CPalius 2.2.4 – 2.2.24: installation, security, update and visitor statistics

We talked about 2.2.3in our last blog post: the import really started to work, the forum took a breath. 21 version output — many within the same weekend. We haven't covered any of this on the blog, so this post is a little long: from installation to security auditing to the end-to-end hardening of the update system, one by one.

Installation and appearance: 2.2.4, 2.2.5, 2.2.6

With 2.2.4, CPalius received a proper zip installation: it asks for database information and the first admin account, marks its email as verified, opens with a single blog post and a single forum post. Optional modules such as roadmap, showcase remain closed by default. In the same version, settings such as logo, favicon, sharing image, theme colors, navbar height were added under AACP → Appearance; mail/DNS toolsthe page has also been redesigned (search, featured tools, a spam score screen with a residual indicator).

But the CSS that 2.2.4 compiled on the server was deleting the running style file when the Tailwind compilation failed-each page spun 500. 2.2.5. corrected this urgently: compiled CSS now comes in the package, the updater puts it in place and compiles it.

2.2.6In, an update was silently reopening modules that the operator had shut down — the list of modules was also crushed by that of the package because the update files came from the package. Now the update only updates the code, the module does not touch the on/off list.

One week's struggle with the update system: 2.2.7, 2.2.9, 2.2.11 – 2.2.19

We do not hide this part, because the tutorial: one "old container" error in a row through nine releases came back in different disguises, each time fixing a real but neighboring problem, reaching the root cause last.

• 2.2.7: A SQL migration parser was silently skipping some real commands as "comment lines" (the Whitepaper module's table never formed) — fixed, affected installations were self-repaired. Fixed an out-of-date container run of the asset build in the same release, a module error that could bring down the entire site, and a crash on the forum homepage.
• 2.2.9: "Update" looked like a single click and actually wanted two clicks. Now the first request automatically triggers the second as well.
• 2.2.11: Deleting a module's files manually without deactivating them could crash other pages. In the same version, a hidden dependency on the Forum's Importer module and the fact that seven different places independently queried the same table and forced the query budget were eliminated.
• 2.2.12, 2.2.13, 2.2.14: Different triggers of the same crash — the container cleanup/recompile assurance was first added to the individual call points, eventually moved to the single common method where all eight points passed.
• 2.2.15, 2.2.16: Root cause: one update, without running database migrations ago cleaning the container, and some Symfony incidents could trigger a forced cleaning in the middle of the request. The sorting has been fixed, the force path has been completely removed.
• 2.2.17: No functional changes — just skipped a version number to test this description. Test passed.
• 2.2.18: The same error class is output once again on the module delete screen of the AACP — corrected.
• 2.2.19: A busy page was sometimes logged as “query budget exceeded”, with several separate readings reduced to a single shared cache.

It's been a long time, but the result is clear: the update mechanism is now really reliable.

Safety inspection: 2.2.10

We did an end-to-end security check of the codebase and found six real problems — none of them were exploited, all of them were turned off in this version: Redis password can be stored in plain text, session key conflict in shared Redis, login screen discloses account status before password check, AI translation is open to hidden XSS, forum moderator screen is not cleared to biographycontent can be written and SSRF protection in DNS tools can be circumvented by DNS-rebinding. All switched off without manual operation.

Security Center and Visitor Statistics: 2.2.20 – 2.2.24

• 2.2.20: Security incidents and pageviews no longer share the same table. The unread/draft/my-topics strip in the forum has been moved to the bottom of the board.
• 2.2.21: Security Center now shows live threat streaming, attack vectors, and most recurring IPs. The page views count has been moved to the optional VisitorStats module.
• 2.2.22: Threats/findings in Security Center were reduced to one card, two tabs; VisitorStats table turned into daily/monthly bar charts.
• 2.2.23: Registration email verification and login verification have been parsed (so that one does not lock the other), admin registration crash with empty bio, and a 403 error that remains silent in the forum has been fixed.
• 2.2.24: VisitorStats' graphs have been refreshed — the daily view is now a soft line/area graph, the monthly view bar graph showing the total visit and the individual visitor together.

And now?

2.2.24 is the most current stable version as of today. No schema changes, nothing to do manually — just hit "Update"from the AACP. We are on the forum for your questions and feedback.