What's new
This release adds new language translations, fixes compatibility with upcoming Joomla and PHP versions, and closes a security-relevant issue around category access restrictions.
Highlights
- Security fix: it was possible to submit a contact request against a category that was disabled or access-restricted, bypassing the intended visibility rules. Frontend controller tasks were also restricted to only what the frontend actually needs, reducing the exposed attack surface.
- New translations for German (de-DE), Greek (el-GR), Spanish (es-ES), French (fr-FR), Italian (it-IT), and Portuguese (pt-PT), generated via machine translation.
- Compatibility: updated for Joomla 7.0 (removed
$app->input property access) and PHP 8.4 (implicit nullable method parameters).
Bug fixes
- [HIGH] You could target disabled or access-restricted categories on submission.
- [LOW] Form factory accessors were exposed as frontend controller tasks.
- [LOW] Fixed British English spelling and grammar in en-GB language files.
Changelog
New features
- Machine translations for de-DE, el-GR, es-ES, fr-FR, it-IT, pt-PT
Bug fixes
- [HIGH] You could target disabled or access-restricted categories on submission
- [LOW] Fixed British English spelling and grammar in en-GB language files
- [LOW] Form factory accessors were exposed as frontend controller tasks
Miscellaneous changes
- Joomla 7.0 compatibility: replace removed $app->input property access
- Moved from Babel to Terser for JavaScript minification
- PHP 8.4 compatibility: implicit nullable method parameter in ItemController