-------------------------------------------------------
Changelog Version 2.13.10 R26 Security Update 29-07-2026
-------------------------------------------------------
add src\Security\CodeGuard for token-based checks of uploaded or edited PHP code
scan module and template ZIP archives before extracting them into public addon directories
scan media ZIP archives before extracting them into public media directories
count all safe files extracted from media ZIP archives so nested ZIP/readme test files do not report a false upload error
scan language files before copying them into the languages directory
block dangerous Droplet code on save/import; commented examples are ignored
auto-disable existing active Droplets with blocked calls when viewed or edited in the backend
validate user group assignments server-side to prevent manipulated requests from assigning foreign groups
add .htaccess protection for Droplet example/archive/temp directories
add temp/codeguard.log JSON-lines audit log and CodeGuard admin tool
add CodeGuard-ID to user-visible block messages and log entries; messages support German/English with English fallback
add temp/.htaccess protection for CodeGuard logs and security reports
add read-only inventory scan in the CodeGuard admin tool and SECURITY-UPDATE-2.13.10.md documentation
include media executable files, .htaccess and active SVGs in the CodeGuard inventory scan
block dynamic PHP calls such as call_user_func() and variable functions in uploaded or edited code
block fully-qualified and namespaced variants such as \system() and \call_user_func()
scan direct media uploads before saving them; active SVGs and double extensions are blocked, executable file types are rejected before saving
align upgrade default rename_files_on_upload with fresh installs by adding inc
keep settings template selection limited to path/existence validation; installed templates are reviewed by CodeGuard inventory scan
allow WebsiteBaker direct-access guards using $_SERVER in language/template files while keeping $_SERVER blocked in Droplets
display forbidden SVG element names with square brackets in user-visible CodeGuard messages
fix PHP 8.x deprecated logout cookie lookup when old_id is missing
remove deprecated PHP 8.5 imagedestroy() calls from admin media thumbnail output
WebsiteBaker Modules, Snippets, Admin-Tools
WebsiteBaker 2.13.10
user rating: 
(click to vote)
(click to vote)WB approved Complete WB-Packages
 |
|
||||||||||||||||||||
|
WebsiteBaker 2.13.10 is an important security update for the WebsiteBaker 2.13.x series. Updating to this version is strongly recommended for all existing 2.13.x installations. This full package can be used for new installations and upgrades from existing WebsiteBaker versions. It contains the WebsiteBaker core, bundled modules and templates, required 3rd-party libraries, and the latest maintenance and security updates. The release includes CodeGuard protection improvements for add-on installation, language files, media uploads, media ZIP extraction, Droplet handling, and related backend checks. Rev 26 |
|||||||||||||||||||||
Release history | |||||||||||||||||||||