1.0.8.1
givanz/Vvveb1.0.8.1Apr 19, 2026by givanz
AI Summary
Adds comprehensive multi-language support features, including additional languages on install and language slugs. It features a new Users list component and fixes carousel bugs, while patching critical RCE and SSRF vulnerabilities.
Key Highlights
- Add additional languages on install and homepage option.
- Fixed renamed failing to prevent rename to restricted file extensions.
- Deny phtml extension for media library upload and html extension for media library.
- Fixed Authenticated SSRF via 'oEmbedProxy' and Privilege Escalation vulnerabilities.
New Features
- Additional languages on install
- Users list component
- Language slug support
- SSRF and Privilege Escalation fixes
Full Release Notes
* Add additional languages on install page (https://github.com/givanz/Vvveb/commit/f85ca7c2bc389bda3cc2eca87b2514581a628c32) * Include nav element for page update when loading partial page content through fetch (https://github.com/givanz/Vvveb/commit/184ca3976f3b110b9b1942eddf4b5f3124fdcba1) * Return language slug column as language to avoid conflict with post slug (https://github.com/givanz/Vvveb/commit/52d9fb307ff9f1dfa3ce1a190360a539421109aa) * Theme install unzip bug in some hosting configuration fix (https://github.com/givanz/Vvveb/commit/399b74b0a742eb1709efbb02d29eca00aa0aca78) * Theme update (https://github.com/givanz/Vvveb/commit/2e678d47616d2bacbcaacee9df0cad321f8ce33e) * New escape vtpl macro (https://github.com/givanz/Vvveb/commit/7c74f1a716aaef7bc1528a50cab372dbab0e6dad) * Fixed carousel bugs and added slide settings for mobile and tablet, added youtube background option for sections (https://github.com/givanz/Vvveb/commit/c810c533ddfcaef04a4943a2f57e7f3e3c3fe0f0) * Set user id to 0 if anonymous comment (https://github.com/givanz/Vvveb/commit/1322d08cdc52379805c5c0964ec550320cbf05b3) * Delete user address method (https://github.com/givanz/Vvveb/commit/545f809223972df9bf9fb4eb60f736ad3ad829e7) * Add active class for active language and currency (https://github.com/givanz/Vvveb/commit/e7d9c13213ff6128014bec56effbc01b3e3c3529) * Don't add page for page 1 for pagination (https://github.com/givanz/Vvveb/commit/b4834cec132af1d7f853fc0957af2fb10dfb1754) * Homepage option and add additional languages on install page (https://github.com/givanz/Vvveb/commit/d32ce504e911aef7aac33dd6906c90956a9c2646) * Users list component (https://github.com/givanz/Vvveb/commit/3a8ac28339b0cf5a1ef3f09e310b928cf1ed9f49) * Product tag (https://github.com/givanz/Vvveb/commit/759e3b25a9acdfe4340643f7a0dde1c68bbb3e86) * Check mtime instead of adding expire time in file name (https://github.com/givanz/Vvveb/commit/88569fd2149eacd988de0eae174cf5052984d6a3) * Set relative path for url's inside style attribute (https://github.com/givanz/Vvveb/commit/df1c3e89852d60a8894375cab571da8b1252d0d1) * App support for generating controller and actions list (https://github.com/givanz/Vvveb/commit/b2834d899e38527d20e35bfd4cf907d63d82ffa2) * Generate temp name and store in storage folder if php native tempnam is blocked on shared hosting (https://github.com/givanz/Vvveb/commit/2710897dcefe1d6c03ccab169d6ba4260556f856) * Added namespace for totals (https://github.com/givanz/Vvveb/commit/d2e7a00ea9661524291c8105e7a006b13ba69dfd) * Added rounded integer rating (https://github.com/givanz/Vvveb/commit/6b790afe6a56cc5461f363272ef1e4a6d8d4bbba) * Wildcard search if only search has only one word (https://github.com/givanz/Vvveb/commit/c411e339386a06ee94196a8178b77e69b33e1637) * Edit order keep post values (https://github.com/givanz/Vvveb/commit/16d8f9340a3d8e026d251767fdb6c8e6e5d8fc99) * Fixed missing type notice for filters (https://github.com/givanz/Vvveb/commit/31e2d42f02292a29f99c8ef03e2d1df6172e06a9) * Fixed search order by score (https://github.com/givanz/Vvveb/commit/45dfefee51e3878c78d095d073247a31aa40f08b) * Added categories for admin search (https://github.com/givanz/Vvveb/commit/7a4ad759087bf237ff5734a3b77537de2d68a489) * Php 8.4 fix (https://github.com/givanz/Vvveb/commit/19b7bf580fe1d49a259e6a229303cf390ccb6894) * Fix theme install, show themes list after theme install (https://github.com/givanz/Vvveb/commit/2ed4a56af38e92c5f93e40980ec02652223448bc) * Fixed plugin slug issue (https://github.com/givanz/Vvveb/commit/8dd6c62d13c964a00e51a674a0d5ba923cd281b2) * Allow php code editing only for admin and super admin roles (https://github.com/givanz/Vvveb/commit/cc8816b289379debb4ec01bc07445e235e092d91) * Show not found if post id is missing for revisions page (https://github.com/givanz/Vvveb/commit/d04618315033027cfda7c7a86f6d7cbc7b5fb6ac) * Menu items image support (https://github.com/givanz/Vvveb/commit/d4806ff912ece64095d4a77a55b21f250c6ef0f5) * Site language homepage settings (https://github.com/givanz/Vvveb/commit/1b1d2aca4a71d4800ce7912f16c794988bd5ce94) * Site specific routes support (https://github.com/givanz/Vvveb/commit/f2b65e0150f627abc4385d984dd2ee5cf3e3f2ea) * Resize method for images (https://github.com/givanz/Vvveb/commit/582997719035e0d3d6818cd7c1b0b14b451e2504) * Site path support for using multi site within subfolders in addition to subdomains (https://github.com/givanz/Vvveb/commit/51fc2ce4083f9007bfe6b89b1c0395b2c2475b68) * Json decode parameter fix (https://github.com/givanz/Vvveb/commit/01419072980a1d609b0e2a7700d94ff79eabf471) * Use id instead of slug if translation is missing (https://github.com/givanz/Vvveb/commit/21c7e9a1f1b9b6477a996bc82c0542b2c73d866d) * Languages code refactor (https://github.com/givanz/Vvveb/commit/a7955a6e6a8c3188d5d7656fd27bc125a7397fab) * Fixed vulnerability "Unauthenticated Remote Code Execution via PHP Code Injection into 'env.php' During Installation", reported by @sh4dowalker Mohammed EL OUARDANI (https://github.com/givanz/Vvveb/commit/5162c1639130bd080ab63c7d856788cd59d6b3b7) * Fixed rename failing to prevent rename to restricted file extension in media library, 'Remote Code Execution via Chained Rename Bypass and .htaccess PHP Handler Injection', reported by @sh4dowalker Mohammed EL OUARDANI (https://github.com/givanz/Vvveb/commit/6fb8eaa998265e33e8802cbc220d8859dbc144f2) * Deny phtml extension for media library upload, fix for 'Remote Code Execution via Unrestricted .phtml File Upload', reported by @sh4dowalker Mohammed EL OUARDANI https://github.com/givanz/Vvveb/issues/418 (https://github.com/givanz/Vvveb/commit/23ac0e8c758d80f3c4d9224763c8b2359648270e) * Deny html extension for media library upload, fix for 'Malicious File Upload Leading to RCE', vulnerability reported by @0xHamy Hamed Kohi of Delta Obscura (https://github.com/givanz/Vvveb/commit/cc997d3359ea5e49a45c132f5dee3bc80fb441d7) * Fix for Authenticated SSRF via 'oEmbedProxy', vulnerability reported by (https://github.com/givanz/Vvveb/commit/2d356844f37819bf771e7cd5e12a8686975e0b2b) @0xHamy Hamed Kohi of Delta Obscura (https://github.com/givanz/Vvveb/commit/2d356844f37819bf771e7cd5e12a8686975e0b2b) * Fix for 'Privilege Escalation via 'role_id' Injection, vulnerability reported by @0xHamy Hamed Kohi of Delta Obscura (https://github.com/givanz/Vvveb/commit/0eca14af50f038915b8bf7ceec2becf6b6720b0a) * Removed default value from 'data' TEXT type column to avoid mysql error (https://github.com/givanz/Vvveb/commit/13c2142da2f3b86d5650c40766fc7fe8c604e981) https://github.com/givanz/Vvveb/issues/407 * Landing theme team demo images update (https://github.com/givanz/Vvveb/commit/e3beaf4cba6ec6e60fb8b504992952784f3ea15a) * Themes udpate (https://github.com/givanz/Vvveb/commit/8f883aac467d4a685d2b472917033643ce36a3be)