Skip to content

CHANGELOG.md

Latest commit

 

History

History
1522 lines (1171 loc) · 159 KB

CHANGELOG.md

File metadata and controls

1522 lines (1171 loc) · 159 KB
Raw

Change Log

Unreleased

  • Security fix: The development lockfile moves nokogiri to 1.19.7, loofah to 2.25.3 and rails-html-sanitizer to 1.7.2, which the Audit job of CI refused for advisories. The gemspec does not change, so a host app updates the three gems in its own bundle. Development-only. #1330.

  • Security fix: The development lockfile moves rack to 3.2.8 and addressable to 2.9.2, which the Audit job of CI refused for published advisories. The gemspec does not change, so a host app updates the two gems in its own bundle. Development-only. #1328.

  • Tooling: The embedded shell, awk, Ruby and jq commands of the review-loop skill are now scripts under .claude/skills/review-loop/scripts, each with a spec. The rule files name a script where a command stood, and keep their one-line git and gh commands. Development-only. #1327.

  • Tooling: The development Ruby moves to 3.4.12, and Bundler and RubyGems to 4.0.23, in .tool-versions, Gemfile.lock and the CI workflows. The gemspec does not change. Development-only. #1326.

  • Tooling: The development lockfile moves to Rails 8.1.4, crass 1.0.8 (fixes GHSA-pq4g-8rxf-4g29) and the current development gems. The gemspec does not change, so a host app updates crass in its own bundle. Development-only. #1325.

  • Tooling: The review-loop skill now follows the commit rule of docs/ai/workflows.md Phase 3. Related fixes can share a commit, the checks run before each commit, and the loop reads the CI checks of the PR head. docs/ai/failures.md now finds the cause of a failed check. The skill is now a bootstrap SKILL.md, which copies the rule files at the start of a run. The run follows the copy of procedure.md. Development-only. #1320.

  • Tooling: Each run of the Camaleon suite now leaves a run marker under tmp/rspec-runs in the repo root. At exit, a run names the run markers of the other runs that were active during it (docs/ai/run-markers.md). Development-only. #1321.

  • Bug fix: The group number of a custom-field value is now validated. It must be nil, or an integer from 0 to 2147483647 (an Integer, or a String of 1 to 16 digits). Before, an admin save with a larger number on PostgreSQL or MySQL, or a JSON boolean, failed with a 500. Now the admin shows an error, and the stored values stay. #1318.

  • Bug fix: After set_field_value, a loaded custom_field_values association no longer holds the values that the call deleted. Before, the record still read them. #1318.

  • Bug fix: A multipart request with a part in a charset that is not ASCII-compatible (UTF-16) gets a 400. Before, the param parser of Rack raised an error, and the server answered with a 500. Camaleon adds the CamaleonCms::MultipartEncodingGuard Rack middleware to the host app. #1319.

  • Tooling: The spec suite disables the RSpec monkey patches (config.disable_monkey_patching!). A spec file must start with RSpec.describe: a bare top-level describe fails to load, and the should syntax does not exist. Development-only. #1317.

  • Bug fix: Admin saves store checkboxes custom fields again. Since 2.9.2 most admin saves dropped the checked options and removed the options that the record held. cama_permitted_field_options keeps values sent as a list of scalars. #1315.

  • Docs: The agent docs now state the prose standard. All prose follows ASD-STE100 Simplified Technical English and must be concise. docs/ai/prose.md gives the scope and the rules. Development-only. #1316.

  • Security fix: Admin custom-field saves store only the fields of the groups their form renders for the record being saved, each value under its slug's own field; a nav menu item's custom fields are stored again. cama_permitted_field_options takes field_groups: and set_field_values an optional groups argument. #1312.

  • Tooling: A review-loop Claude Code skill, started with /goal, repeats /code-review --fix passes on a core, plugin, theme or host app PR until they converge; tmp/ is now ignored, and AGENTS.md orders its pre-push checks autocorrect first and no longer asks for them on a branch that changes no code. Development-only. #1313.

  • Tooling: CI also runs the camaleon-post-clone plugin's suite against the core commit under test, as a fifth advisory ecosystem check. Development-only. #1311.

  • Bug fix: In the post editor, the Preview link names the draft an autosave created, however it is opened; the autosave no longer re-sends an unchanged form every minute, saves an untouched post or freezes the editor while saving; leaving an untouched post no longer asks to confirm; a failed Save Draft or Preview says so. #1310.

  • Docs: docs/ai/testing.md no longer tells a local run of an ecosystem member's suite to point CAMALEON_CMS_PATH at a worktree away from the member's path; a sibling checkout gets the core migrations. No behavior change. #1308.

  • Docs: The user-registration-hooks OpenSpec capability has a written Purpose in place of the placeholder openspec archive left, so openspec validate --specs --strict passes. No behavior change. #1307.

  • Bug fix: get_meta and get_option return each read's own default for a meta with no value (no row, null or ''); a value written with set_meta reads back on the writing instance as a freshly loaded record reads it; the_meta and the_option return a stored number, boolean or hash instead of raising. #1303.

  • Bug fix: With auto_include_migrations on, a host app whose path only shares the engine root as a prefix (a plugin checked out as camaleon-cms-seo beside camaleon-cms, core sourced as a path gem) gets the core migrations; it was mistaken for the engine's own dummy app and silently got none. #1306

  • Tooling: CI runs the suites of cama_contact_form, camaleon-cms-seo, camaleon_editor and the florsan host app against the core commit under test, each as its own advisory check on the pull request, so a core change that breaks one of them shows before release. No tokens involved, so it runs on fork PRs too. Development-only. #1305.

  • Bug fix: On the record that wrote its options with set_meta, options and get_option read an option by a String key or its Symbol twin, as a freshly loaded record does, whether passed as a plain Hash, request parameters or a JSON string, and an option written on that object afterwards is stored beside them. #1302.

  • Bug fix: Memoized meta and option reads and the ability no longer survive reload; dup copies share nothing with the original; a boolean meta reads as the boolean and a post reads the request's user and site. #1301.

    • Breaking change: reset_ability and the PostDefault.current_user/current_site class attributes are removed.
    • Upgrade notes.

  • Bug fix: current_site no longer reads the $current_site global, which left a server's processes serving stale site settings; the error logged when no site matches a request points to domain mapping instead. #1300.

    • Breaking change: a $current_site assignment has no effect, and the camaleon_cms:generate_thumbnails task is removed.
    • Upgrade notes.

  • Bug fix: data_options and data_metas are written once, by the first save that completes, so a later save of the same instance no longer reverts options or metas changed since, and a post type created with data_metas stores them at creation. They read nil once written and are queued again if that save is rolled back. #1299. Upgrade notes

  • Bug fix: delete_meta also removes the metas a record holds in memory, so a record with eager-loaded metas no longer reads the deleted value back, and a meta set with set_meta and deleted before the record's save is no longer stored by that save. It takes a single key: an Array is no longer matched as a set. #1298.

  • Security fix: A non-admin's post save is refused for a template or layout the editor does not offer, a non-ASCII meta key, a status outside published/pending/draft, or a summary the content scan refuses; engine-maintained metas and options are refused from anyone, and restore no longer publishes for a user without the publish permission. #1297.

  • Bug fix: A failing plugin hook handler was run a second time by the dispatcher, repeating its side effects; a handler now runs once per dispatch and its error reaches the caller. A handler none of a plugin's helpers defines now raises NoMethodError in controllers as in views (2.9.3 and 2.9.4 skipped it there). #1296.

  • Security fix: A post type's cama_post_decorator_class option must name a CamaleonCms::PostDecorator subclass: other values are refused at save, a stored one is ignored, and the scan_content task lists it. #1295.

  • Bug fix: camaleon_cms requires json < 3, since no released Rails works with json 3, and raises the bundled floors to cama_contact_form ~> 0.1.15 and cama_meta_tag >= 1.7.3. The shipped JSON configs are plain JSON, and config loading keeps accepting comments. Meta and option writes no longer store a key twice or update a row that reads skip. #1292.

  • Tooling: The Audit workflow runs RuboCop with its default formatter instead of -f github, so the job log lists the offenses and the summary. Development-only. #1293.

  • Docs: Capture the custom-field behaviors fixed in #1288 — the admin edit form's per-field render isolation and colorpicker value handling, and the settings save keeping every per-kind field option — as the custom-field-render-resilience and custom-field-option-persistence OpenSpec capabilities. No behavior change. #1291.

  • Tooling: The checked-in OpenSpec agent instructions (/opsx:* prompts and skills for the four integrations) are regenerated with OpenSpec 1.12.0. Development-only. #1290.

  • Tooling: Rightsize the agent docs for the Claude 5 generation: AGENTS.md keeps a one-line repo description plus codebase gotchas, and the docs it routes to (docs/ai/workflows.md, testing.md, reference.md, criteria.md) drop generic advice, duplicated rules and stale claims in favour of pointers to real code; docs/security/permissions.md no longer says post content is sanitized. Development-only. #1289.

  • Bug fix: A colorpicker custom field whose saved value was not a colour crashed the edit form's field rendering, and saving then silently blanked the record's other custom-field values. Rendering now survives bad values and broken field callbacks, an opened-but-unused picker no longer overwrites the field, and the per-kind field options (colour format, date type, image versions, file formats, post-type filter) persist on save. #1288.

  • Bug fix: Destroying a term_taxonomy row whose taxonomy value maps to no model — typically one left behind by a removed or renamed plugin — raised NameError, which also blocked Site#destroy for any site owning such a row. Both now complete normally. #1287.

  • Bug fix: Media rows stored is_public inverted — site.public_media returned the site's private files and vice versa; uploads now store the flag matching real visibility, plus stale-cache hardening. #1286.

    • Notes for upgraders: run bundle exec rake camaleon_cms:repair_media_visibility right after deploying — upgrade notes.

  • Security fix: A media folder-delete whose key resolved to the media root (e.g. /.) let a media-permission user delete the site's entire upload directory from disk; deletion is now contained to the media root. The same change stops folders whose stored name or path collapses (e.g. one named .) from crashing with SystemStackError or deleting sibling media on destroy, and refuses such non-canonical names and paths at save. #1285.

  • Security: Floors the bundled cama_contact_form dependency at ~> 0.1.14, the release that completes its contact-form security series (output escaping, auto-reply recipient validation, a submission throttle, an attachment-count cap, upload-scan coverage, an e-mail tracking-pixel block, and response-file-cleanup confinement). An install still resolving 0.1.13 moves up on bundle update; drop-in, no config or API change. #1284.

  • Tooling: Ruby 3.4.10 for development and for the Release job, both of which read .tool-versions; RubyGems/Bundler 4.0.19 there, in the two CI matrix workflows and in BUNDLED WITH, plus the transitive development bumps that came with it. The CI Ruby/Rails matrices are unchanged, and openspec/config.yaml no longer restates the Ruby and Rails versions. Development-only; the gem's supported ranges are unchanged. #1283.

  • Tooling: The checked-in OpenSpec agent instructions (/opsx:* prompts and skills for the four integrations) are regenerated with OpenSpec 1.11.0. Development-only. #1282.

2.9.4 (2026-08-25)

Upgrading to 2.9.4? The one action for every install is bundle update camaleon_cms; required grants, behaviour changes, and notes for theme/plugin developers are collected in docs/upgrading-to-2.9.4.md. Breaking changes are flagged inline below.

  • Security fix: The bundled front_cache plugin ran Rails.cache.clear on every POST/PATCH, wiping every cache-based counter in the shared store — an attacker could reset the per-IP login brute-force counter with one interleaved frontend POST. Pages are now cached per site under versioned keys (one entry per URL, one-week TTL, any store); invalidation bumps the version and never touches entries the plugin does not own. #1279.

    • Breaking change: the Invalidate the cache instead of deleting it checkbox is removed from the front_cache settings — versioned invalidation is now the only behavior, and a stored invalidate_only value is ignored. PUT and DELETE requests now invalidate the page cache like POST/PATCH; draft autosaves (posts/drafts) no longer invalidate it (a draft is not published content); and the admin Clean cache action also physically purges the site's stored pages.
    • Upgrade notes.

  • Security fix (dependency): Raises the bundled cama_contact_form floor to ~> 0.1.13, which validates the contact-form auto-reply recipient: the optional confirmation email previously went to a visitor-controlled address, turning a site into an email relay from its own From address. 0.1.13 also routes the plugin's markup gate through CamaleonCms::UnsafeMarkup and gates its forms shortcode. cama_contact_form#76.

  • Bug fix: The engine no longer force-requires factory_bot_rails nor appends its spec/factories to the application's factory paths — a host app loading the gem from a path/git checkout while defining its own same-named factory (e.g. :site) crashed at boot with FactoryBot::DuplicateDefinitionError. Released-gem installs never received the factories (spec/ is not packaged). #1280.

  • Testing: Specs are now bootstrapped through rails_helper — .rspec uses --require rails_helper, so individual specs no longer require 'rails_helper' — and rails_helper forces RAILS_ENV=test before the app boots, so an exported RAILS_ENV can never point the suite (whose before(:suite) purges every table) at a development or production database. Development-only. #1278.

  • Testing: The contact-form security specs moved to the cama_contact_form plugin, which now has its own camaleon_cms-backed harness and owns the code they exercise; the contact_form_unfiltered_html permission-model spec stays here, where the permission is defined. Development-only; no shipped code changed. #1278 · pairs with cama_contact_form#73.

  • Security fix: Shortcodes in authored content are now gated behind a default-off content_shortcodes role permission. A save carrying a registered shortcode is refused (never sanitized) for a non-admin lacking it, across post content, custom-field values, taxonomy content and widget descriptions. Detection is precise and fails closed; admins, stored content and rendering are unaffected. #1277.

    • Breaking change: a non-administrator role without content_shortcodes can no longer publish shortcode-bearing content on any of those surfaces. Grant the permission (Settings → User Roles → Allow shortcodes in content) to roles that author shortcodes.
    • Upgrade notes.

  • Bug fix: Publishing a post without an explicit date saved it published with a nil published_at — undated, and raising in themes that format the publish date. CamaleonCms::Post now stamps published_at (UTC) when a post becomes published without one; supplied/scheduled dates and already-published posts are untouched, and existing undated posts are not backfilled. #1276.

  • Performance fix: Frontend post listings no longer issue N+1 queries for post metas, categories, post_tags and post-type metas — a Post.with_eager preload scope loads them up front on the listing paths (single-post lookups stay lean), and stale association caches are reset after category/tag mutations. #1275.

2.9.3 (2026-08-16)

Upgrading to 2.9.3? Required operator actions, the post-upgrade maintenance tasks (with copy-paste commands), behaviour changes, and notes for theme/plugin developers are collected in docs/upgrading-to-2.9.3.md. Breaking changes are flagged inline below.

  • Bug fix: The post editor could load with an empty body on a cold server when the edit form was opened in a background browser tab, and saving then overwrote the post with the empty body; the editor now restores the server-rendered content when it initializes empty. #1273.

  • Performance fix: On installs with many sites, the first request after a server (re)start could 404 or be served against a still-building route table. Route drawing no longer scales with the number of sites, it is drawn at boot in development so no request is served mid-draw, and admin responses now send Cache-Control: no-store. #1272.

  • Security fix: A role holding only the media permission could set any same-site user's avatar — including an administrator's — via media#crop with saved_avatar, gated only by :manage, :media. Writing another user's avatar now requires :manage, :users; a caller may still set their own with the media permission alone. Completes the media-crop finding (cross-site half shipped in #1267). Reported by Guilherme Facini. #1271.

    • Breaking change: a role with :manage, :media but not :manage, :users can no longer set other users' avatars via crop. Grant :manage, :users to a role that needs to manage other users' avatars.

  • Security fix: The upload scan chose its ruleset from the filename, so identical bytes were refused as x.svg yet stored as x.html. The ruleset now follows how the file renders: markup is parsed and on* attributes rejected by shape, .svgz decompressed under a bounded read, and executable scripts require media_unfiltered_upload. Reported by Guilherme Facini. #1269. Upgrade notes.

    • Breaking change: a role without media_unfiltered_upload can no longer upload .js, .mjs, .cjs, .wasm or .swf files. Grant that permission to a role that needs them.

  • Release process: Releases are now cut by a manually-started Release GitHub Actions workflow that verifies, builds, and publishes the gem, then tags the commit and creates the GitHub release from this file's section; lib/camaleon_cms/version.rb is the single source of truth. Procedure: docs/releasing.md. #1268.

  • Security fix: Low-severity hardening bundle — the captcha challenge is drawn from a CSPRNG; save_comment fails closed on crafted input and no longer follows an off-host Referer; the media crop avatar target is resolved within the current site; and front_cache keys its cache on a lossless digest (no URL collisions) and skips malformed path patterns. #1267. Upgrade notes.

  • Security fix: Four medium admin hardenings — media#upload no longer skips CSRF (the uploader now sends the token); draft custom-field options are confined to the post type's registered slugs; the nav-menu reorder resolves its destination through the current site; and the email-confirmation token is consumed on use. #1266. Upgrade notes.

  • Security fix: The remaining destructive admin endpoints no longer answer GET (audit M6): nav-menu item delete requires DELETE, the legacy appearances/widgets delete routes no longer admit GET, and media/crop accepts only POST. A routing audit spec enforces that no mutation-named admin route answers GET/HEAD. #1265. Upgrade notes.

  • Security fix: Destructive admin actions no longer ride GET links (which Rails' CSRF protection exempts): trashing/restoring posts, comment moderation, plugin toggle/upgrade, impersonation, test email, theme sample-data import, and logout now act only over PATCH/POST. #1264. Upgrade notes.

  • Security fix: Post content from untrusted authors is rejected on save when it contains disallowed HTML, instead of being silently sanitized: the save fails with an error naming the remedy, and stored content always equals authored content. Admins and roles holding post_content_unfiltered_html are unaffected; unfiltered_content! opts server-side pipelines out. #1263. Upgrade notes.

  • Security fix: Unlocking a password-protected post now happens over POST with a session-side unlock and a constant-time comparison. The prompt used to submit over GET as plain text (exposing the password in URLs, history, logs and Referer) and compared with ==; the query-string parameter no longer unlocks anything. #1263. Upgrade notes.

  • Security fix: Password-protected posts no longer leak their body through excerpts. the_excerpt (listings, search, RSS) was still derived from the body; a locked post's excerpt is now a neutral notice, and such posts are excluded from the front_cache page cache. #1263.

  • Security fix: The admin auth cookie is now HttpOnly and Secure (over SSL), and logging out rotates the server-side auth_token. The bearer token was previously readable by JavaScript and sent in the clear, and a cookie copied before logout stayed valid. #1263. Upgrade notes.

  • Security fix: field_attrs custom-field values are now gated at save like editor values and rendered verbatim, closing a second stored-XSS path. The gate scans the decoded members of any JSON shape, so markup hidden by unicode escaping is refused like literal markup; nothing is sanitized. #1263.

  • Security fix: Dangerous custom-field values (rich-text editor, URL types) are rejected on save instead of stored, closing a stored-XSS path. A value an untrusted author may not write (scripts, event handlers, embeds, javascript: URLs) is refused with an error naming the field; trusted authors are unaffected. #1263. Upgrade notes.

  • Security fix: Passwords must now be at least 8 characters (NIST-aligned, length-only), applied whenever a password is set; a profile update that leaves the password untouched is unaffected. #1263.

  • Security fix: The forgot-password endpoint no longer reveals whether an email is registered, nor floods an inbox: it returns one neutral message either way and sends at most one reset email per account per 5-minute window. #1263.

  • Security fix: Admin login no longer leaks whether a username exists through response timing — a missing username now spends one bcrypt comparison too, closing a username-enumeration oracle. #1263.

  • Security fix: Two admin endpoints now enforce authorization. AdminController#search scoped nothing, so any admin-area user could enumerate every post title/slug in every status; it now scopes results to the caller's authorized post types, categories and tags. Posts::DraftsController#index now requires :posts authorization. #1262.

  • Security fix: The admin post index no longer leaks another post type's posts through a taxonomy filter. ?taxonomy=category|post_tag replaced the scope with the taxonomy owner's site-wide posts; the filter is now resolved within the authorized post type (a foreign id 404s) and intersected with its posts. #1262.

  • Security fix: Credential parameters are now filtered from the Rails logs. The engine set no config.filter_parameters, so SMTP/S3 secrets, user and protected-post passwords, and token parameters were logged in cleartext on hosts without their own filter. #1262.

  • Security fix: Private uploads to S3 are now stored with an owner-only (private) ACL instead of public-read, which left a private file world-readable at a guessable s3://bucket/private/<name> URL. Public uploads are unchanged. #1262. Upgrade notes.

  • Fix: The upload content scanner now accepts embedded raster images encoded as data:image/* URIs (e.g. an Inkscape/Figma SVG with <image xlink:href="data:image/png;base64,…">), previously rejected as false positives. Dangerous data: URIs and javascript:/vbscript: remain blocked. #1261.

  • Security fix: The uploaded-SVG scanner now rejects uppercase/mixed-case event-handler attributes (e.g. ONCLICK), and no longer raises on an SVG declaring a non-UTF-8 encoding — such a file is scanned normally instead of failing the upload. #1261.

  • Security fix: The uploaded-SVG scanner now catches blocked URI schemes hiding a TAB/LF/CR gap inside the scheme name (e.g. java&#9;script:), which a browser strips back before executing. Both scheme checks now share ContentSecurity's gap-tolerant pattern and entity normalization. #1261.

  • Security fix: sort_by_field no longer interpolates its sort-direction argument into the SQL ORDER BY. It is a public API, so a user-controlled direction could 500 or append attacker-chosen ORDER BY terms (a blind ordering oracle); the direction is now whitelisted to ASC/DESC and the value column ordered as a quoted identifier. #1260. Upgrade notes.

  • Fix: sort_by_field and filter_by_field no longer append phantom unsaved records to the collection — class discovery now uses the relation's klass instead of build. #1260.

  • Change: The user_before_register hook now fires during registration (previously a silent no-op), after the register captcha passes; a handler can veto a signup by setting r[:stop_process]. #1259. Upgrade notes.

  • Security fix: Closed an open redirect in the admin session flows. safe_redirect_url treated a parsed-host-blank URL such as return_to=///evil.com as same-origin; it now follows a host-blank destination only when it is a genuine same-origin path, and a host-matching absolute URL only over http/https. #1258. Upgrade notes.

  • Fix: The user_before_register hook now fires during account registration — it was dispatched in a form that resolved to a no-op, so a listening plugin never ran. #1258.

  • Security fix: Only an admin may control an admin account. Holding :manage, :users let a non-admin mint or strip the admin role, or reset an admin's password/email to hijack the account; granting/removing admin and changing an existing admin's password, email or username now require being an admin (audit H10). #1257.

  • Security fix: Admin login is now brute-force throttled per client IP. The "under attack" decision was per-session, so dropping the session cookie each request evaded the captcha (H1); the bundled attack plugin also keyed on the session id and inserted a row per request (H2). Failures are now counted per IP in the cache, with a captcha then an HTTP 429 lockout. #1256. Upgrade notes.

  • Security fix: The captcha is now a single, single-use challenge of bounded length. GET /captcha?len= fed its length straight into generation (a huge value tied up the worker; 1 shrank the answer to a letter), and every issued answer accumulated in the session and was accepted forever (H3/H4). The length is clamped and a solved captcha is consumed. #1255. Upgrade notes.

  • Fix: Saving a frontend comment no longer 500s when the client sends no User-Agent header; it is recorded nil-safely without mutating the request string in place. #1255.

  • Security fix: Ending admin impersonation now requires the impersonating admin's password. The Logout link previously restored the stashed admin cookie for whoever held the session, so an admin who walked away mid-impersonation on a shared browser let the next occupant become admin. #1254.

  • Security fix: The session is now reset on a genuine sign-in and on logout. The impersonation stash outlived the admin on a shared browser, so a later user inherited it and was handed the admin's cookie on logout (audit H6); login_user/cama_logout_user now reset_session. #1253. Upgrade notes.

  • Security fix: The admin custom-fields "list" endpoint no longer writes a post's categories on a GET request — with categories omitted it deleted every category relationship, reachable by CSRF. The write now runs only on a CSRF-verified POST, and the endpoint authorizes the caller against the resolved record (audit M6). #1252.

  • Fix: The admin confirm_email route now accepts PATCH — its via: list carried path (a typo for patch), so a PATCH request fell through to the "invalid route" handler. #1252.

  • Security fix: Foreign keys that carry a record's tenancy are no longer mass-assignable across sites. A post type's, category's or tag's parent_id, and a widget assignment's sidebar_id/widget_id, were reassignable via hidden fields; these are now dropped from the permits or validated against the current scope (audit H8/H9). #1251.

  • Security fix: The admin user-list and account-creation actions now require :manage, :users even when the caller injects their own ?user_id=. The validate_role self-exemption was short-circuiting the capability check on these collection actions, exposing the full user table and account creation (audit H7). #1250.

  • Security fix: The breadcrumb, HTML sitemap, and default theme's taxonomy links now HTML-escape the post/category URL they interpolate into an href, closing a stored-XSS via a slug that closes the attribute (audit H11). #1249. Upgrade notes.

  • Fix: Administrator password reset works again. On Rails 7.1+ has_secure_password generated a password_reset_token method that shadowed Camaleon's same-named column, so every reset dead-ended on "URL incorrect". Reset links now resolve, expire, are single-use, and confined to the account's own site. #1248. Upgrade notes.

  • Security fix: The installer no longer publishes a default administrator password and can no longer be run by an anonymous visitor on a fresh deploy (audit C1). New sites mint admin with a random password shown once, and the first-run installer is gated by a setup token from CAMALEON_SETUP_TOKEN. #1246. Upgrade notes.

  • Fix: The captcha tag now honors a caller-supplied image style and string-keyed input attributes, and the admin "no categories/tags created" message shows a translated label instead of the raw slug. Regression audit L14/L15/L17. #1245. Upgrade notes.

  • Fix: A failed avatar crop now shows an error instead of silently blanking the saved avatar; the theme generator and the repair rake tasks print progress to the terminal (via a shared CamaleonCms::TaskReporter). Regression audit L3/L16/L11/L18. #1244. Upgrade notes.

  • Security fix: SVG uploads and /media/ SVG responses are now matched by extension case-insensitively, so an uppercase-extension SVG (image.SVG) is scanned by the SVG parser and served with the nosniff / script-src 'none' headers like a lowercase one. Regression audit L5/L6. #1243.

  • Fix: The admin media browser paginates at the database again instead of loading a folder's entire media list into memory per page view; sites with large media folders load the manager far faster. Regression audit M27. #1242.

  • Security fix: An uploader without media_unfiltered_upload could use a before_upload hook to substitute bytes the scanner never saw; the pipeline now re-scans substituted content for untrusted uploaders. Also: a blank/0 "Max file size" no longer rejects every upload, and the content scan folds its event-handler patterns into one pass. Regression audit N2/M26/M24/M25. #1241.

  • Security fix: The two admin theme-settings paths that still saved custom-field values raw now go through the same allowed-slugs filter as every other admin custom-field save (added in 2.9.2), closing a mass-assignment gap reachable by any role with the theme-settings capability. #1240. Upgrade notes.

  • Fix: An admin custom-field save whose submitted slugs were all unregistered under the target scope wiped the object's stored values; the filter now drops those empty groups, so the save is a no-op instead. #1240.

  • Fix: User custom fields work again for host apps configuring a namespaced user_model (e.g. 'Admin::User'): the settings form, edit page, and save filter now derive the demodulized scope name, so submitted user field values are no longer silently discarded (broken since 2.9.2). Regression audit N5. #1239. Upgrade notes.

  • Fix: The object_class scope naming for metas, custom fields, and field groups returns to the demodulized 2.9.2 contract ('Main', 'User'), reverting an unreleased rename that stranded existing rows; the bulk-delete cascade on definition associations is also removed. Regression audit M9/M8/N4. #1238. Upgrade notes.

  • Fix: Three legacy model-API surfaces restored: Media.find_by_key (alias of by_key), Post#unassign_category (with reliable counter refresh), and the default ascending-id ordering on NavMenu/NavMenuItem. Regression audit M5/M6/M10/M4/M11. #1237.

  • Removed: The ActiveRecordExtras mixin and its update_or_create, update_or_create! and assign_or_new methods. Use the Rails idiom (find_or_initialize_by(...).tap { … save }); the 2026-08 ecosystem sweep found no external caller. Regression audit M4. Upgrade notes.

  • Fix: Three session-adjacent regressions: the admin login/register/forgot pages render in the site's language again (with ?locale= honored); same-host return_to is followed regardless of host case; and malformed ?user_id[]= / ?locale[]= requests no longer 500. Regression audit M15/M17/M14. #1236.

  • Security fix: Draft autosaves could be forged to parent a new draft under an arbitrary post, and an edit-own-only user was locked out of autosaving their own post. post_parent is now create-only (derived from the validated post_id), and draft buffers are per-user, authorized against the post being edited. Regression audit M12/M13. #1235. Upgrade notes.

  • Fix: Restores seven admin and frontend runtime-compatibility contracts broken by the CurrentRequest and admin-menu refactors (2-arg post_type_list_taxonomy, signed-out cama_current_user memoization, quote-safe admin menu data-*, and more). Regression audit M16/M18–M20/M22/M23. #1234.

  • Fix: On multisite installs, background and cross-site email (password reset, email confirmation, admin notifications) raised NameError and sent nothing — SiteHelper#current_site stopped honoring the @current_site that HtmlMailer sets. Single-site installs were unaffected. #1233.

  • Docs: Codified the security-capability-gating rule — a security-sensitive action is admin-only by default and gated for non-admins by a dedicated, off-by-default, fail-closed permission — as an OpenSpec capability, a docs/security/permissions.md section, and a docs/ai/criteria.md checkpoint. #1231.

  • Docs: Removed the defunct Autocomplete plugin from the README plugin list and example Gemfile, and recorded the external plugin/theme binding surface as the ecosystem-plugin-bindings OpenSpec capability with a docs/ai/ecosystem.md inventory. #1229.

  • Security fix: A media-only user could upload an SVG the ruleset accepted, then re-crop it under an .html name to have the identical bytes served as text/html, unscanned. Scanning is now gated on a new media_unfiltered_upload role permission. Also fixes seven defects found reviewing #1223–#1227. #1228. Upgrade notes.

  • Fix: Validating a post without an explicit slug raised FrozenError instead of reporting Slug can't be blank, so creating posts programmatically was impossible. String#translations no longer memoizes on a frozen receiver. Long-standing, not a regression. #1227.

  • Fix: The upload hardening in #1198–#1211 rejected legitimate work: uploads staged outside public//temp failed, animated SVGs and re-crops of stored files were refused, and prose with a word before a colon tripped the scheme detector. Trusted callers can widen roots per call, animation elements are accepted, and scheme detection matches the browser rule. #1226. Upgrade notes.

  • Fix: Save-time post-content sanitization (#1206) destroyed legitimate markup for untrusted authors and sanitized every programmatic save; untrusted Post#content now keeps structural, non-executable markup while stripping scripts and handlers. Also restores activation of the bundled camaleon_first theme. (Superseded by the reject-on-save gate in #1263.) #1225. Upgrade notes.

  • Fix: Fallout from the native-STI conversion (#1173): rows with custom taxonomy/post_class raised SubclassNotFound; deleting a user orphaned their comments and destroyed their widgets; and wrong inverse_of declarations made .owner raise. All restored to 2.9.2 behavior. #1224. Upgrade notes.

  • Fix: Six high-severity regressions introduced after 2.9.2, each pinned by a reproducing spec: engine boot on nginx/Apache static hosts, a plugin/theme config without a helpers key, GET /search 500, mixed-case PostgreSQL search, /sitemap.html crashes, and case-sensitive login/reset. #1223.

  • Fix: Slug-uniqueness validation was silently inert on Rails 7.0+ — UniqValidator/PostUniqValidator pushed onto errors[:base], which modern Rails discards, so duplicate slugs and recursive page hierarchies saved without complaint. Errors are registered with errors.add again. #1222. Upgrade notes.

  • Tests: Feature specs now sign in by setting the auth cookie instead of driving the login form, and the sign-in actually verifies credentials; the form-driven flow lives on in admin_form_sign_in. #1221.

  • Tests: The suite installs a single shared Camaleon site per run instead of before nearly every example, cutting a local full run from ~18 minutes to ~5; init_site(fresh: true) keeps a per-example site for multi-site UI specs. #1220.

  • Fix: Admin headings and tooltips showed raw HTML entities instead of the characters they encode, so a site named Ben & Jerry's read Ben &amp; Jerry&#39;s. Affected site settings, the post edit form, the sites form, and the categories/tags indexes. #1219. Upgrade notes.

  • Security fix: Stored XSS in two server-generated fragments. PostDecorator#the_status and CustomFieldGroup#get_caption built markup by interpolation and were rendered through raw without escaping the spliced values; both now escape and return a SafeBuffer. Thanks, Enrik Mustafa, for pressing the re-check. #1218. Upgrade notes.

  • Security fix: Cross-site custom field group injection. The custom-fields controller wrote the submitted assign_group placement without checking ownership, so a manager on one site could stamp a group with another site's placement id and render it there, invisible to that site's admins (multi-site installs only). #1217. Upgrade notes.

  • Fix: The site settings form rendered every custom field group in the site, not just the site's own, so required fields on other content types blocked submit and were discarded anyway. Site now reads placement (object_class/objectid) instead of tenancy (parent_id). Reported as #1124. #1216. Upgrade notes.

  • Security fix: HTML injection in Hash#to_attr_format and the bundled cama_contact_form plugin. to_attr_format used a Ruby string escape (inert in HTML) and interpolated attribute names verbatim; the contact form built markup by raw interpolation, so visitor input and form fields could inject script into the same-origin admin. Requires cama_contact_form 0.1.12. #1215 — thanks, Amir Aliu and Enrik Mustafa.

    Breaking changes

    • The contact form refuses unsafe content instead of rewriting it — content is stored and delivered verbatim, or the save is refused and the author told which setting to fix. An author holding contact_form_unfiltered_html is unaffected; a visitor's submission is refused whole. Ordinary writing (Tom & Jerry, <br/>, Fish & Chips <today>) still passes.
    • to_attr_format emits &quot; where it emitted \", and drops pairs whose key is not a valid HTML attribute name. A plugin relying on the old output to inject markup will stop working.
    • to_attr_url_format emits value.to_s.inspect; it did not escape backslashes before. No callers in this repo.
    • The role editor gains "Allow unfiltered HTML in contact forms" (off for every role but admin), and now renders an admin role's permissions as held and locked, matching can :manage, :all.
    • #1206's permission is renamed allow_unfiltered_html → post_content_unfiltered_html. No migration: #1206 has not shipped in any release.
    • The cama_contact_form dependency is raised to ~> 0.1.12 (dropping the vulnerable 0.1.0 from its range); bundle update camaleon_cms is enough.

  • Security bumps picked up while re-resolving cama_contact_form: rails 8.1.3 → 8.1.3.1, concurrent-ruby, erb, json, net-imap; Bundler 2.7.2 → 4.0.17, with both CI workflows pinning rubygems: 4.0.17 to match. #1215.

  • Developer tooling: Document when an OpenSpec change is archived — on the branch as part of the PR, not post-merge. AGENTS.md and docs/ai/workflows.md Phase 4 now say so. #1214.

  • Developer tooling: Correct the skip-ci guidance in docs/ai/workflows.md — the marker is a per-push decision (omit until the PR has had one full check run), not an unconditional rule for the Phase 4 changelog commit. #1214.

  • Fix: Report an unresolvable target in Admin::UsersController#updated_ajax in the action's own error format instead of an HTML error page, and switch the failure paths from render inline: (an ERB-injection sink on the 422 path) to render plain:. Not a security fix. #1214.

  • Developer tooling: Capture the target-user resolution invariant for Admin::UsersController as the user-target-resolution OpenSpec capability and close the regression-coverage gap it exposed (new request specs for update/destroy/impersonate). No behavior change. #1214.

  • Security fix: Close a user-existence oracle left by the profile IDOR fix in #1197 — profile authorized against the loaded record, so a nonexistent id 500ed while an existing one 302ed. Authorization is now decided from the request parameter before loading, and any bad user_id redirects with "Not found user." instead of 500ing. #1213.

  • Refactor: De-duplicate the two uploader entry points (RuntimeUploaderConcern and UploaderHelper, 349 byte-identical lines) into shared UploaderPipeline/UploaderImageProcessing/UploaderSupport modules. Both entry points keep their full public API, so host apps, plugins and themes are unaffected. #1212.

  • Security fix: Prevent rejected media uploads from persisting in the web-served staging directory — a rejected data: payload was still written to public/tmp/<site_id>/ and served same-origin. Content is now scanned before staging, and staged files are removed on any failure. #1211 — thanks, Lukman Azri. Upgrade notes.

  • Developer tooling: Restructure the AGENTS.md docs tree for progressive disclosure — remove superseded process docs, consolidate reference docs, and add a CLAUDE.md import shim. #1208.

  • Developer tooling: Add OpenSpec skills for Claude. #1207.

  • Security fix: Fix stored XSS via unsanitized post content — add server-side sanitization to Post#content at save with role-based allowlisting, so untrusted contributors cannot inject scripts into raw @post.the_content. Also fixes normalize_attrs data loss on plain-text fields (e.g. Name <user@domain.com>). (Later superseded by the reject-on-save gate in #1263.) #1206 — thanks, Theodosis Paidakis.

  • Security fix: Add defense-in-depth URL validation to the crop action — validate user-supplied HTTP/HTTPS URLs before the temporary upload pipeline, via a shared cama_upload_url_error helper. Same-site URLs are checked for path traversal only; remote URLs get full SSRF validation pinned to the validated IP to defeat DNS rebinding. #1203 — thanks, Theodosis Paidakis.

  • Security fix: Fix path traversal bypass in file upload guards — canonicalize paths with File.expand_path before prefix validation at all four sinks, compare site URLs by host+port, and harden the data: branch against name-based traversal. Also bumps loofah and rails-html-sanitizer. #1201 — thanks, Jose Rivas (Zero Trust Offsec).

  • Security fix: Fix SVG stored XSS via Nokogiri parse-based detection — replace the regex denylist with an XML parser that resolves entities, blocks script/on*/javascript:/data:/embed, and disables XXE. Add Rack middleware serving /media/ SVGs with nosniff and script-src 'none'. #1199 — thanks, Jose Rivas (Zero Trust Offsec).

  • Security fix: Fix arbitrary server-side file read via media upload — validate the path prefix before File.open in upload_file and cama_tmp_upload, coerce nil formats to '*', and handle crop errors gracefully. #1198 — thanks, Jose Rivas (Zero Trust Offsec).

  • Security fix: Fix profile IDOR in Admin::UsersController#profile — add an inline authorize! check when viewing another user, so low-privilege users can no longer enumerate arbitrary accounts. #1197 — thanks, Neo Andrew.

  • Security fix: Fix improper authorization in the draft autosave endpoint — scope draft lookups to post type, add authorize! checks before draft mutations, and validate post_parent against a real post. #1196 — thanks, Enrik Mustafa and Óscar Uribe.

  • Security fix: Prevent an SVG XSS bypass via missing animation event handlers (onbegin/onend/onrepeat) in the upload content filter, and DRY UNSAFE_EVENT_PATTERNS into the shared CamaleonCms::ContentSecurity module. #1195 — thanks, Mohamed Almuhaya.

  • Fix: Restore legacy widget assignments, configured navigation order, and frontend plugin controller helper compatibility. #1194.

  • Developer tooling: Add the OpenSpec planning workflow and agent guidance. #1193.

  • Security bumps: Bump json, puma to 8.0.2, rubocop to 1.88.1, zeitwerk to 2.8.2 and other development gems, fixing all new Rubocop offenses. #1186.

  • Security fix: Prevent account takeover in Admin::UsersController#updated_ajax by unifying target-user lookup and authorization. #1185 — thanks, Lukman Azri.

  • Fix: Restore TinyMCE editor icons in development — sprockets-rails >= 3.5's asset-url post-processor rewrote the skin's relative font urls to an invalid root path; a TinymceSkinSafeAssetUrlProcessor now expands them to full logical paths for the skin only. #1183.

  • Fix: Restore object_class scoping on CustomField#metas and CustomFieldGroup#metas — a #1173 regression dropped the scope, so a colliding numeric id read the wrong _default meta (visible as the theme-settings editor field rendering as a plain text box). #1183.

  • Refactor: Finalize the Phase 6G runtime-concern decomposition — runtime concerns now include their helper modules (single source of truth) while keeping back-compat ivars for templates/plugins; restores several controller-context helpers, per-site theme view overrides, legacy-thumbnail fallbacks, plugin template lookup, Sprockets-4 asset precompilation, and localized-slug lookups. #1183.

  • Fix & Refactor: Phase 5 — restore theme preview rendering (preview theme state, legacy ivars, preview hook dispatch, auto-created preview menus) and refactor the nav-menu helper onto request-scoped CurrentRequest state. #1181.

  • Refactor: Replace Phase 4 session/shortcode/comment helper instance-variable state with request-scoped CurrentRequest state, preserving controller/view compatibility. #1179.

  • Refactor: Replace Phase 3 admin/menu/taxonomy helper instance-variable state with CurrentRequest-backed state, keeping legacy taxonomy-list compatibility. #1178.

  • Refactor: Replace Phase 2 frontend helper context (content, SEO, site helpers) with CurrentRequest-backed state. #1177.

  • Refactor: Replace Phase 1 helper instance-variable state (content, hooks, html, theme helpers) with CurrentRequest-backed state. #1176.

  • Fix: Restore admin preview locale compatibility for decorators and plugin helpers removed by #1166, preserving theme previews and admin-rendered frontend flows. #1175.

  • Security fix: Fix Rails OutputSafety sinks while preserving menu and asset rendering — escape untrusted HTML in attack responses, media crop output, edit-link labels, hierarchy titles, and select options. #1174.

  • Refactor: Implement native Rails STI for term taxonomies and posts, and add polymorphic owner associations for metas and custom-field records. #1173.

  • Style & tooling: Add RuboCop plugin gems (performance, rails, capybara, factory_bot, rake, rspec_rails), fix hundreds of offenses across 92 files, and set the maximum line length to 120. #1167.

  • Style & testability: Refactor HTML in Ruby code to Rails tags (content_tag, tag, link_to, safe_join) across 12 files, and add factories and specs for nav menus, the captcha helper, and fix_post_order. #1172.

  • Security fix: Fix two unprotected redirects via params[:return_to] in sessions_controller.rb and session_helper.rb by routing through the existing safe_redirect_url helper. #1168.

  • Security, style, and cleanup: Rubocop fixes part 1 — style/performance/rails offenses, dead-code removal, and TargetRailsVersion set to 6.1. #1168.

  • Security fix: Bump gems — Nokogiri to 1.19.3, action_text-trix, aws-sdk, puma, rubyzip, selenium-webdriver, sqlite3, Bundler 2.7.2. #1170.

  • Fix: Decorator locale resolution and language context mixing (fixes issue #233) — move cama_get_i18n_frontend to the parent controller and rely on I18n.locale, so decorators use the site's frontend language in frontend context and the admin language in admin context. #1166.

  • Bug fix: Fix thread-safety issues with PluginRoutes.reload causing persistent 500 errors — remove the reload from plugins#index/themes#index and guard route reloading/cache access with a Monitor. #1163.

  • Optimize PluginRoutes.draw_gems and apps_dir — micro-optimizations for memory consumption and performance. #1164.

2.9.2 (2026-05-01)

This release is fixing several security vulnerabilities! Please, upgrade ASAP!

  • BREAKING CHANGE - Security fix: Fix Broken Access Control (CWE-862) in MediaController, #1147

    • Add consistent authorization checks to all MediaController endpoints requiring :manage, :media permission
    • Previously, only index and ajax actions checked authorization; other endpoints (upload, download_private_file, crop, actions) only checked authentication
    • All endpoints now protected by centralized before_action :verify_media_authorization
    • Thanks, Seoyoung Kang for reporting this

  • BREAKING CHANGE - Security fix: Centralize plugin admin authorization in PluginsAdminController, #1142

    • All plugin admin routes now require manage :plugins permission by default (fail-closed)
    • /admin/plugins/*/settings and related endpoints protected without per-controller opt-in
    • Third-party plugins (via Ruby gems like cama_contact_form, cama_meta_tag) automatically protected when inheriting from PluginsAdminController
    • Thanks, Amir Aliu and Enrik Mustafa for reporting this

  • BREAKING CHANGE - Security fix: Restrict select_eval custom field type to authorized users only, #1136

    • The select_eval field type can execute arbitrary Ruby code and now requires explicit permission
    • Added select_eval permission to User Roles UI (appears as "Select Eval" checkbox under Manager Permissions)
    • Users with 'admin' role automatically have full access (via can :manage, :all)
    • Non-admin users must be explicitly granted select_eval: 1 permission in their role meta
    • Implemented CurrentRequest (ActiveSupport::CurrentAttributes) for thread-safe, request-scoped access to current_user and current_site
    • Added authorization checks at model layer: CustomFieldGroup#add_field, CustomFieldGroup#add_fields, and CustomField before_update callback
    • Migration required: See docs/MIGRATION_SELECT_EVAL.md for detailed upgrade instructions
    • Security documentation: See Permissions & Security Guide
    • Run bundle exec rake camaleon_cms:backfill_select_eval_permission to fix the permission checkbox on admin roles
      • Thanks, Ik0nw, Thomas Wells, Amir Aliu & Enrik Mustafa, and l1nk for reporting this

  • BREAKING CHANGE - Add permissions for Custom Fields management in the admin area, #1134

  • Security fix: Fix Brakeman vulnerabilities: dangerous eval in plugin_routes, path traversal in MediaController, and SQL injection in visibility_post_helper, #1160

  • Security fix: Fix Brakeman XSS vulnerabilities, #1159

  • Security fix: Fix mass assignment vulnerabilities in Categories, Widgets, Posts, Users, and other admin controllers, #1158

  • Security fix: Fix mass assignment vulnerabilities in NavMenusController, #1157

  • Security fix: Fix open redirect vulnerability in session helper via return_to cookie, #1155

  • Security fix: Fix reflected XSS vulnerability via params[:info] in flash messages, #1154

  • Security fix: Fix mass assignment and open redirect vulnerabilities in SitesController, #1152

    • Replace permit! with strong site_params allowing only :name, :slug, :description
    • Redirect to cama_admin_path instead of @site.the_admin_url to prevent open redirect

  • Security fix: Fix Stored XSS (CWE-79) in the_content helper, #1149

    • The the_content helper was using .html_safe which bypassed Rails' XSS protection
    • Changed to use sanitize() which uses Rails' allowlist approach
    • Thanks, Pratik Karan for reporting this

  • Security fix: Fix IDOR (CWE-639) in CategoriesController, #1148

    • Users with category management permission for one Post Type could modify/delete categories from other Post Types by manipulating request parameters
    • Changed set_category to scope lookup to authorized @post_type instead of global lookup
    • Thanks, Seoyoung Kang for reporting this

  • Security fix: Fix SSTI (Server-Side Template Injection) in test_email endpoint, #1145

    • Replace render inline: with render plain: to prevent ERB evaluation of exception messages
    • This prevents authenticated admins from potentially executing arbitrary code via crafted error messages
    • Thanks, Amir Aliu and Enrik Mustafa for reporting this

  • Security fix: Fix SQL Injection in PostUniqValidator (authenticated, boolean-based blind SQLi via post slug), #1144

    • Use parameterized queries instead of string interpolation for slug validation
    • Thanks, Amir Aliu and Enrik Mustafa for reporting this

  • Security fix: Fix Stored XSS in post title rendering, #1143

    • Add HTML escaping to post titles when displayed in admin views (e.g., drafts list)
    • Thanks, Amir Aliu and Enrik Mustafa for reporting this

  • Security fix: Upgrade development Rails to 8.1.3 and other gems, #1141

  • Security fix: Fix mass assignment vulnerability in user registration (cross-tenant account injection), #1140

    • Replace permit! with explicit whitelist of allowed params in SessionsController#user_permit_data
    • Remove params[:meta] from user registration to prevent arbitrary meta injection
    • Thanks, Aryan Bhagat for reporting this

  • Security fix: Add authorization checks for broken access control, #1139

    • Thanks, Amir Aliu & Enrik Mustafa for reporting this

  • Security fix: Fix SSRF vulnerability in media URL upload, #1133

    • Thanks, Minjun Lee for reporting this

  • Security fix: Bump json, action_text-trix, bcrypt, loofah to fix vulnerabilities, #1132

  • Security fix: Fix RCE in custom-field i18n rendering, #1129

    • Thanks, Nguyen Trung Kien and Mohammad KH Yaseen for reporting this

  • Security fix: Fix path traversal in CamaleonCmsAwsUploader, #1127

    • Thanks, William chengw625@gmail.com, Michael Loomis (@investigato), and Wade Sparks III from VulnCheck for reporting this

  • Add Brakeman and bundle-audit to CI, #1161

  • CI: Update actions/checkout to v6, #1156

  • CI: Use binstubs in CI, #1151

  • Security: Add brakeman and bundle-audit gems to development/test groups, #1150

  • Docs: Harden AGENTS.md to enforce agent workflow, #1146

  • Docs: Add AGENTS.md and AI agent documentation in docs/ai/ for agent behavior, Rails/RSpec conventions, and project guidance, #1138

  • Fix: rewind Tempfile after scanning to avoid 0-byte uploads (regression fixed; tests added), #1137

    • Thanks, Minjun Lee for reporting this

  • Fix: Apply Rubocop style fixes, #1131

  • Dependencies: Bump flatted from 3.2.7 to 3.4.2, #1130

  • Fix: Add migration safe-guards and modernize migration code, #1128

  • Dependencies: Bump minimatch from 3.1.2 to 3.1.5, #1126

  • CI: Modernize CI, remove EOL Ruby/Rails versions, #1125

  • Dependencies: Bump cross-spawn from 7.0.3 to 7.0.6, #1122

  • Fix: Normalize widget behavior, #1120

  • Fix: Replace deprecated JSON.fast_generate with generate, #1116

2.9.1 (2025-03-15)

This release is fixing several security vulnerabilities! Please, upgrade ASAP!

2.9.0 (2025-01-06)

  • Fix false positive on malicious upload check
  • Add magic comment to silence Ruby 3.4 deprecation warnings
  • Feature: Support custom aws endpoint

2.8.3 (2024-09-16)

  • Remove unused underscore.js
  • Bump IntroJS to 7.2.0
  • Upgrade jquery-validate to 1.21.0
    • Add messages for Arabic language
    • Add methods_ln.js files with regexps for DE, NL, and PT languages
    • Modify admin layout view to load the methods_ln.js file with a javascript_include_tag if the file exists
  • Fix uploads to AWS S3 folders
    • Also, introduced the path traversal validation to the add_folder method, which was found unsafe

2.8.2 (2024-08-25)

  • Bump AdminLTE to 2.3.11
    • Has several CSS fixes and doesn't yet require jQuery 3.x
  • Fix TermTaxonomy attributes sanitizing to not remove translation tags in [#1091] (#1091)
  • Add bootstrap.min.css.map
    • Works OK in the development environment if the config.assets.debug = true is set.

2.8.1 (2024-08-21)

This release is fixing several security vulnerabilities! Please, upgrade ASAP!

  • Replace sass-rails with dartsass-sprockets
    • Remove sass and sass-rails gems from the main app's Gemfile when upgrading camaleon_cms to this version
  • Fix colorpicker missing admin asset, adding it to admin-manifest.css
  • Security fix: Mitigate arbitrary path write in uploader (GHSL-2024-182)
    • Thanks Peter Stöckli for reporting and providing clear reproduction steps
  • Add Rails 7.2 to stable testing on CI, point rails_edge to main branch
  • Security fix: Mitigate arbitrary path traversal in download_private_file (GHSL-2024-183)
    • Thanks Peter Stöckli for reporting and providing clear reproduction steps
  • Security fix: Mitigate stored XSS through user file upload (GHSL-2024-184)
    • Thanks Peter Stöckli for reporting and providing clear reproduction steps
  • Security fix: Mitigate remote code execution through code injection (GHSL-2024-185)
    • Thanks Peter Stöckli for reporting and providing clear reproduction steps
  • Security fix: Mitigate arbitrary file delete vulnerability (GHSL-2024-186)
    • Thanks Peter Stöckli for reporting and providing clear reproduction steps
  • Use actions/checkout@v4 on CI to remove warning about deprecated Node JS version

2.8.0 (2024-07-26)

  • Use jQuery 2.x - 2.2.4
    • If there are //= require jquery clauses in the main application, replace them with //= require jquery2
  • Add Ruby 3.3 and Rails 7.2 to CI
  • Replace Tuzitio links with camaleon.website and http with https
  • On cama_site_check_existence, if site is unknown, use allow_other_host: true for redirection to main site
    • Starting from Rails 7.0 a redirection to other host will raise an exception unless the redirect_to method is called with the allow_other_host: true option
  • Set sprocket-rails version to be at least 3.5.1
  • Use MiniMime for mime types, because the MiniMagick 5.0 has no Image#mime_type
  • Reimplement the temporary uploaded file removing, wrapping it in a bl…ock to make possible overriding the block in the app initializer to use an async job
  • Sanitize name and description attrs of TermTaxonomy classes to prevent XSS attacks
  • Potentially breaking change: Fix ActiveRecord deprecations from Rails 6.1
    • fields, field_values, and field_groups associations have been removed from the CustomFieldsRead mixin module
    • custom_fields, custom_field_values, and custom_field_groups associations should be used instead
    • Beware that the CustomFieldsRead mixin is included into the TermTaxonomy base model, PostDefault model, and UserMethods mixin

2.7.5 (2023-11-22)

2.7.4 (2023-04-11)

  • Sanitize error messages when rendering them directly from the controller

2.7.3 (2023-04-07)

  • Inclusion of CommonRelationships into subclasses is now performed in an inherited hook

2.7.2 (2023-03-24)

  • Fix bug rendering category pages

2.7.1 (2023-03-22)

  • Fix common relationships

2.7.0 (2023-03-22)

  • Change some render calls from inline to plain
  • Stop monkeypatching ActiveRecord::Base
    • Use CamaleonRecord, not ApplicationRecord, as a base class for the models
  • Fix canonical URLs for translated sites
  • Lint Ruby using RuboCop
  • Lint JS using ESLint
  • Use cama_contact_form v. 0.1.0
  • Migrate CoffeeScript files to JS
  • Do not redundantly compile default theme assets
  • Remove temporary dependencies
  • Add Ruby 3.2 to CI
  • Require Rails 6+
  • Require Ruby 2.7+

2.6.4 (2022-06-08)

  • Reformat JSON comments for OJ compatibility
  • Use OJ in testing
  • Test for asset existence when running spec
  • Fix some typos

2.6.3 (2022-03-11)

  • Move glyphicons to correct folder

2.6.2 (2022-02-21)

  • Fix TinyMCE icons
  • Update welcome post
  • Make sure built-in theme assets get compiled

2.6.1 (2021-12-7)

  • Ruby 3.1 support
  • Rails 7.0 support
  • Require Ruby 2.6+
  • Require Rails 5.2+

2.6.0.1 (2021-10-12)

  • Fix comment injection vulnerability
  • Fix DoS vulnerability when uploading empty SVG
  • Log out user when admin changes their password
  • Disallow uploading from local URLs to prevent SSRF

2.6.0 (2021-01-27)

  • Add Moldavian language
  • Separate locales in files per folders/namespaces
  • Add unfilled strings to English locale
  • Rails 6.1 support

2.5.3.1 (2020-08-04)

  • Use non-digest-assets gem for using 3rd party assets (fix missing not found glyphicon fonts)

2.5.3 (2020-07-02)

  • Russian locale additions and fixes
  • Fix deprecation warnings present in Ruby 2.7 and Rails 6.0
  • Fix admin error path
  • Process shortcodes when evaluating widgets
  • Add canonical option to seo
  • Theme template include i18n
  • Upgrade Bootstrap from 3.3.4 to 3.4.1

2.5.0 (2020-01-08)

  • feat: sprockets 4 support
  • feat: for sprockets 4, generate config manifest to precompile
  • feat: precompile assets only for sprockets <= 3x
  • fix: Rails 6 missing to_s for session id
  • fix: preview error

2.4.6.7 (2019-08-05)

  • Fixed rails 6 bundle install error
  • Added https to default uri options
  • Use default page if no other pages exist

2.4.6.4 (2019-08-05)

  • Fixed posts slug index length
  • Added support for rails 6
  • Improved themes list UI

2.4.6.4 (2019-05-02)

  • Updated aws-sdk dependency to include only s3 needed dependency available in aws-sdk v3+

2.4.6.3 (2019-05-02)

  • Fixed cache plugin to support several domains/hosts

2.4.6.2 (2019-05-02)

  • Fixed route errors for error for non static error pages

2.4.6.1 (2019-04-16)

  • Fixed s3 nil error

2.4.6.0 (2019-04-05)

Full Changelog

  • Cannot create site on Rails 6 #884
  • Loosen CanCanCan version restriction #886 (brian-kephart)
  • Set config.belongs_to_required_by_default = false for Rails 6 #885 (brian-kephart)
  • Use implicit return on case statement assignment #858 (chukitow)
  • Fixed update posts to exclude slug verification in trash posts
  • Updated min version of contact form plugin

2.4.5.14 (2019-03-24)

Full Changelog

Closed issues:

  • Issue in production mode #882
  • Missing template themes/[themename]/views/single #875

Merged pull requests:

2.4.5.13 (2019-03-11)

Full Changelog

Closed issues:

  • Contact form throws error on submission #877
  • "the_avatar" showing as undefined. #874
  • PG::UndefinedFunction: ERROR: function lower(boolean) when searching in admin panel #866
  • SEO field is not saving for specific custom group #863
  • module CamaleonCms::UploaderHelper - north_east north_west params #860
  • Camaleon CMS in Rails 5, adding a new post the form disappear when updating the category #859
  • Intro Popups in the Admin Screen #781

Merged pull requests:

2.4.5.12 (2018-12-04)

Full Changelog

Closed issues:

  • Broken Preview Function for Draft Post #861

2.4.5.11 (2018-12-04)

Full Changelog

camaleon_cms-2.4.5.11.gem (2018-12-04)

Full Changelog

Closed issues:

  • Some errors in apache proxy #844

Merged pull requests:

2.4.5.10 (2018-10-26)

Full Changelog

Closed issues:

  • How to override _data.js #855
  • Update the Website #848
  • How can I add new language ? #846
  • Site is down #840
  • Shortcode yield content #838
  • Problems loading the Documentation #837
  • install problem #833
  • Route problem #827
  • Multilanguage and varchar field length issue #820
  • Test fix prevents testing plugins #817
  • Support for old Ruby/Rails versions #813
  • Images are not being created in different versions #808
  • Uploading image doesn't auto orient #786
  • post order problem #783
  • Cant create theme without sudo #771
  • Sprockets::FileNotFound in CamaleonCms::AdminController#dashboard #763
  • AWS Media doesn't scale #757
  • Unable to add attachments to custom content type #753
  • Contact form throws error on submission #729
  • We're sorry, but something went wrong. If you are the application owner check the logs for more information. #728
  • Hi Owen #727
  • How to implement Paper Trials in Camaleon CMS? #725
  • Cannot add custom fields to custom user #719
  • Copy from Word into Rich editor? #717
  • Default user_model? #715
  • Media gallery uses different path than actual path #714
  • Serve camaleon assets from cloudfront? #709
  • NoMethodError in CamaleonCms::Admin::InstallersController#save #702
  • Redirect loop with existin devise model #699
  • Tags created with tag form do not appear #695
  • Tags for multiple post types #694
  • NoMethodError in CamaleonCms::Admin#dashboard #687
  • Comment's submit flash messages doesn't shows #686
  • Error action save_comment #685
  • NoMethodError in CamaleonCms::Admin::SessionsController#login_post #684
  • Authoring Posts plugin shows all users instead of current_site.users #681
  • Contact Form Item not translate to chinese #606
  • Feature request #597
  • warning: already initialized constant JSON::* #596
  • Can I migrate existing pages from BrowserCMS to CamaleonCMS? #595
  • I18n.backend translations not working #593
  • json pagination problem #584
  • Asset Undefined And Testing Repo #579
  • Unable to install. Command gem 'camaleon\_cms' not working. #573
  • Request Update Feature #572
  • Using Camaleon with existing database and models #567
  • Assign a template to a content-group global page #561
  • Bootstrap Sass variable and Mixin are also undefined with Camaleon CMS version 2.4 #560
  • Assets conflict #557
  • How to avoid N+1 queries in CamaleonCms? #556
  • Urgently BUG: Camaleon Version 2.1.1 does not upload file to S3 #555
  • Multiple Language: Editor field of other language doesn't show container body to input data #552
  • Integrate with an existing authentication system #545
  • Rspec tests are failing #540
  • Server migration and image url problem #538
  • How to add leadpages to Camaleon #535
  • Multi Site: How to assign users to specific sites only? #525
  • Image uploader caching is not scalable #518
  • Creating a folder in image uploader should clear cache #517
  • Theme settings missing #513
  • Favicon Causes DNS issues. #510
  • Image upload enhancements #509
  • Dynamic URLs for pagination #505
  • Test suite does not run #470
  • Setting Custom Homepage Via Theme Settings in Default Theme Not Working Correctly #467
  • How to create mobile app for Camaleon CMS and subdomains #462
  • Direction should be :asc or :desc #425
  • How to avoid numeric values in tags #403
  • NoMethodError in CamaleonCms::Frontend#index #397
  • Is there a blogs json api? #393
  • Themes assets not found on production #348
  • Hang in Heroku/Dokku push-deploy #321
  • Add Custom field #319
  • Custom field types extendable by plugins #293
  • MIT License #292
  • New user role for basic info, theme setting and Contact Response #285
  • Specs not running #228
  • Pt-BR translation to admin #177
  • "Author Name" Confusion in SEO Settings #98

Merged pull requests:

2.4.5.7 (2018-05-15)

Full Changelog

Closed issues:

  • image versions are not created #805
  • Plugin tests fail #799
  • Redirect after subscription #798
  • SVG uploads failing #787
  • Updating custom fields does not update parent #785
  • Image cropper is broken #782
  • wildcard ssl using nginx redirects page to localhost instead of main sub-domained site #780
  • [Request] Use Travis CI #778
  • There should be an endpoint for rendering a 404 page #772
  • translation missing: en.camaleon_cms.admin.post_type.private #768
  • Page not found not giving 404 status code #767
  • "wrong number of arguments (given 1, expected 0)" when using gretel #765
  • Create a folder with spaces breaks image path #756
  • ActionController::InvalidCrossOriginRequest: Security warning #742
  • Feature Request: Wordpress Import #34

Merged pull requests:

2.4.5.1 (2018-01-09)

Full Changelog

Closed issues:

  • 500 internal server error & can_edit_file? in Media #744
  • Any recommended approach to deploying from dev/staging to production? #743
  • A question about camaleon's asset #740
  • add new language to common.yml #736
  • the path to the media file breaks when the frontend and backend localizations do not match #733
  • Demo page crash #713
  • Timestamp of NavMenu and NavMenuItem not updated #539
  • TinyMCE Templates #463

Merged pull requests:

  • Replaces deprecated fields, field_values and field_groups associations #746 (fmfdias)
  • Re #740 modify admin-manifest file #741 (lanzhiheng)
  • added .svg extansion to validation image files method #739 (superchell)

2.4.5 (2017-11-23)

Full Changelog

Closed issues:

  • Unable to upload image: Internal Server Error #724
  • How to fix mixed content warnings when moving to production #722
  • Inactive site with no page selected is inaccessible #690
  • Camaleon store sources ? #356

Merged pull requests:

2.4.4.6 (2017-11-01)

Full Changelog

Closed issues:

  • No such file or directory @ dir_initialize #720
  • Edit link visible when viewing post category while logged out #718
  • Visibility plugin bug: Published Date not ok in list view #710
  • Disable create new sites? #708
  • Dynamic admin URL at system.json ? #707
  • Can't see changes when assigning field group to User #704

Merged pull requests:

2.4.4.5 (2017-10-09)

Full Changelog

Closed issues:

  • mounting? #700
  • Migration does not work #692
  • Image custom field #294

2.4.4.3 (2017-10-02)

Full Changelog

2.4.4.2 (2017-10-02)

Full Changelog

Closed issues:

  • ActiveModel::UnknownAttributeError in CamaleonCms::Admin::InstallersController#save #698
  • Support with Gitter? #697

2.4.4 (2017-09-30)

Full Changelog

Closed issues:

  • Not working: users_share_sites = false #691
  • Assets compilation failing working with webpack #688
  • Can't access admin panel for inactive site #682
  • Application stops working #680
  • Validation with contact_form #679
  • Plugin generator creates duplicate routes in Gemfile #663
  • undefined method `saved_change_to_attribute?' for #<CamaleonCms::Site:0x007ff468a826b8> #651

Merged pull requests:

2.4.3.12 (2017-08-13)

Full Changelog

Closed issues:

  • Query to find all object with a certain custom field value #673
  • Template is missing #612

Merged pull requests:

2.4.3.11 (2017-08-01)

Full Changelog

Closed issues:

  • show/hide custom fields based on another custom fields value #671
  • Loop on the multiple group custom fields on the FO #668
  • Can't create new custom_field_group #666
  • Changer order back office #665
  • Ukrainian Flag Image #664
  • Import Script to Camaleon CMS Database #659
  • Content group slug on multiple sites #655
  • Multiple Files Uploading #653

Merged pull requests:

2.4.3.10 (2017-07-08)

Full Changelog

Closed issues:

  • incomplete response in production env #661
  • [Question] Add fields to post category #656
  • admin post_types page fail to load from time to time #634
  • Feature Request: Memcached/Redis support #609

Merged pull requests:

  • Fix custom fields group issue on Rails 5.1.1 #667 (max2320)
  • Use Rails cache store in Front Cache plugin #662 (brian-kephart)
  • Cast parameters to hash to avoid error in rails 5 #660 (sudoaza)
  • upload files sequentially #658 (haffla)
  • using content slug instead of id to prevent conflict between multiple sites #657 (phlcastro)
  • fix error when using another model for authentication (ie.: devise) #654 (phlcastro)
  • memory leak in plugin routes #652 (niedfelj)

2.4.3.7 (2017-06-09)

Full Changelog

Closed issues:

  • Incomplete Documentation for Draper patch for Rails 5 #646
  • the_related_posts returns duplicate records #637
  • Title tags truncated to 65 chars #635
  • db:migrate StandardError Directly inheriting from ActiveRecord::Migration #625
  • Front Cache problem with Rails 5.1 #624
  • SEO fields not translate to other languages #621
  • default slug from title.to_url #619
  • remove pluralize for some locales #618
  • TinyMCE error after upgrading to 2.4.3.2 #617
  • How to display different versions/dimensions of an image #614
  • User Roles Disabled #613
  • Frontend routes issue #600
  • Customize email template #599
  • How to get the contact form to actually send the emails #598
  • Can I migrate existing pages from BrowserCMS to CamaleonCMS? #594
  • Validation error #591
  • how can I override default_url_options #590
  • Probably typo in posts controller #586
  • upload_file method in rake task #585
  • How to filter featured posts from a specific category #583
  • real estate website functionality #582
  • Missing pagination in admin user list #581
  • Display the featured image #580
  • How to loop through custom fields content #578
  • MiniMagick::Error when cropping #577
  • Can a custom post type be child of another custom post ? #576
  • Feature request: title tag for User profiles #575
  • S3 errors #571
  • Is there a function like blogcard or linkcard? #570
  • Colorpicker field type throws JS bugs in console and does not work #569
  • Warning: already initialized constant Cama::User #566
  • Wrong shortcode post search? #565
  • Enable ability to programatically tie a custom field to a post type #564
  • All users are have the permissions to update into admin user #563
  • Programatically enable custom field groups with multiple groups #562
  • No route matches {:action=>"search", :controller=>"camaleon_cms/frontend", :label=>"search", :slug=>"welcome"} missing required keys: [:label] #558

Merged pull requests:

2.4.3 (2017-01-07)

Full Changelog

Closed issues:

  • "Constrain proportions" can't be deselected in editor #554
  • Error when saving posts #553

2.4.2 (2016-12-21)

Full Changelog

2.4.1 (2016-12-21)

Full Changelog

Closed issues:

  • Could you please add haml for designing template? #551
  • Coffeescript is not defined #550
  • Allow Each Page's Meta Tags to be Editable #547

2.4.0 (2016-12-15)

Full Changelog

Closed issues:

  • NotNullViolation #548

2.3.7 (2016-12-12)

Full Changelog

Closed issues:

  • Method overwrite warning when precompiling #549
  • RSS feed error #544
  • 500 Internal Server Error #541
  • Problem with setting post dates #534
  • Typo #533
  • Question about login #532
  • S3 upload options #531
  • Deprecation warning #530
  • parent_auth_token #529
  • Request: async loading with cama_draw_custom_assets #521
  • Edit link visible when viewing post category while logged out #520
  • How to route subdomain to its own domain #514
  • Separate URLs for admin and public site #507
  • List of available plugins #497
  • TypeError in CamaleonCms::Admin::SettingsController#save_theme #496
  • Theme per Site #493
  • How can I Override FrontendController #492
  • Rails 5 #487
  • Rails console not running #485
  • Use only Admin portal of Camaleon with Rails 4 application #483
  • Assigning Custom Field Group to Users has no effects. #477
  • adding gem to my plugin #468
  • Creating content group in rails 5 #458
  • ActiveModel::ForbiddenAttributesError Rails 5 #450
  • Feature Request: External Link should have target. #444
  • Unable to upload media files. #418
  • Changing theme reverting back footer info #309
  • How to enable amazon S3 storage for all subdomains #270

Merged pull requests:

2.3.6 (2016-09-21)

Full Changelog

2.3.5 (2016-09-19)

Full Changelog

Closed issues:

  • Release a new version #489
  • Performance issues #461

2.3.4 (2016-09-14)

Full Changelog

Closed issues:

  • Rendering is broken when using narrower window widths #481
  • undefined local variable or method `doorkeeper_token' error with new changes. #476
  • undefined local variable or method `cama_root_url' with rails 5.0. #473
  • undefined method `id' for nil:NilClass while trying to access ecommerce posts as un logged in user. #472
  • Checkbox and Checkboxes in Custom Fields not working proerly #464
  • 2.1.2.6 tag missing #460
  • Change history #459
  • Cannot use shortcode #432

Merged pull requests:

2.3.3 (2016-08-16)

Full Changelog

Closed issues:

  • ActionController::RoutingError - Media routes fail when you use relative_url_root #437

2.3.2 (2016-08-16)

Full Changelog

Closed issues:

  • Languages support for camaleon #457
  • How to create/change ecommerce plugin as multi vendor store #453
  • rails generate camaleon_cms:install :error" Rais 5 #452
  • How to run specs #429

2.3.1 (2016-08-12)

Full Changelog

Closed issues:

  • ForbiddenAttributesError in ShippingMethodsController #455
  • Custom PaymentMethod Error #454
  • Slim/ Haml support #449
  • Where to define current site? #448
  • Adding custom post type and custom field programmatically. #447
  • Forbidden attributes error #446
  • Logo doesn't appear after uploaded. #445
  • Camaleon doesn't run in both rails 4.2.7 and with rails 5 ? #443
  • Draft posts can not be published #442
  • Camaleon App code #436
  • Reorder in menu does not work. #435
  • Register FAIL #433
  • undefined method `[]' for nil:NilClass error whith cms 2.2.1 and ecommerce 1.1 version. #428
  • install with rails 5.0 #424
  • redirect on creation of a second site #423
  • Not administrators users editing profile #417
  • Image in template email #415
  • What cased this problem ? How to solve this ? #413
  • How to override plugin views #405
  • uninitialized constant CamaleonCms::Admin::AdminController Error if I use cloudfront URL & while trying to delete Images #402

Merged pull requests:

2.2.0 (2016-06-15)

Full Changelog

Closed issues:

  • pt-BR problems #407
  • How to change title for posts #400
  • File upload size limit #377
  • Rails Best Practices #346
  • Switch to Devise #103
  • Tests #74

Merged pull requests:

2.1.2.1 (2016-05-20)

Full Changelog

Closed issues:

  • How to ensure only specified plugins and themse are available for subdomains #398
  • Adding translation by admin? #395
  • Please Deploy to ruby gem frequently #335
  • Unable to use cloudfront #280
  • Theme views aren't added to the view path #278

Merged pull requests:

2.1.2.0 (2016-04-29)

Full Changelog

Closed issues:

  • Custom fields api link broken - https://camaleon.website/custom-fields-api #394
  • Not a issue but.. Looking for documentation and camaleon website is down #391
  • Cannot use asset in localhost #390
  • We would like to suggest that external menu items also have visibility settings #389
  • I would like to suggest changing the route name for the back end. #388
  • Custom theme for admin interface? #387
  • Allow site admin to suspend a subdomain #386
  • Media folders can not be deleted with local storage #385
  • Sub menues? #384
  • Authorization issue #383
  • Basic install is generating a permission denied error #382
  • Compatibility with rails-composer #381
  • change search engine #380
  • Typo in CamaleonCms::CustomFieldsRead (post -> Post) ? #376
  • How to rename post type menu #375
  • Paginate Not Working when custom routes #374
  • An unhandled lowlevel error occurred while uploading a photo for a user profile. #373
  • Undefined local variable or method admin\_plugins\_contact\_form\_admin\_forms\_path #370
  • Problem with nav menu generation #364
  • Theming tutorial #361
  • Sending mail on Heroku #360
  • How to close down multiple language support in grain? #359
  • Subscribe form #357
  • Docker image #355
  • How to let users create subdomains using omniauth #354
  • Multiple Custom Field with same value #353
  • Camaleon documentation broken #342
  • undefined method `get_taxonomy' error #341
  • Custom Fields #329
  • Feature: Role management limited to site #325
  • "Slug can't be blank" when creating page #323
  • Commit "changed datetimepickerr" breaks creating posts. ref =>55dfe78906c59df3cb873a8e684f14cfef1b9a56 #315
  • nav-menu custom fields 500 error #307
  • Dutch Flag Image #302
  • Allow users to use cloudfront for AWS S3 bucket #291
  • Multiple Domain Needed #290
  • Shortcode don't have post's content #277
  • Tags on posts? #268
  • smtp email settings and notifications #265
  • How skip User model? #252
  • Reintroduced: Admin section breaks if changing slug of main site #249
  • Bug and weird behaivor of the create/update/recover/publish button on post edit/creation section #239
  • Wrong locale in backend translation #233
  • Permalink link not support utf-8 character #194
  • Build nav menu for plugins #160
  • Override custom post types in sitemaps #157
  • Default layout #153
  • Move system.json configuration into environment variables #141
  • Custom Post Types #129
  • Integrate Post/Page links into tinymce #96
  • Post Type form is confusing #95
  • Performance #93
  • Using Camaleon alongside existing app #89

v2.1.1.3 (2016-04-03)

Full Changelog

Closed issues:

  • Tinymce attempts to load plugins and themes #365
  • Assets not found after clobbering and precompiling assets #363
  • Excessive memory consumption problem #343
  • How can I have grid editor #340
  • example for create custom_field_groups at theme installation #337
  • Method_missing sender #336
  • Search error #330
  • File format not allowed #317
  • Media manager "shadow" items #313
  • Media manager: can't delete items #312
  • Opening category page gives page not found error #311
  • CMS demo is broken #306
  • Order post by drag drop #296
  • Custom Routes #275
  • Translation doesn't work when setting menues #271
  • undefined method `init_seo' #266
  • Custom permalink structure #158

Merged pull requests:

2.1.2 (2016-01-17)

Full Changelog

Closed issues:

  • Editor and Contributor user roles are cleared when adding a new Post Type #289
  • Internal Server Error while trying to upload image on post #287
  • NoMethodError if I try to create a subdomain(slug) with starting with capital letter #286
  • Can't apply font to custom theme #284
  • Allow users to create categories on post creation page #283
  • Just FYI, your documentation site is down` #282
  • How to let users create subdomains #281
  • undefined method `the_thumb_url' error if I click on user created tag #279
  • Better to have media in current_site.slug folder #272
  • How to use high_voltage pages as main site home page #267

2.1.1 (2016-01-08)

Full Changelog

Closed issues:

  • NoMethodError in CamaleonCms::Admin::SessionsController#login_post #274
  • Captcha image broken on your demo site #273
  • Multi languages with Contents Route Format => content/:post_type_title/:slug in Content Group #264
  • asset-theme-url incorrect path #263
  • Error trying to insert image on post #262
  • Contents menu icon personalize #260
  • Can not load plugin assets #258
  • None Favicon #257
  • How did you group your navbar by category under documentation? #256
  • show the default theme? #255
  • Newbie Question #254
  • Deployment to heroku : BreadcrumbsOnRails detected it won't be overridden. #251
  • Upgrade guide #250
  • ActionView::MissingTemplate in CamaleonCms::Admin::Settings#site #248
  • TypeError in FrontendController#index #244
  • TypeError (no implicit conversion of Time into String) #243
  • Logout on frontend redirects to dashboard #242
  • Bug when creating post simple custom field group #240
  • no implicit conversion of Time into String #237
  • Could not find "apps" in any of your source paths #236
  • loading of S3 assets in admin media index page takes too long #235
  • cannot stop intro popups #234
  • NoMethodError in CamaleonCms::Admin::SessionsController#login_post #232
  • theme generator not working #231
  • Cannot go to General Setting page #230
  • image custom field #229
  • Error when creating a custom field group #227
  • Custom Fields: undefined local variable or method `post_data' #224
  • Bug after update v2 ActionView::Template::Error (undefined local variable or method `root_url' #223
  • Missing template themes camaleon_cms v2 #222
  • Posts feature field #220
  • Broken Submit button on "Settings>General Site>Filesystem Settings" #218
  • undefined local variable or method admin\_plugins\_contact\_form\_admin\_forms\_path for CameleonCms::AdminController #216
  • awsS3: missing @fog_connection.endpoint on moduler branch #210
  • undefined method when migrating cameleon1x #209
  • Has Comments? Always true. #208
  • install error #207
  • missing template #206
  • LoadError "cannot load such file -- faraday" #204
  • error after installing AWS-S3 plugin #189
  • Undefined local variable or method params #186
  • Add footer text field #185
  • shortcodes.html.erb missing #178
  • Document to setup multiple domain with application #167
  • Expose camaleon view helpers to ActionController::Base.helpers #161
  • Cache problems #159
  • AJAX #146
  • Admin section breaks if changing slug of main site #134
  • Alternative File Manager? #107
  • OAuth api #101
  • Images upload on heroku #100

Merged pull requests: