CPalius CMF 2.2.59

Released: 2026-10-13 · Channel: private · Critical: no

Security#

• A signed-in administrator can no longer lock themselves out: the address of an administrator with an open session is exempt from IP bans and cannot be auto-banned. The entry is removed at logout, or 30 minutes after the last administrator request. It lives in the cache, not the database.
• The request guard no longer signature-scans content saves of a signed-in administrator on a short, exact list of routes (docs page save, translation desk save, module editor and theme editor lint/save, POST only). Markdown rules (--) and code samples matched the SQL-comment signature and could ban the site owner for a day. The ban list is still checked first and every other request is scanned as before.
• Fixed a double-escaped meta description in the static head of "shield" cached pages.

Updates#

• Administrators are notified when a new version of the core, a module or a theme is available. The core.release_check job now runs every 6 hours, also refreshes the signed extension catalogue and puts one notification per item and version into every administrator's bell (AACP and Studio).

Modules#

• module.json accepts "extends": "<Module>": an add-on of another module. The parent is required automatically; the module list and the store show an "Add-on of <Module>" badge. Messages is now a Forum add-on.
• Widget API: WidgetArea has an owner module, WidgetRenderContext carries the module and the active theme, and ScopedWidgetTypeInterface lets a widget type belong to certain modules.
• New icons book-open and arrow-up-tray (the Studio Docs menu entry had none).

Documentation#

• The documentation bundle is refreshed: new "Security and IP bans" and "Performance and cache problems" pages in the module chapter, how to lift an IP ban (panel, SQL, recovery console), updated Widget, SEO, Messages and Docs chapters, and the 2.2.59 notes in the release history.

Extension store (separate updates)#

• Seo 1.3.0: SEO health check, redirects and 404 log moved under the SEO menu; documents can carry their own hreflang alternates.
• Widget 2.1.0: placement (also show in other areas, themes, schedule), copy to another area, areas grouped by module.
• Forum 1.3.0: forum widgets (latest, new and popular topics, board statistics) and the forum_sidebar area.
• Messages 1.1.0: add-on of Forum; its admin screens moved under the Forum Studio menu.
• Docs 1.4.0: schema.org TechArticle and breadcrumbs, canonical, per-page hreflang, docs sitemap, docs widgets (docs_aside).

Database#

No schema changes.

Upgrade notes#

Run the update from AACP → Updates, then update Forum, Widget, Seo, Messages and Docs from the module store ("Update all"). Forum, Widget and Docs need core 2.2.59.