner GmbH rebuilt from the delivered design with
imprint, privacy, 404 and the enquiry form (scripts/reset-huefner.sh, ports 8102/8103),
Barlow and Barlow Condensed served locally with their licence.
- Buttons, icon cards, calls to action, icons and linked images accept tel: and mailto:
links, the same targets menus and rich text already allowed (ADR 107).
- The arrow inside a button takes the button's text colour instead of the accent colour.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- /eroeffnung (noindex, unlinked): opening hero, offers embedded from
app.kantarci-markt.de without title and app button, app store buttons,
visit section with route, hours and contact placeholders.
- The height script on the embed asks the app for its height once it runs
(it is deferred and missed the first report) and scrolls to the offer
popup when the app reports it outside the viewport.
- audit.mjs takes CMS_HOST_RULES, because the app allows framing only from
localhost while the server listens on 127.0.0.1.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Coming-soon page "Kantarci Markt – Neueröffnung" rebuilt from the delivered package with
imprint, privacy and 404 (scripts/reset-kantarci-markt.sh, ports 8100/8101).
- Own CSS accepts a short quoted string for `content`, so ::before/::after work.
- cms:fonts:fetch replaces only the rules of the fetched families in fonts.css.
- A variable font is linked and preloaded once with a weight range instead of once per weight.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
