What's new
Security fixes.
Front-end category and article lists could show disabled, access-restricted or other-language content due to a filtering bug in the underlying model. The backend Scan and Rebuild tasks also lacked anti-CSRF protection. We recommend updating as soon as possible.
New translations.
Added machine-translated language packs for Greek, French, German, Spanish, Italian and Portuguese.
Joomla 7.0 compatibility.
Reworked the editors-xtd button plugin to use the new onEditorButtonsSetup event and removed reliance on properties and methods being deprecated ahead of Joomla 7.
Please also consult the CHANGELOG below for the full list of changes.
Changelog
New features
- Machine translations for el-GR, fr-FR, de-DE, es-ES, it-IT, pt-PT
Bug fixes
- [HIGH] Front-end lists ignored enabled/access/language filters (wrong model state keys); restricted content could leak
- [LOW] British English consistency in en-GB language strings
- [LOW] Hardened ORDER BY in article/category list models with a sort-column whitelist instead of escape()
- [LOW] PHP deprecation: null used as array offset on documentation pages
- [LOW] PHP warning: array to string conversion in backend Access/Language multi-select filters
- [MEDIUM] Backend Scan/Rebuild tasks lacked anti-CSRF tokens, allowing CSRF-triggered rescans/rebuilds
Miscellaneous changes
- Joomla 7.0: editors-xtd button plugin now uses onEditorButtonsSetup, drops CMSObject dependency (legacy fallback for J4.x)
- Joomla 7.0: replaced User::get() property access, which throws without the compatibility plugin
- Joomla deprecations: removed deprecated Factory::getUser() calls
- Joomla deprecations: replaced Factory::getDbo() in admin list layouts
- Joomla deprecations: replaced Table::getDbo() with getDatabase()