CPalius CMF 2.2.26

Released: 2026-09-26 · Channel: stable · Critical: no

A design, accessibility and security pass across the public homepage, blog and forum. No schema changes.

Security#

• Member bios and blog/page bodies are sanitized when rendered, not only when an admin form saves them. The migration importer wrote them unsanitized, so an imported profile could carry script onto public pages.
• cp_thumb no longer turns a remote image URL into a broken /uploads/https://… path.

Forum#

• Long topics no longer stay blank on phones (the scroll-reveal could never trigger on very tall content).
• Forum index and search have a proper H1; search fields are labelled; the index title no longer repeats "CPalius Forum".
• Activity tabs, hover cards and the image viewer work from the keyboard; quoting a selection works on touch screens; sharing a post confirms the copy.
• "Edited by" no longer appears on posts nobody edited; the relative time no longer repeats the date.
• Profile card stacks on phones; small metadata text is larger; avatars load as thumbnails.

Blog#

• Dates in the reader's language ("22 Eyl 2026" / "Sep 22, 2026").
• Tag pages show the tag name; reading time shown once; proper heading order.
• The featured strip no longer scrolls on its own.
• Covers and avatars are served at display size.

Homepage#

• New hero: download the latest release, whitepaper second, a real #[CpResource] example instead of the animated orb.
• Forum feeds removed from the homepage (the forum stays at /forum).
• Navigation collapses below 1200px instead of hiding sign-in on laptops and tablets.
• Copy fixes: the missing words in the English subtitle, PHP 8.4+ in the footer, "Roadmap" instead of "Chapter 10".

Everywhere#

• Link, button and meta text colours meet 4.5:1 contrast; a visible keyboard focus ring; a skip-to-content link and <main> landmark; reduced-motion settings are respected.
• The language switcher no longer loads flag images.