WebsiteBaker Modules, Snippets, Admin-Tools

-------------------------------------------------------
Changelog Version 2.13.10 R26 Security Update 28-07-2026
-------------------------------------------------------
add src\Security\CodeGuard for token-based checks of uploaded or edited PHP code
scan module and template ZIP archives before extracting them into public addon directories
scan media ZIP archives before extracting them into public media directories
count all safe files extracted from media ZIP archives so nested ZIP/readme test files do not report a false upload error
scan language files before copying them into the languages directory
block dangerous Droplet code on save/import; commented examples are ignored
auto-disable existing active Droplets with blocked calls when viewed or edited in the backend
validate user group assignments server-side to prevent manipulated requests from assigning foreign groups
add .htaccess protection for Droplet example/archive/temp directories
add temp/codeguard.log JSON-lines audit log and CodeGuard admin tool
add CodeGuard-ID to user-visible block messages and log entries; messages support German/English with English fallback
add temp/.htaccess protection for CodeGuard logs and security reports
add read-only inventory scan in the CodeGuard admin tool and SECURITY-UPDATE-2.13.10.md documentation
include media executable files, .htaccess and active SVGs in the CodeGuard inventory scan
block dynamic PHP calls such as call_user_func() and variable functions in uploaded or edited code
block fully-qualified and namespaced variants such as \system() and \call_user_func()
scan direct media uploads before saving them; active SVGs and double extensions are blocked, executable file types are rejected before saving
align upgrade default rename_files_on_upload with fresh installs by adding inc
keep settings template selection limited to path/existence validation; installed templates are reviewed by CodeGuard inventory scan
allow WebsiteBaker direct-access guards using $_SERVER in language/template files while keeping $_SERVER blocked in Droplets
display forbidden SVG element names with square brackets in user-visible CodeGuard messages
fix PHP 8.x deprecated logout cookie lookup when old_id is missing
remove deprecated PHP 8.5 imagedestroy() calls from admin media thumbnail output

-------------------------------------------------------
Changelog Version 2.13.9 R25 05-11-2025
-------------------------------------------------------
fix issue in media administration, see
https://forum.websitebaker.org/index.php/topic,32443.0.html

-------------------------------------------------------
Changelog Version 2.13.9 R24 01-09-2025
-------------------------------------------------------
fix broken frontend.functions.php / missing register_frontend_FrontendCss()

-------------------------------------------------------
Changelog Version 2.13.9 R23 01-09-2025
-------------------------------------------------------
replace wrong language-files, missing LANGUAGE_LOADED-definition

-------------------------------------------------------
Changelog Version 2.13.8 R22 28-08-2025
-------------------------------------------------------
change script-url in upgrade-script, produce redirect-error, when wb installed in a subfolder on some server-configurations
remove DA.php from Delete-List in getRemoveFiles-Array

-------------------------------------------------------
Changelog Version 2.13.8 R21 27-08-2025
-------------------------------------------------------
language fix - replace all Straight Apostrophe with Typographic (or Curly) Apostrophe in all language files - produce js-errors
add abort-process for chmod0444
add own css for upgrade-script-errors
Change min- & best-version in initialize.php
fix typofix in pagetree, produce css error
-------------------------------------------------------
Changelog Version 2.13.8 R20 09-08-2025
-------------------------------------------------------
update versions info in all files

-------------------------------------------------------
Changelog Version 2.13.8 R19 09-08-2025
-------------------------------------------------------
fix admin/media/upload.php - function $processAndSanitizeImage () - prevent for errors, if one resize parameter == 0

-------------------------------------------------------
Changelog Version 2.13.8 R19 09-08-2025
-------------------------------------------------------
remove old unsafe function $resizeImages in admin/media/upload.php and replace it with $processAndSanitizeImage. Have to use now Intervetion/image in every case, not only in resize-process. the prevent for manipulated Image files
recode old function media_filename() to prevent for upload of manipulated files like _.htaccess
update version numbers in all files

-------------------------------------------------------
Changelog Version 2.13.8 R18 09-08-2025
-------------------------------------------------------
Add missing LANGUAGE_LOADED-definition in all language files - forgotten in the new translations

-------------------------------------------------------
Changelog Version 2.13.8 R17 09-08-2025
-------------------------------------------------------
add info for restart the svn in both Docu/Readme-Files

-------------------------------------------------------
Changelog Version 2.13.8 R16 09-08-2025
-------------------------------------------------------
add missing type-declaration in admin/media/upload.php for $jpegQuality

-------------------------------------------------------
Changelog Version 2.13.8 R1 - R15 09-08-2025
-------------------------------------------------------
rebuild the SVN and add a new branch
-------------------------------------------------------
Changelog Version 2.13.7 R165 07-08-2025
-------------------------------------------------------
update versions numbers again

-------------------------------------------------------
Changelog Version 2.13.7 R164 07-08-2025
-------------------------------------------------------
fix broken date display in WB-Info-Window, wrong date format

-------------------------------------------------------
Changelog Version 2.13.7 R162-163 07-08-2025
-------------------------------------------------------
update keywords in fileheaders and update versions number

-------------------------------------------------------
Changelog Version 2.13.7 R161 07-08-2025
-------------------------------------------------------
update composer files

algo26-matthias/idna-convert 3.2.0 A library for encoding and decoding internationalized domain names
intervention/image 3.11.4 PHP image manipulation
mixable/color-utils 1.0.5 PHP utilities to convert any values between RGB, HSL, CMYK, YUV and HEX colors.
nesbot/carbon 2.73.0 An API extension for DateTime that supports 281 different languages.
php81_bc/strftime 0.5.0 Locale-formatted strftime using IntlDateFormatter (PHP 8.1 compatible)
phpmailer/phpmailer 6.10.0 PHPMailer is a full-featured email creation and transfer class for PHP
symfony/polyfill 1.32.0 Symfony polyfills backporting features to lower PHP versions
twig/twig 3.21.1 Twig, the flexible, fast, and secure template language for PHP

-------------------------------------------------------
Changelog Version 2.13.7 R160 07-08-2025
-------------------------------------------------------
add 356 new translation files

-------------------------------------------------------
Changelog Version 2.13.7 R157 - 159 07-08-2025
-------------------------------------------------------
fix FTAN-Problems in outputfilter, Change logik for the save-procedure
fix load-structure for floatbox-plugin

-------------------------------------------------------
Changelog Version 2.13.7 R156 23-07-2025
-------------------------------------------------------
framework/helpers/Precheck.php - replace old fightbulc/Moment-Plugin (working with Dates) with the modern Carbon/Carbon via composer
-------------------------------------------------------

Changelog Version 2.13.7 R155 23-07-2025
-------------------------------------------------------
XSS-Prevention in WB-Search

-------------------------------------------------------
Changelog Version 2.13.7 R140 - 154 23-07-2025
-------------------------------------------------------
replace old PhpThumbFactory (to build Thumbs in Media && News) with modern intervention\image via composer
replace old fightbulc/Moment-Plugin (working with Dates) with the modern Carbon/Carbon via composer
refactor autoload-function and remove

-------------------------------------------------------
Changelog Version 2.13.7 R138 - 139 11-07-2025
-------------------------------------------------------

remove modules/output_filter/languages/DE.php from the remove-list, not longer needed to remove this file
remove DOCU-folder in modules/droplets - copy&paste-error


-------------------------------------------------------
Changelog Version 2.13.7 R129 - 133 09-07-2025
-------------------------------------------------------
+ add changelog-file to module code && droplets (R131)
+ fix problem with numeric folder names in media-options, was not possible to read the pathsettings for this foldernames (R132)- (admin/media/upload.php - Ln 173 - 203)
+ add ltrim, to remove possible empty spaces in front of directory names (admin/media/upload.php - Ln 185)

-------------------------------------------------------
Changelog Version 2.13.7 R124 - 128 09-07-2025
-------------------------------------------------------
+ change default fontsize for editarea-windows on this places: /modules/code/modify.php, droplets/cmd/modify_droplets.php, modules/edit_module_files.php
from (old) 14pt to (new)12pt

-------------------------------------------------------
Changelog Version 2.13.7 R120 - 123 08-07-2025
-------------------------------------------------------
admin/media/browse.php + admin/media/thumb.php - now takes into account the aspect ratio of the original image, Thumb is re-produced with frame
+ refresh the version number on different places and also changelog

-------------------------------------------------------
Changelog Version 2.13.7 R104 - 119 11-06-2025
-------------------------------------------------------
- remove old jquery versions 1.9.1, 1.12.1, 3.3.1
+ set jquery 3.5.1 as default
+ refresh the version number on different places

-------------------------------------------------------
Changelog Version 2.13.7 R100 - 104 11-06-2025
-------------------------------------------------------
+ refresh the version number on different places

-------------------------------------------------------
Changelog Version 2.13.7 R99 09-06-2025
-------------------------------------------------------
+ limit the submitted parameters to g,p & _wb to prevent XSS-attacs
+ added proofmethod for integer values and text in string, remove all other chars from urls, only a-z, A-Z, 0-9, /,_,-

-------------------------------------------------------
Changelog Version 2.13.7 R97 08-06-2025
-------------------------------------------------------

fix logical issues in accout/detail.php for display_name, language & timezone
limit the submitted parameters to g,p & _wb to prevent XSS-attacs

-------------------------------------------------------
Changelog Version 2.13.7 R96 05-10-2025
-------------------------------------------------------

fix image path for preview pics in media administration
change some description in output_filter
add german translation

-------------------------------------------------------
Changelog Version 2.13.7 R88 05-08-2025
-------------------------------------------------------

class.database.php - prevent escapeString() for empty strings
upgrade all wb-version-nr (3x)
remove some unneeded test-folders in vendor-packages
upgrade of all composer packages, incl registration & autoload
- algo26-matthias/idna-convert (v3.2.0)
- guzzlehttp/psr7 (2.7.1)
- intervention/image (2.7.2)
- jakeasmith/http_build_url (1.0.1)
- mixable/color-utils (1.0.5)
- php81_bc/strftime (0.5.0)
- phpmailer/phpmailer (v6.10.0)
- psr/http-factory (1.1.0)
- psr/http-message (2.0)
- ralouphie/getallheaders (3.0.3)
- symfony/deprecation-contracts (v3.5.1)
- symfony/polyfill (v1.32.0)
- twig/twig (v3.21.1)

-------------------------------------------------------
Changelog Version 2.13.7 R60 03-23-2025
-------------------------------------------------------

News - delete_news - add translation for group-delete-error (was only english)
helpers/cronJob.php - fix error, is $sMessage is empty

-------------------------------------------------------
Changelog Version 2.13.7 R44 03-23-2025
-------------------------------------------------------


- remove unneeded Line-output for every usage of GDlib
- removed personal mail adress as example in cronCheck
+ fix error in page_header() && page_footer(), $sTpl cannot be empty, must be string or array
- remove double files & folders in /vendor/psr - copy&paste-error
- ckeditor-upgrade.php - $aTmp cannot be nothing, must be String or Array - this stops the globale upgrade
+ fix headers in redirect for multi-lingual pages - doesn't work in SEO
- remove .setFrontend.inc-inclusion in frontend.functions.php
+ fix delete-buttons for items && groups in news.overview in backend
+ add file types avif && svg as preview in media administration
+ add avif && svg in media-handling in ckeditor - images
+ add two new icon in DefaultTheme, to show avif && svg in media-administration, if no preview possible
+ fix errors for shorthand IPv6-adress, old code support only complete adresses
- remove old namespace-definition in Zebra-Image
+ fix some small typofix in any css-files
- remove some unneeded lines in admin/groups/save.php Ln 94-99, copy&paste-error, not possible, to save group datas