1.0.7.3

givanz/Vvveb1.0.7.3Oct 6, 2025by givanz

AI Summary

Security-focused release addressing multiple vulnerabilities plus subdirectory installation support and post/product type enhancements.

Key Highlights

  • Security fixes: CSRF protection for all forms and media upload mime type validation
  • Subdirectory installation support
  • Post type and product type support
  • Authentication tokens for admin users (REST/GraphQL)
  • User cover image support
  • Cache improvements for site data and routes

New Features

  • Post type support for post pages
  • Product type support for categories and URLs
  • Admin authentication tokens for API access
  • User login feedback improvements
  • Theme and plugin marketplace filtering

Full Release Notes

* Set for subdirectory detection https://github.com/givanz/Vvveb/commit/aa1b6aaa096e39c4100e85d2e392b6173aee68c9
* Admin theme update https://github.com/givanz/Vvveb/commit/329d2d7778c3f3dc996ed13574d3b3e70e189af7
* Redirect to new page only for new attributes https://github.com/givanz/Vvveb/commit/7392dc96103eb61c2def26cd2e7dccfb61f66737
* Category image support https://github.com/givanz/Vvveb/commit/30fa7654ea3eef3bc142c8485c61c3b6c94c98fb
* Don't cache components that are not usually global/reused https://github.com/givanz/Vvveb/commit/3897719fce37678318583d441d01632ab5171f7f
* Validation rules for themes/plugins market filtering and search https://github.com/givanz/Vvveb/commit/2a1ca406268aedc0dbf2c5adc4e576e87b452099
* User cover template update https://github.com/givanz/Vvveb/commit/94108cb74628620772dcea6318ce8491e322eb44
* Removed base href for admin template https://github.com/givanz/Vvveb/commit/f9dbd561b326a956e89a21affdc985b70c195724
* Removed site_id parameter for menu posts to show posts from other sites https://github.com/givanz/Vvveb/commit/c20092cd2fae8b8440fb18196d2252eaf605b0f9
* Post type support https://github.com/givanz/Vvveb/commit/81de2cf7ca68b58a01d6b7f5791c25cd18e0cf05
* Don't cache component if search parameter is provided https://github.com/givanz/Vvveb/commit/5bdd7de22834b5c6b53bf78ab934693bf822a53e
* Category image support https://github.com/givanz/Vvveb/commit/b927f17c2b5f91d64afb1d196bd74a988feb5661
* Post limit option https://github.com/givanz/Vvveb/commit/ebace57cf3b0bd9ae319cc09f0f0a805b1fe9cd1
* Added support for button values https://github.com/givanz/Vvveb/commit/cb6415630997fd095fb9fa83fc8d8aa84a81709e
* Marketplace templates categories update https://github.com/givanz/Vvveb/commit/6caa1178e7f7e1a1e47dd0d5a9ec498e38c6c843
* Added admin_auth_token parameter https://github.com/givanz/Vvveb/commit/88404ac65cb80f186fc3d1c7fe8174f6da72a90e
* Fix for plugins controllers namespace https://github.com/givanz/Vvveb/commit/93a35915d7a2741cdf11f2058fef231c86a1e0ff
* Added csrf for fetch post requests https://github.com/givanz/Vvveb/commit/245bd71ccd34ed8217b6151ca9fadf74ffd3da46
* Set correct path for subdir installs https://github.com/givanz/Vvveb/commit/7084b6c0bd61bc7a21e580cbee8a4fade2d5deb2
* Check both Bearer and Authorization headers for token for GraphQL and Rest API https://github.com/givanz/Vvveb/commit/6e4842b93a6d367a2d817a402b24a87792ebb91e
* Added ldjson response type https://github.com/givanz/Vvveb/commit/7a85d4eaa70ed5f37d50b3b6c31d3af24ad1904d
* Escape return reason text https://github.com/givanz/Vvveb/commit/60a67ca1163db679d39014ec29d4cf6fd3f1f483
* Set email page title https://github.com/givanz/Vvveb/commit/dfa49cb3d9ea072898039d1ac4b89af0382c2184
* Post/product preview https://github.com/givanz/Vvveb/commit/eb2f1bbacf92e6dbe3304e3ab5ed4ae399e62a87
* Backtrace info on queries errors, connect to db only if a query needs to be executed https://github.com/givanz/Vvveb/commit/cb9e3bcaa0bc1ab0d1da484099febb9770683d9a
* User login feedback for more info when login fails, to differentiate between non existing users and wrong password https://github.com/givanz/Vvveb/commit/9948f6da834918321340c57cf30eaa3528088fe6
* Skip column change diff changes for new tables https://github.com/givanz/Vvveb/commit/ca4dfca619670f16c96c567d418ab04bafe79dee
* New menu item Home for multi language sites with link to language home page for demo data https://github.com/givanz/Vvveb/commit/74b3af58ccb584ceee6182d49032e9c0b34e268c
* Added category after recursive function call for nested categories https://github.com/givanz/Vvveb/commit/fc6bb0d1ead39260f3e0a8c2ec2431c018c0a5d7
* Added id for label and input for categories pages component for use in css menu tree https://github.com/givanz/Vvveb/commit/29c9e8682fed72d901a71f48d2b0664d36911619
* Changed year to current_year to avoid conflict with query parameters https://github.com/givanz/Vvveb/commit/657c0fac0cc6dbd7fc5c15f60b962a12c0ace981
* Fixed post component content update https://github.com/givanz/Vvveb/commit/55489d8988cd821b0340291219b7575c1db1f281
* Cache site data https://github.com/givanz/Vvveb/commit/9cd80b8f5665b48e6a65306f0996e6b28fe45003
* Cache app routes https://github.com/givanz/Vvveb/commit/7daf17410e71859a08bf48bba1adf30616f0c3cf
* Use null to check if value is not cached, set crc32 of root directory for cache prefix for shared hosting for apcu/redis/memcached, added automatic purge for file cache https://github.com/givanz/Vvveb/commit/0ca05a07a6baf9a926ca6570493d320197e1151d
* Check if page lock exists before deleting https://github.com/givanz/Vvveb/commit/a8cc08592adb83b0624b95f49c36e55aecd88250
* Theme and plugin marketplace categories filter and search https://github.com/givanz/Vvveb/commit/0887e76d991dfd38ce084caa01aeb809be8cd687
* Update media only if parameters is present https://github.com/givanz/Vvveb/commit/42458e25f4019c73578fb4cfa8cf84ac30239c6b
* Changed categories get all query to avoid * full group missing columns warning https://github.com/givanz/Vvveb/commit/f612363adf9ac2f60b7a5e1a200bc918eae9b3f8
* Subdir path added for full site url https://github.com/givanz/Vvveb/commit/c76027ecb077db5370cc79f70f6e27b6ef5f93d5
* Changed post/product type event name and moved code to functions https://github.com/givanz/Vvveb/commit/9a355bb2391464b6735394a59b400596e85a66e6
* Show 404 if user not found https://github.com/givanz/Vvveb/commit/d86f0d3e8643758bfa9aa9e3d9eeacfca1645435
* Redirect to user dashboard if user already logged in when accessing login page https://github.com/givanz/Vvveb/commit/b2dd0e7b59781dfb6e6fedc1c2681bf3b42dd919
* Menu to site list on menu edit page https://github.com/givanz/Vvveb/commit/dfbe6360df1d31222698229b775b0537433b34ef
* Added pages and common pages like home, blog, signup etc for url input autocomplete https://github.com/givanz/Vvveb/commit/93b6e671f72b0f30c2aeaffc753e269ddbe17dd8
* User cover image https://github.com/givanz/Vvveb/commit/e09c10011525c9711045c707b4fdabfef8917473
* Authentication tokens for admin users to use with REST and GraphQL API's, username sanitization https://github.com/givanz/Vvveb/commit/0bc6e9d8cdc8bea98fff41d291956714cb8cfe12
* Use post/product type for breadcrumb urls to use correct route https://github.com/givanz/Vvveb/commit/e3284cd9a49e773aef7e7de7f33699c1c1e81dde
* Added product type to url generation to use correct route https://github.com/givanz/Vvveb/commit/ddc6d3d7b903f359616a8ab814eed8ff033873ea
* Product type support for product page https://github.com/givanz/Vvveb/commit/3db9cc00defa9854b29ed368902ed432d45e245a
* Post type support for post page https://github.com/givanz/Vvveb/commit/160d8629de63a495a3ee12c704ef08ab38f81bbb
* Product type support for category https://github.com/givanz/Vvveb/commit/85fa3b251583e909cb186a5d0064a772ecf73cec
* Added post type to url generation to use correct route https://github.com/givanz/Vvveb/commit/b69ddd8f9f36cef9f1ddc61879a64f50ea9c780a
* Use currently selected site id in admin dashboard for admin components https://github.com/givanz/Vvveb/commit/484123f066460469027ab03d4198c6d25e4700ab
* Fixed components wrong cache expire https://github.com/givanz/Vvveb/commit/4c8302a88e42f9e7aed73b5764152dcab7e653d9
* Skip pages without translations from pages list for multi language installs, global flag for system pages to disable delete. https://github.com/givanz/Vvveb/commit/bda70819608334980f1af61e5ce08928476891ae
* Compile translations gettext mo files to po files all in one single domain https://github.com/givanz/Vvveb/commit/a0baf5e9851163002153cbb773e652f9bbe04a95
* Fixed user group dropdown on user page https://github.com/givanz/Vvveb/commit/efcc138b2a1080e26a25289b12c76a0b7c1d8661
* Sticky navbar check if navbar element exists https://github.com/givanz/Vvveb/commit/09bc23e321e32bce699a4545b8615e3a01e48b7d
* VvvebJs updates https://github.com/givanz/Vvveb/commit/bb85b7db0fa5cb12fa7b40f4f8bd41db53d22080
* Added csrf protection to all forms and changed all state changing actions to post, vulnerability reported by https://github.com/givanz/Vvveb/commit/ad94c4a3f314ca4a46968d5565d069a9fbc821e3 @KhanMarshaI @0xHamy
* Media upload file type check by mime type to avoid uploading svg files with different extension, vulnerability reported by https://github.com/givanz/Vvveb/commit/6f3a4ab53f8a3c0fe5745e7fc159666678a49f39 @KhanMarshaI @0xHamy
* Avoid html entity encoding for html templates text on compile and change utf8 to UTF-8 for consistent locale https://github.com/givanz/Vvveb/commit/0a5cc3d0ca2215cc52c99bfc49a68d3652e30c35 https://github.com/givanz/Vvveb/issues/327
* Fixed XSS for reflected login data on user login form https://github.com/givanz/Vvveb/commit/bbd4c42c66ab818142240348173a669d1d2537fe https://github.com/givanz/Vvveb/issues/323

**Full Changelog**: https://github.com/givanz/Vvveb/compare/1.0.7.2...1.0.7.3