Concrete CMS 9.2.1

13 July 2023

Concrete CMS version 9.2.1 is now available (major release).

Upgrading to Concrete CMS 9.2.1

What's New in Concrete CMS 9.2.1

• Added a thumbnail property to the Feature and Feature Link block types (thanks katalysis)
  
• File manager image editor now supports full screen mode (thanks mlocati)
  

• Reinstated the ability to attach accounts to external authentication providers on the My Account page.
  
• Use User->isRegistered() instead of User->isLoggedIn() throughout Concrete (Thanks mlocati)
  
• Top Navigation Bar now honors replace_link_with_first_in_nav custom attribute (thanks danklassen)
  
• Top Navigation Bar block can now use the site name for branding text if no custom branding text is defined in the block.
  
• Dashboard image editor is now larger (thanks mlocati)
  
• Minor display improvements
  
• First weekday in calendar is now defined by the locale instead of being hard-coded to Sunday (thanks mlocati)
  
• Page Selector and User Selector attributes now work better when used with Express label entry display masks/labels.
  
• Image editor in Dashboard now reloads an image detail page when an asset is edited (thanks mlocati)
  
• Display more details when explaining why a package cannot be installed due to problems in the package controller (thanks mlocati)
  
• Dashboard File Details page now reloads when versions are changed (thanks mlocati)
  
• Improved appearance of Express Entry Details block.
  
• Added optional alphabetical sort to to block type sets using a configuration option (see here: https://github.com/concretecms/concretecms/pull/11292) (thanks mnakalay)
  
• Dates displayed in Site Health reports are now properly localized (thanks mlocati)
  
• Logs Dashboard page now reloads when logs are cleared (thanks mlocati)
  
• Content replacement should be slightly faster when dealing with large amounts of block records.
  

• Many additional stricter code fixes under PHP 8.2 (thanks mlocati)
  
• Fixed: Express form with file upload attributes results in multiple copies of a file in the file manager.
  
• Fixed inability to do Board instance editing of individual slots.
  
• Fixed inability to view site health reports under certain conditions.
  
• Fixed bug where selecting “Force file to download” in a block would result in being unable to un-check and save the setting at a later point (thanks mlocati)
  
• Fixed bug where conversations were not getting a unique ID when being created, leading duplicate conversations when being added.
  
• Fixed some misnamed migrations (thanks mlocati)
  
• Bug fixes to redirect response in GenericOauthTypeController (thanks mlocati)
  
• We now properly pass the type object to the authentication type controllers upon instantiation (thanks mlocati)
  
• Fixed errors importing files in the incoming directory (thanks JeRoNZ)
  
• OAuth service provider: avoid deprecated methods, display errors properly (thanks mlocati)
  
• Fixed bug where adding an attribute to a page via the attributes panel would clear out select attribute options set against that page if they existed.
  
• Fixed: Using the feature block, if the icon is not selected, an exception occurs with PHP 8.x due to an undefined array index (thanks JeRoNZ)
  
• Fixed: Can't bulk edit attributes on page search v9.2 (thanks mlocati)
  
• Fix View pages using a specific block type (thanks mlocati)
  
• Fixed Social links stacking instead of displaying inline (thanks nikkiklassen)
  
• Fixed: Health Check - "Consider enabling logging on tasks." incorrect link
  
• Fixed: If a page doesn't have the tags attribute attached to it but has a Tags Block you will get this error when accessing that page (thanks mlocati)
  
• Fixed some errors when detaching OAuth2 accounts (thanks mlocati)
  
• We now properly pass the item object to user interface menu controllers (thanks mlocati)
  
• Multilingual - Exception when try to reload strings (thanks mlocati)
  
• Fixed: Fixed attempt to read property "pTemplateID" results in null under some very rare circumstances.
  
• PHP 8 Fix: Fix warnings when viewing /dashboard/reports/logs (thanks mlocati)
  
• Fixed error when searching Logs by their severity level in the Dashboard (thanks lemonbrain-mk)
  
• Fixed bug where Express object added to the API was unavailable in the API if it had been added via the in-page form builder.
  
• Fix Undefined property error on PHP 8 in WorkflowAccess class (thanks hissy)
  
• Fixed error when attempting to use the Closure password validator (thanks gregheafield)
  
• Fix Undefined array key "scheme" in redis drivers (thanks mlocati)
  
• Fixed inability to revert page to draft (thanks JeRonZ).
  
• Fixed Feature and Feature Link block types not exporting their files or importing them properly when used with the Migration Tool.
  
• Fixed: Pages with theme defined preset layouts crash when editing if the theme is changed (thanks JeRoNZ)
  
• Fix accessing undefined array index in dialog/block/design.php under certain conditions (thanks mlocati)
  
• Fix ckeditor language path & remove declaration variable $useLanguage (thanks hamzaouibacha)
  
• Fixed error when using sitemap selector that nodes in the unexpanded areas would not be selected when those areas were expanded (thanks deanL-zuiderlicht)
  
• Declare width, height and size in ccmi18n_filemanager object is used in ConcreteFileChooser component so it’s properly localized (thanks hamzaouibacha)
  
• Currently active geolocation library is now properly highlighted. (thanks mlocati)
  
• When given a list of topic node ID's such as tid:54,tid:56, the method updateAttributeValueFromTextRepresentation() only imports the last ID in the list when importing content (thanks JohnTheFish)
  

• Fixed: The email validation with the EmailValidator class gets passed even if it contains emojis (thanks biplobice)
  
• Developers can now define the minimum PHP version required for a Concrete package with the getPhpVersionRequired in their package controllers (thanks mlocati)
  
• Developers can now specify if certain block content fields ought to be run through the content importer replaceContent method, by including them in the $btExportContentColumns protected array in their block controller.
  
• Fix support for C5_ENVIRONMENT_ONLY env variable (thanks mlocati)
  
• Move the on_user_logout event at the end of the logout (thanks mlocati)
  
• Upgrade primal/color third party color parsing library for better PHP 8 compatibility (thanks mlocati)
  
• Add on_before_user_logout, enable customization of post-logout URL (thanks mlocati)
  
• icon-bar class now included in the Navigation fallback asset so themes that the Top Navigatiaon Bar block will support it when using fallback assets.
  
• Add ability to column at a specific position (thanks biplobice)
  
• Added new MemoryOutput class for tasks for diagnostic purposes (thanks mlocati)
  

• Fixed CVE-2023-28477 Stored XSS on API Integrations via name parameter. Prior to fix While adding API Integrations on concrete cms, the parameter name accepted special characters enabling malicious JavaScript payloads impacting /dashboard/system/api/integrations and /dashboard/system/api/integrations/view_client/unique-id. Concrete CMS Security team CVSS scored this 5.5 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N. Thanks Veshraj Ghimire for reporting H1 1753684 and providing the fix. Fixed in commit
  
• Fixed CVE-2023-28476 Stored XSS on Tags. Prior to fix there was no sanitation when adding tags on uploaded files. Concrete CMS Security team scored this 4.5 with CVSS v3.1 AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N. Thanks Veshraj Ghimire and Ashim Chapagain for reporting H1#1767949 and providing the fix. Fixed in commit
  
• Fixed: CVE-2023-28475 Reflected XSS on the Reply form by ensuring msgID is sanitized. Concrete CMS Security team scored this 4.2 with CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N. Thanks Bogdan Tiron from Fortbridge for reporting H1 1772092. Fixed in commit #11279
  
• Fixed CVE-2023-28474 Stored XSS on Saved Preset. Prior to fix, there was no sanitation when saving presets on search. Concrete CMS Security team scored this 3.5 with CVSS v3.1 vector AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N Thanks Veshraj Ghimire for reporting H1 1768494 Fixed in commit
  
• Fixed CVE-2023-28472 Secure and Http only attributes are now set for ccmPoll cookies. Concrete CMS Security team scored this 3.4 with CVSS v3.1 vectorAV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N Fixed in commit #11000
  
• Fixed CVE-2023-28473 possible Auth bypass in the jobs section. Concrete CMS Security team scored this 2.2 with CVSS v3.1 vector AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N Thanks Adrian Tiron from Fortbridge for Reporting H1 1772230. Fixed in commit #11118
  
• Fixed moment.js CVE-2022-24785. Concrete now pulls in updated versions of moment.js Concrete CMS Security team scored this 2.2 with CVSS v3.1 vector AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L Thanks Fortbridge for reporting. Fixed in commit 11085
  
• Fixed: CVE-2023-28471 XSS on container name. Prior to fix, there was no sanitization on the container name resulting in stored XSS. Concrete CMS Security team scored this 2.0 with CVSS v3.1 vectorAV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N Thanks Ashim Chapagain for reporting H1: 1866111] and providing Concrete CMS Pull request #11209
  

• The user autocomplete quickSelect method now defaults to showing user avatars and including usernames and email addresses (if the site is configured to use usernames). This is likely desired for an administrative component but if you’re using quickSelect on the frontend you may wish to restrict this behavior. Consider modifying your usage of quickSelect to use the AUTO_MINIMUM constant and enable/disable user avatars as you like.
  
• Bootstrap Select has been deprecated. It is still shipping with Bedrock but will be removed in a subsequent version update. Update your code to use new Concrete select components instead.
  
• The encryption service (unused by the core) has been removed; there is no replacement built into the core but many third party libraries are available in packagist.
  
• The v-date-picker and v-calendar Vue components have been removed. They are attractive but they are simply too large to include in the JavaScript that powers Concrete. They have been replaced with native solutions. It is unlikely that you’ve included these components in custom code, but if you have you’ll need to import them into your JavaScript bundles yourself.
  
• The vue toggle Vue component has been removed. It was too large to include in the Concrete CMS JavaScript bundle. If you need this functionality use Bootstrap Switches, which are now included and available.
  

• Refinements to the in-page editing experience: better highlight of editable blocks and areas, better delineation of containers, layouts and in-page areas, better hit areas for draggable blocks and much more.
  
• New “Site Health” Hub: run reports against your site to ensure that its optimally configured. Extensible reports engine ships with the ability to check site for production status settings, cache settings, unauthorized JavaScript and more. Learn more at https://www.youtube.com/watch?v=K76xk1E6hPE
  
• Complete 1.0 REST API with coverage of major Concrete CMS features, including pages, users, files, Express objects and more.
  
• Added production modes to the Dashboard - tell Concrete whether this copy is in development, staging or production mode. Useful when running security health checks, or automatically displaying a staging notice to admins or visitors on a staging copy of a site.
  
• Added the ability to view and retry failed queue messages within the Dashboard and through the use of a command line tool. (https://www.loom.com/share/83530934986940b98f74ebe108e49c6e)
  
• Added a button to clear all running processes in case any get stuck.
  
• Adds ability to configure Composer form sets to be collapsable (thanks Mesuva)
  
• Adds option to filter events in Event List by Past, Future or All Events (thanks katalysis)
  
• Adds option to change sort order by Most Recent First or Oldest First (thanks katalysis)
  
• Added new password strength meter to user creation and password changing Dashboard pages (thanks shahroq)
  
• Added new URL Slug Dashboard page to the SEO section, where you can change settings related to URL slugs (thanks hissy)
  
• We no longer fall back to using the super admin’s email address as the default address if certain specific addresses aren’t set; instead we use a new config value “default email address”, settable in config code and from the Dashboard email options page (Thanks mlocati)
  
• Added the ability to specify several allowed IP addresses to avoid triggering logout on IP address change. Added user-specific IP address overrides as well (thanks mlocati)
  
• Improvements to user experience when passwords are reset for users by administrators, either for a single user, or for all users in the site (mlocati). Users will no longer have to enter their email addresses twice, and will no longer be told that they’re in the “forgot password” user flow, when they’re actually in the manual reset user flow.
  
• Added the ability to force user passwords changes every X days (thanks mlocati)
  
• Added the ability to mark a password as reset from a Dashboard user detail page (thanks mlocati)
  
• Add more info in user details dashboard page (thanks mlocati)
  
• Added a new full page caching setting that determines the lifetime of the page based on the blocks on the page (thanks hissy)
  
• Defaulted file manager and file manager component in chooser to sorting by name ascending for more consistent behavior.
  
• New user avatar editor component in My Account and Dashboard.
  
• Added a config option to disable asciify for uploaded files (thanks hissy)
  

• Improved display of View Page as User panel.
  
• Using group paths when group operations are logged instead of group names (thanks mlocati)
  
• Activating the Elemental or Atomik themes after installation will install required supported templates.
  
• Added min fields to page list block number fields (thanks ccmEnlil)
  
• Core guest, registered and admin groups once again forced to be created with the proper initial IDs (thanks mlocati)
  
• New conversations message notifications now appear in Waiting for Me.
  
• Top Navigation Bar block now correctly links to the multilingual home pages, and includes nav-path-selected CSS classes on parent pages of active pages.
  
• Top Navigation Bar now honors nav target custom attribute (thanks ccmEnlil)
  
• API Integrations can limit which Concrete CMS product areas they cover via custom scopes.
  
• Add missing for attribute to checkbox label of option list attribute (thanks Mesuva)
  
• SMTP config page: don't send the SMTP password to the clients (thanks mlocati)
  
• Fix UI of "Update Languages" dashboard page (thanks mlocati)
  
• Heartbeat backend call updates “Online Now” user property (thanks mlocati)
  
• Add option to disable asciify on generate url slug (thanks hissy)
  
• Performance improvement: All global areas’' blocks no longer loaded on every page load (thanks mnakalay)
  
• Fixed: Breadcrumb block doesn't respect replace_link_with_first_in_nav attribute (thanks hissy)
  
• Fixed error where Express Entry List criteria in the block were being shown twice.
  
• Changed image slider URL field from textarea to text input for better display and less ability to mess up input by putting in newlines (thanks nikolai-nikolajevic)
  
• Dashboard Environment Information page now wraps its content properly (thanks JohnTheFish)
  
• Fixed error where containers when used on page would block that page from engaging in automated full-page caching (thanks hissy)
  
• Added date/time of previous login to Welcome back dashboard and account screens.
  
• File title is now included when searching via the file manager file/folder interface.
  
• Much improved, more uniform appearance to select pickers and combo boxes when using autocomplete functionality.
  
• Better block caching settings for certain core block types (thanks
  
• Added additionally indexes throughout (thanks jlucki)
  
• Performance Improvement: Avoid getting same attribute values multiple times (thanks hissy)
  
• Added a new publish notification if a page has a publish end date that is earlier than the current date (and is therefore closed) (thanks hissy)
  
• Alias pages are no longer included in sitemap.xml.
  

• Fixed: Express Form Block submission cannot be edited (thanks mnakalay)
  
• Fixed bug: Viewing versions of a page with permissions does not work
  
• Fixed bug: Page preview fails if page is protected
  
• Fixed bug: Unable to view mobile preview, page versions panel detail, custom design before publish the page
  
• Fixed bug where unapproved conversation messages were being sent to subscribers.
  
• Fixed bug where advanced search dialogs in the Dashboard weren’t accurately showing default search and sort order selections.
  
• Add the missing user param on page_version_approve event (thanks chauve-dev)
  
• Fix sorting results of FolderItemList by file title when only full group by SQL mode is enabled (thanks mlocati)
  
• Many bug fixes to searchable lists.
  
• Bug fixes to Tags attribute that fixes inability to remove tags, other problems.
  
• Fixed: For draft pages, the destination is the Drafts directory if you create the page in another language.
  
• Fixed inability to use query parameter ccm_order_by broken with block express_entry_list (thanks mnakalay)
  
• Fixed issue where editing a JPEG using the image editor would save that file with the JPEG extension but the file behind the scenes was actually a PNG.
  
• Fixed Calendar block not being properly localized.
  
• Fix issue under PHP8 when saving select/option attributes with no selected values (thanks Mesuva)
  
• Fixed bug where tag block showing tags on a specific page did not limit properly.
  
• Fixed /concrete/single_pages/download_file.php:23 Undefined variable $fID under PHP 8.
  
• Fixed inability to set home folder when editing a user in the Dashboard.
  
• Fixed: [V9][Bug] Order by FileSet not working in Document Library Block (thanks mnakalay)
  
• Fixed: "select fileset" dialog in file manager doesn't retain file set values (thanks mnakalay)
  
• Fixed error registering users with email validation under PHP 8.
  
• Exporting users now checks the permission of the access user export permission.
  
• When running validate-schema via the console no more errors are reported (thanks biplobice)
  
• Fixed errors regarding titleFormat in multiple blocks under PHP8
  
• Fixed error when placing site into maintenance mode.
  
• Fixed: Dashboard user attributes always required when present and empty even if not required when editing attributes
  
• Fixed: If ID of the Home page isn't 1, we can't manage access rights to site
  
• Image attribute causing js error in composer and attribute panel (thanks mlocati)
  
• Fixed bug where marking a page description as required in composer made it impossible to approve the page version even when description was specified.
  
• Fixed error when hiding username on new registration form under PHP 8.
  
• Fixed error using layout sliders on non-Bedrock themes.
  
• Many small errors and code incompatibilities fixed in group notifications (thanks mlocati)
  
• Fix handling of page removal when deleting a calendar event (thanks mlocati)
  
• Fixed PHP errors when using Legacy Form block with PHP 8 (thanks mlocati)
  
• Fixed some exceptions in BlockController when using PHP8 (thanks biplobice)
  
• Fixed Wrong params order in the call of View::element(), under elements\workflow\edit_type_form_required.php (thanks BSalaeddin)
  
• Fixed bug where removing orphaned blocks that are part of page defaults for a page template deletes them from all pages of that type (thanks hissy)
  
• Fixed error when using Check Automated Groups task.
  
• Fixed error when saving page type order in the Page Type Order and Group Dashboard page under PHP 8 (thanks hissy)
  
• Fixed error when visiting URL of deleted private message: Undefined property: Concrete\Core\User\PrivateMessage\PrivateMessage::$uID
  
• Fixed: Tags Block Ignores Display Limit
  
• Fixed JavaScript error in version 9 themes when using address attributes.
  
• Fixed: Presets transparent less variable are replaced by colors when upgrading to concrete version 9 (thanks apaccou)
  
• Fixes in browsers where certain asynchronous operations could result in a popup saying “undefined” when navigating away from a page
  
• Fixed: Attempting to delete the "social block" gave displayOrder error under PHP 8.1.
  
• Fixed: Bugfix: Bulk update for page attributes only saves first selected page (thanks lvanstrijland)
  
• Fixed misnamed spam allowlist parameter that could result in spam allowlist functionality not working for all configurations (thanks gantanikhiliraj)
  
• Fixed some bugs in conversations under PHP 8.
  
• Fixed error displaying languages in Dashboard Breadcrumb dropdown on Global Areas Dashboard page when multilingual is enabled.
  
• Fix undefined array key when exporting Express entries on PHP 8 (thanks JeffPaetkau)
  
• Fixed: Get an antispam library by handle breaks under PHP 8 (thanks mnakalay)
  
• Fixed: Undefined variable $selectedTemplate" error on design panel when editing single pages in PHP 8 (thanks hissy)
  
• Fixed error when a user has no rights to do settings on express, but can edit the entities (under PHP 8) (thanks Lemonbrain)
  
• Fixed: HTML block breaks composer interface on PHP 8.1 (thanks hissy)
  
• Fixed Unable to install with MariaDB 10.10+ (thanks mlocati)
  
• Fixed: Adding Core Property 'Text' to Express Form Causes Error under PHP 8.
  
• Fixed occasional errors that could occur if a config file is written twice in rapid succession (thanks JohnTheFish)
  
• Fixes to the user registration email template (thanks jlucki)
  
• Add cache lock to fix potential race condition with attribute keys (thanks jlucki)
  
• Fixed: Legacy form dashboard view "Undefined array key ..." under PHP8
  
• Fixed: Undefined array key "ptComposerOutputControlID" error on page type default page after removing a composer control under PHP 8
  
• Fixed behavior where if a custom file storage was set as default it was not selected when adding new folders (thanks hissy)
  
• Document library block forcing download of files outside default storage location (as attachment)
  

• Bedrock updated to 1.4, which includes support for Bootstrap 5.2 and many other updates.
  
• Numerous minor PHP dependency updates
  
• New Group selector Vue component (Thanks mlocati)
  
• New ConcreteSelect, ConcreteUserSelect, ConcretePageSelect and other components.
  
• Developers can now add to the list of email addresses displayed on the System Email Addresses Dashboard page for their custom add-ons (thanks mlocati)
  
• Display the php-cs-fixers applied when the phpcs CLI command applies fixes (thanks mlocati)
  
• FancyTree deprecated errors no longer displayed in Sitemap (thanks mlocati)
  
• Theme developers may add required additional content XML for their theme in content.xml in the theme root - it will be installed if (and only if) the theme is activated.
  
• Added an option to hide usernames from the user picker component (thanks mlocati)
  
• Add the setupSiteInterfaceLocalization in the controller method in ResponseFactory.php (thanks chauve-dev)
  
• Deprecate Ajax::isAjaxRequest (thanks mlocati)
  
• Removed more instances of “concrete5” in favor of “Concrete CMS”
  
• Guzzle PHP Library updated to 7.5.
  
• Concrete now supports Doctrine ORM 2.14.x+
  
• Fixed error when running method getPermissionObject from the BlockController class.
  
• Many minor PHP dependency version updates.
  
• Minor improvements to antispam service (thanks mnakalay)
  
• Updates to block controller code to future-proof for PHP 9 (thanks mlocati)
  
• moment.js has been updated to the latest stable version. This file could sometimes trigger insecurity warnings.