CPalius CMF 2.2.0

Released: 2026-09-22 · Channel: stable · Critical: no

This release ships DNS Tools as a first-class module: a public catalogue of diagnostics, header search, keyed REST, Studio per-tool SEO, and a one-shot inbox for spam scoring. Studio also gains a rebuild desk. Sitemap sources are tagged so a module can contribute URLs without a core edit.

What's new#

DNS Tools. Fifty-plus public tools under /dns-tools: lookup, mail policy, SSL, IP, generators. Each tool has its own SEO page. Probes never use shell_exec. Private, loopback and metadata targets are rejected. SMTP never sends mail. AXFR never returns zone contents.

Studio catalogue. Operators can enable or disable a tool, override titles and meta, and pick a forum board for "ask this field". Disabled tools 404 and leave the sitemap.

Header search. SearchProviderInterface now includes enabled DNS tools by title, slug and keywords.

Spam score inbox. Each visit can mint t{hex}@catch-all. Mail arrives through signed JSON at /hooks/dnstools.inbound-mail, .eml files in var/dnstools-inbox, or optional IMAP. A pasted raw source still scores without a mailbox. Score is 0–10 from SPF/DKIM/DMARC, PTR and DNSBL. Raw mail is dropped after scoring.

Keyed REST. GET /api/dns-tools is public. GET|POST /api/dns-tools/{slug} needs dnstools.query and an API key. The browser route stays CSRF-protected.

Studio rebuild desk. Cache, blog categories and forum counters rebuild in batches instead of one long request.

Tagged sitemaps. SeoSitemapSourceInterface is collected with a tagged iterator. DnsTools publishes /sitemap-dnstools-{locale}.xml.

Login return path. After sign-in the visitor lands on the page they asked for, not a hardcoded home.

Fixes#

Settings seeder no longer trips the N+1 guard. Missing DnsTools keys are loaded in one IN (...) query.

Forum new-topic prefills the title only. "Ask this field" opens a board picker, then the compose form with an empty body.

Upgrade notes#

Activate DnsTools. cp-core/config/active_modules.php already lists it in this zip. After the panel update, open Studio → DNS Tools once so defaults seed. Then empty cp-core/var/cache/prod/ (leave the folder).

Catch-all is optional. Spam score works as paste-only until you set a catch-all domain and webhook secret in Studio.

If you deploy by FTP rather than through the panel, clear cp-core/var/cache/prod/ after uploading — leave the folder, empty its contents. Upload public/themes/cpalius-website/dist/ as well.

Known limits#

The inbox does not create mailboxes on the internet. You must point MX at a catch-all you control.

DKIM is not cryptographically verified here. Pass/fail is read from Authentication-Results when present; otherwise only DNS existence is claimed.

Hcms and Hosting are not in this zip. They remain local work and are not activated.