CPalius CMF 2.2.46

Released: 2026-10-12 · Channel: stable · Critical: no

Extension store

AACP → System → Extension store: browse the signed catalogue of modules and themes, install the free ones in one click and apply updates. Packages come from com.net.tr/CPalius/modules/ and themes/; the catalogue (extensions/index.json) is signed with the publisher key, has an expiry and cannot be rolled back. Every package is checked against the SHA-256 in the signed catalogue before it is opened.
Updating an active module runs under the guarded update flow: a database snapshot, the 503 maintenance page, and a rollback of files and database together if a step fails.
Core updates no longer touch cp-content/modules/ and cp-content/themes/. Modules and themes update through the store. A core update is also blocked, with a hint, when an installed module does not support the new core version.
A parked update with nothing left to run is now closed automatically instead of leaving the site in maintenance mode.

AACP → Security → Malware scanner: Off (default, nothing runs), Manual, or Manual plus automatic checks of uploads and module/theme packages. Findings can be ignored (tied to the file hash) or moved to quarantine and restored later. Built-in rules only; no outside data is fetched.

The AACP header search works now and Studio has one: pages, users and content as you type (/ or Ctrl+K to focus). List filters (users, logs, trash, posts, media ...) refresh as you type.

The WAF no longer blocks saving an article in the panel because the text mentions .env or contains a code sample. Body fields of staff POSTs are no longer scanned; everything else still is.
The Forum statistics card appears on forum pages only.
Theme stylesheets now publish the fonts and images they reference, so icon fonts (for example Tabler in the Ağasar theme) are no longer missing. Outside CDN references were removed from the Ağasar theme.
entity.type.* labels in the AACP volume card are translated.
N+1 warning on the Showcase type list: field definitions load in one query, also when the cache is cold.

php cp-core/bin/console cp:showcase:seed-catalog lists the CPalius modules, themes and core parts in the showcase and can be run again at any time.

One "Portal Yönetimi" menu in Studio: overview, submissions and comment moderation, polls, dictionary, ads and all portal settings.

No schema changes. Clear cp-core/var/cache/prod/ after updating, and the Redis cache if you use one.