CPalius CMF 2.2.23

Released: 2026-09-25 · Channel: stable · Critical: yes

Three fixes: two crashes and a settings coupling bug that could unexpectedly lock out existing accounts.

Registration email verification no longer forces login verification too#

"Require email verification" at registration and "refuse login until verified" were the same setting, read live at both moments. Turning on email verification for new signups immediately started refusing login to every existing account as well — they had never been asked to verify anything, so they read as unverified the instant the setting existed. There is now a second, independent setting, Refuse Login Until Verified (System Settings → Account → Registration), so registration verification and the login gate can be configured separately. It defaults to on, so a site already relying on the combined behavior sees no change; turn it off to make verification a registration-time nudge without it affecting login.

Admin password change (and any user save with an empty bio) no longer crashes#

Saving a user from AACP — including just changing their password, since it goes through the same full edit form — threw an uncaught InvalidTypeException whenever that user's bio field was empty. The cause was in the form layer: Symfony's textarea field type turns an empty submission into null, and the underlying data object declared bio as a non-nullable string, so the framework's own property writer rejected it before the form was even validated. Fixed by making the field nullable, matching how the admin's own profile form already handled it correctly.

A routine 403 no longer logs with an empty message#

Trying to start a new topic in a forum section without posting rights correctly showed a normal "access denied" page — but the underlying exception carried no message, making it indistinguishable from a real bug in the server log. It now logs what actually happened.

Upgrade notes#

No schema changes. No manual steps. If you use the new setting: System Settings → Account → Registration → Refuse Login Until Verified.