CPalius CMF 2.2.68

Released: 2026-10-16 · Channel: stable · Critical: no

Turkish: 2.2.68-tr.md

A homepage editor with live desktop and mobile preview and a site access mode, a repaired page cache, a performance pass measured on 100,000 users and 200,000 posts, and a security round learned from studying Drupal, TYPO3, MODX, ProcessWire and Sulu.

Homepage and site access#

• New homepage editor (Appearance → Homepage). Every text, link and element of the portal blocks is editable, with a live preview shown as desktop and mobile separately and a screenshot for each choice. Optional SEO fields, and a custom HTML/CSS/JS engine whose script runs in a sandbox with no access to the site, cookies or network.
• Site access mode. Open, sign-in only (the site is an ERP/CRM behind a login) or panel only (no public website). robots.txt disallows everything when the site is not open.
• Tidy Appearance menu. Homepage, Themes, Store, General appearance, Fonts, Theme editor and Studio appearance now sit in one ordered strip.

Page cache#

• Forum pages were never cached for guests. A last-visit cookie and a CSRF token that started a session made almost every guest page uncacheable. Guests no longer receive cookies, so pages are stored, minified and served by the web server.
• Stale-while-revalidate. After a purge one request regenerates the page while the others are served the previous copy.
• Tag index rewritten. Recording which pages depend on which content costs about 3 ms per page instead of 515 ms, no longer loses updates and no longer needs Memcached.
• Pre-compressed pages. Cached pages are stored gzipped (a 40.7 KB blog page is served as 8.5 KB) and static files carry long cache lifetimes.

Performance (measured on 100k users, 20k topics, 200k posts, 100k reservations)#

• Forum home 209 → 60 ms, topic lists 37 → 0.13 ms, a section's topic list 29 → 0.05 ms, hall overlap check 44 → 0.03 ms.
• New indexes on forum topics, users and content; the paginator no longer builds a derived-table query unless a join multiplies rows.
• Forum search is limited per client (a search scans every post) and its results are remembered for a minute.
• The forum index loads each board's last poster in one query. This also brings back the statistics card under the board list in development mode, where the N+1 guard had been silently dropping it.
• Admin dashboard pollers are cached and stop when the tab is hidden; 404 counting is written in batches.
• Tools: cp:perf:probe, cp:perf:routes, cp:perf:seed (refuses any database whose name does not contain "perf"), a per-route cost screen in AACP, and a performance check in cp:doctor.

Security#

• Key rotation. Secrets at rest use a key-id format with a derived key. Put the old APP_SECRET in APP_SECRET_PREVIOUS, set the new one, run cp:secrets:rotate. Recovery codes survive the change.
• Step-up authentication. Applying updates, backups, installing or editing modules and themes, store installs, deleting users, API keys and webhooks ask for the password (and the second factor) again when the last confirmation is older than security.reauth_minutes (default 10; 0 turns it off). A remember-me cookie does not count.
• Extension security advisories. The signed extension index can carry advisories; affected installed versions show a warning in the Store and in cp:doctor.
• Restricted capabilities. Role and override screens mark capabilities that can take over the site, and cp:doctor flags any non-admin role that holds one.
• CSP. The report endpoint also reads the Reporting API format; cp:security:csp-suggest summarises reports into conservative advice.
• Wedding hall bookings. A booking whose lock could not be obtained is refused instead of running unlocked (a double booking was possible).

Database#

Migration Version20261016200000 (user indexes) and Version20261016210000 (content list index). Module SQL adds forum topic list indexes. Both are idempotent.