Administrators can lock a page from the Pages list to stop editors
publishing, saving a draft, or scheduling a change to it. Administrators
are never restricted by a lock. State is stored per-page URI in the new
cms/data/pagelocks.json, following the existing pagetemplates.json
pattern: it moves with the page on rename, is cleared on delete, and is
never copied onto a duplicate.
- New lockPageAction and assertNotLockedForEditor() guard, called from
save/saveDraft/schedule.
- getPages responses gain a locked flag; the Pages list gets a Lock/
Unlock row action and a Locked badge.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- bootstrap.php: disable display_errors/display_startup_errors in favour of
PHP's own error log, so an uncaught engine error can never leak a stack
trace or filesystem path to a client.
- LoginRateLimiter: cap tracked address/identity buckets at 20000, evicting
the least recently active first, so a distributed flood of distinct
addresses or login names cannot grow login-attempts.json without bound.
- Logger: prune expired audit logs probabilistically (1-in-100) instead of
on every request, since every request already builds a Logger and a full
directory scan on each one scales with total rotated log files.
Found during a self-review security audit; full findings available on
request.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Users (Tools > Users)
- Everyone can update their display name, email and password; administrators can add,
edit, invite (one-time link), block and delete accounts.
- Accounts in config.local.php stay locked to config (the main administrator); CMS
accounts live in data/users.json. Sign-in is by login name.
- Roles are now editor and administrator (publisher is an alias of editor).
- Account protection: password hashes only (12-72 characters), administrator password
confirmation for sensitive actions, rate-limited failures, hashed single-use invite
tokens, self-lockout guards, sessions of blocked/deleted users end on the next request,
every account event audited without secrets.
- dataDirectory can move data outside the web root; the dashboard recommends it.
Media library
- Upload images, documents, video and audio, sorted into four categories by extension.
- Extension allow-list; executables, scripts, HTML/SVG, archives, legacy and macro Office
files refused; content sniffing; files containing code refused; PDFs with scripts refused;
Office/OpenDocument packages inspected for macros and embedded objects.
- Media library button in the editor inserts an image, document link, video or audio.
Navigation menus, pages and interface
- The site scan detects primary/secondary navigation and seeds Navigation Menus; menus can be
renamed, edited and deleted but not created by the CMS; a scan button finds new navigation.
- New page wizard (template, name, navigation group) in the Pages dialogue; new pages stay
private drafts until published; pages can be used as templates.
- Deleted pages can be recovered from the Dashboard.
- Full-width top bar with the user at the top right, device icons, consistent buttons.
Tests and docs updated (tests/run.php, README, ARCHITECTURE, DEVELOPMENT, CHANGELOG).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds a whole-site "Site scan" that analyses pages, images and SEO tags and
makes pages editable in one step, moves Save Draft / Schedule Publish /
Publish Now into the content editor, supports installs in a subfolder, and
hardens metadata handling. Only the cms/ directory is changed.
Added
- Site scan (Tools > Site scan, administrators): reports pages, folders,
editable/untagged pages, images without alt text, broken local
references, unused uploads and missing title/description/Open Graph
tags; then tags <main> or top-level article/section content areas,
images outside editable regions and photo placeholders, and inserts only
missing SEO tags. Page source is edited byte-for-byte (no DOM
re-serialisation), a revision is kept for every changed page, later scans
list only pages that still need changes, and work runs in small batches
with a progress bar and "N of M pages" count. New administrator-only
actions: listSitePages, analyseSitePages, applySiteTagging.
- Click-to-edit images and photo placeholders (role="img" boxes) with a
Media Library picker and alt text.
- Subfolder installs (basePath / siteRoot auto-detected); root installs
behave as before.
- Audit/activity entries for cancelled schedules, image uploads, alt-text
changes and failed scheduled publications (shared Activity class).
- Snackbar (success/error) and table-style dialogs for the page picker,
revision history, dashboard, shared content, menus and site scan.
Changed
- Editor actions are now Save Draft | Schedule Publish | Publish Now |
Cancel; saving in the editor and applying image/SEO changes stores a
private draft. The toolbar no longer has Save Draft, Schedule or Publish.
- CMSController split into PagePaths, ContentDom and Activity; entry points
share cms/bootstrap.php. Restoring a deleted page uses
PageNotFoundException instead of matching an error message.
Fixed
- Lost updates on JSON metadata (locked FileStore::update).
- Non-atomic site-wide shared-content/menu writes; non-ASCII text handling.
- Scheduled publishing contending for a lock on every request.
- Revision pruning dropping the newest revision (revisions gain a "ts").
- Stale cached pages in the editor preview after a site is replaced.
- Saved drafts reloading without stylesheets or the correct page path, and
Publish discarding a draft that was not re-offered in the same session.
- HTML entities in page titles; backslashes in folder names on Windows.
Migration: no manual steps. basePath/siteRoot are optional and detected
automatically. The analyseSite action was replaced by listSitePages and
analyseSitePages.
Geoff MooreandClaude Sonnet 5
Geoff Moore
Andy Dixon
Andy Dixon
Andy Dixon