CPalius CMF 2.2.42

Released: 2026-10-06 · Channel: stable · Critical: no

Themes

New theme Githeme: a high-contrast light/dark theme inspired by GitHub's Primer design language (system fonts, 6px corners, 1px borders, compact density). The header has a light/dark switch that remembers the choice. Templates it does not ship (blog, forum, account and so on) come from the Default theme, so Githeme needs Default to stay installed.
The original theme is now listed as Default in AACP.
AACP → Appearance has a new Themes entry. Every theme card shows a preview image: set screenshot in theme.json, or put screenshot.png, .jpg, .webp or .svg in the theme folder. A theme whose theme.json lists a missing CSS or JS file shows a warning, and such a theme can no longer be installed or activated.
Theme assets are now resolved with cp_theme_url('dist/style.css'): the active theme first, then the other installed themes. The file is copied to public/themes/ on first use, so a theme installed from a ZIP no longer loads without styles. Asset URLs carry a version (?v=), so updated CSS and JS reach visitors at once. The error page and the forum statistics card follow the active theme too.

The statistics card above the footer now shows on every public page except the home page, not only in the forum.

The home hero has a large All tools button under the logo, and the logo no longer sits on a white box.

Forum topics always carry a text value in their structured data, which clears Google Search Console's "text, image or video must be specified" error for topics whose opening post could not be read.

/cron/execute no longer accepts the token in the URL. Call it with POST and Authorization: Bearer <token> (or an X-Cron-Token header). A GET request now gets 405 and a wrong token 401. Update your crontab after upgrading, otherwise scheduled jobs stop running. AACP → Cron shows the new line to copy.

Inline onsubmit, onclick and onchange handlers in the admin and module templates were replaced by data-confirm and data-autosubmit attributes handled by one script, so the strict (nonce) CSP mode can be used for the admin panel. The default stays report-only.
Theme ZIPs are refused when they contain PHP files, .htaccess, .user.ini, web.config or symbolic links, more than 3000 entries, or unpack to more than 128 MB.
Pages served straight from the page cache now carry X-Content-Type-Options, Referrer-Policy and X-Frame-Options.

Appearance colors and sizes are now stored per theme; logo, favicon and the social image stay shared. Existing settings stay with the Default theme.
A theme card lists the page areas the theme does not ship itself (they come from another installed theme).
site_home is a theme-neutral name for the home page route; the old name keeps working.

Private messages pages are noindex, nofollow.
Showcase has titles, canonical URLs, structured data (with an offer when an item has a price) and a sitemap source for published items. Member screens stay noindex.
The social image from the appearance settings feeds the SEO fallback chain, and the themes no longer print a second og:image tag.

Inline <style> blocks of DnsTools, Messages, Showcase, the maintenance page, the admin home and the page theme now carry the CSP nonce.
Per-page custom CSS and JS can only be changed by users with system.settings.manage; other editors' submissions leave the stored values untouched. Stored values are also neutralised at render time against </style and </script breakouts.
The blog read counter is limited to 6 pings per minute per IP and post.
Themes can ship their own translations in Resources/translations. They load below module and core translations, so a theme can never override a core key. The AACP translation editor lists theme catalogues.
Theme ZIPs are checked before install: a .twig or .css file that fails to parse rejects the package and is listed as file: message.
One shared theme discovery now backs the runtime and the compile-time pass; a database problem during container build is logged.
Fixed a crash in the theme card's "not fully shipped" report.
Whitepaper pages get a real SEO title and description, DNS tool pages emit SoftwareApplication structured data, and Showcase sitemap entries carry hreflang alternates. No database changes. Clear cp-core/var/cache/prod/ after updating.