andy/neoCMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 11 Wiki Activity

docs: document page locking and prior security fixes

Browse Source 
README, the changelog and the built-in welcome page were missing the
page-lock feature and the bootstrap/LoginRateLimiter/Logger hardening
from the earlier security audit.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Geoff Moore
2026-10-02 12:11:09 +01:00
co-authored by Claude Sonnet 5
parent 83ae3a08ff
commit bc4730eb30
3 changed files with 23 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+10 -2
View File
@@ -29,7 +29,8 @@ Further technical documentation:
deleted pages can be recovered from the Dashboard.
* Page Management: Search, duplicate, rename, and delete editable HTML pages, including pages in subdirectories. The New page section of the Pages dialogue is a
three-step wizard (template, page name, navigation group); the new page stays a private draft until it is published. Any page can
be offered as a template with Create Template.
be offered as a template with Create Template. Administrators can Lock a page to stop editors publishing, saving a draft, or
scheduling changes to it; administrators are never restricted by a lock.
* Media Library: Upload images, documents, video, and audio; they are sorted into Imagery, Documents, Video, and Audio by file
extension. Reuse them from the editor's Media library button, maintain alternative text or link text, see usage counts, and
remove files. Executables and files containing code are refused.
@@ -137,7 +138,7 @@ There are two roles:
| Role | Can do |
| --- | --- |
| `editor` | Edit content, save drafts, upload images, publish or schedule pages, and restore revisions or deleted pages. Cannot change the site structure or manage users. |
| `administrator` | Everything an editor can, plus creating new pages, duplicate, rename and delete pages, templates, navigation menus, shared content, site scan, deleting media, and managing users. |
| `administrator` | Everything an editor can, plus creating new pages, duplicate, rename, delete and lock pages, templates, navigation menus, shared content, site scan, deleting media, and managing users. |
The former `publisher` role is now part of `editor`; existing `publisher` assignments are treated as `editor`. Users without an
explicit valid role receive `editor`, the least powerful role.
@@ -286,6 +287,13 @@ Templates are the files in `cms/templates/` plus any page you choose **Create Te
is used live (later edits to it show in new pages), and the **Delete** action in the template list deletes a template file or
stops using a page as a template (the page is kept).
### Locking Pages
Administrators can **Lock** a page from the Pages list to stop editors publishing, saving a draft, or scheduling a change to
it; a **Locked** badge shows next to the page name for everyone. Administrators are never restricted by a lock, and locking
is independent of Create Template, Duplicate, Rename, and Delete, which were already administrator-only. A lock follows a
page when it is renamed, is cleared when the page is deleted, and is never copied onto a duplicate.
### Subfolder Installs
The site can live in a subfolder such as `http://localhost/neocms/`. The URL prefix (`basePath`) and the folder that contains