Release phpwcms v1.12.0

Happy mid-2026! We are pleased to announce the release of phpwcms v1.12.0. This release includes major security hardening, PHP 8 compatibility improvements, dependency updates, and feature enhancements.

What's Changed

🛡️ Security Hardening

XSS Mitigation: Resolved security vulnerabilities by properly escaping template outputs (#372).
Cryptographically Secure CSRF: Implemented cryptographically secure CSRF tokens and updated translations.
UX Alert Hardening: Added warning icons (RTL-aware) and improved link visibility for CSRF alerts on the login page.
Web Server & Configuration Hardening:
- Blocked public access to Composer configurations (composer.json, composer.lock) and PHPStan configurations via .htaccess.
- Aligned and hardened rewrite rules of nginx.conf and IIS web.config to match the updated .htaccess rules.

⚙️ PHP 8 Compatibility & Bug Fixes

Array Type & Unserialize Warnings: Resolved various PHP 8 array type warnings and unserialize check errors in the shop system and content rendering engine.
Image Helper Modernization: Modernized the core image helper module to ensure clean operation under PHP 8.
Array Merge Fix: Resolved a TypeError in cnt25.takeval.inc.php during array_merge execution.
Include Path Fixes: Corrected the require_once order and paths for conf.inc.php and default.inc.php (#371).

✨ Features & Enhancements

TinyMCE 8 Integration: Integrated the new TinyMCE 8 editor option into user profiles and the tabs template.
Disk Caching for Sitemap: Implemented disk caching for the sitemap and enabled feed URL generation for News modules.
Localisation & Version Check: Localized calendar month names and weekdays, and updated the version checker to use secure SSL connections.
CookieConsent v3 Translation: Passed user-defined customize text to the CookieConsent v3 modals to ensure custom buttons are correctly localized.
Deprecations: Formally deprecated obsolete media plugins (Flash, RealMedia, QuickTime) in favor of HTML5 native video or Video.js.

📦 Dependencies & Cleanup

Libraries:
- Updated jQuery to 4.0.0 and jQuery Migrate to 4.0.2.
- Upgraded Symfony polyfills to v1.38.1.
- Updated Guzzle, PHPMailer to 7.1.1, PHPSpreadsheet to 5.7.0, and league/oauth2-google to 5.0.0.
Codebase Cleanup: Cleaned up outdated MooTools and jQuery remnants and removed the obsolete GoogleMapsAPI directory.

Upgrade Instructions

You can view the full comparison of changes since the last version here.
Remember that it's recommended to upgrade legacy phpwcms installations (< v1.10) to the legacy release v1.9.48 first.

Assets 2