Proclaim 10.7.1 Stable
Proclaim 10.7.1 is a maintenance release. It closes two ways credentials could end up in server logs, hardens how template code is written to disk, fixes three faults that only ever appeared on a freshly installed site, and stops two places where the admin quietly discarded your work.
Please rotate these keys after updating
Two settings screens used to send credentials as part of the web address rather than in the request body. Web servers, proxies and analytics routinely record full addresses, so those values may be sitting in log files.
- Your AI provider API key, if you use the AI assistant.
- Server Test API credentials, including the YouTube Data API key and the Resi client secret, if you have used the Test API button.
The release stops it happening. It cannot remove what was already written, so issue new keys and retire the old ones.
Template code is written more carefully
A template code record becomes a real PHP file in your site. Three faults in how that file was named and placed are fixed: the filename is now validated on every path that writes one, a record can no longer overwrite a layout the package itself ships, and a template's title can no longer decide where an export is written or what a download is called.
Permissions for template code are also clearer. Because those files are PHP that your site runs, being allowed to create or edit them is as powerful as being a Super User. The permissions screen now says so on the three settings that carry it, the edit form says it above the editor, and System Health reports any group that has it without being a Super User. Nothing is taken away — if delegating this is deliberate, the finding can be dismissed.
Fixed on newly installed sites
- The Layout Editor tab showed a Joomla error page instead of the editor. It affected every fresh install; a site that had been configured never saw it.
- Two accessibility faults: the control panel and location wizard now meet the WCAG AA contrast requirement, and article information lists are marked up so a screen reader can read them.
The download button appears again
On a site with Simple Mode switched off that had never chosen a download button style, the download control on a media file rendered as an empty link: nothing to click, and nothing a screen reader could announce. The style is not one the installer sets, so this was the state of any site that had not picked one deliberately. It now falls back to a labelled download icon.
The admin no longer discards your work
- Saving Administrative Settings removed every System Health finding you had dismissed, so they all came back. Settings that have no field on the form are now kept.
- A save that fails validation repopulated the form from the stored record rather than from what you had typed, silently reverting your edits. Eleven screens were affected, including messages, teachers, series, locations, podcasts, comments and templates.
System Health
- The summary chips are now filters. Click Needs attention to see only what needs looking at; click again, or Show all, to go back. The panel still opens showing everything.
- A new check reports Schema.org records stored where the edit form cannot see them, which can happen on sites upgraded from older versions.
- A new check reports which user groups can write template code, as above.
Also in this release
Better test coverage behind the scenes: the browser tests now run on every change against both Joomla 5 and Joomla 6, the nightly checks can report their own failures, and dependency updates across the board.
Changes
What's Changed
- chore(deps-dev): bump the composer-minor-and-patch group with 2 updates by @dependabot[bot] in https://github.com/Joomla-Bible-Study/Proclaim/pull/2023
- chore(deps): cwm/build-tools 1.32.1 by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2039
- chore(deps-dev): bump the npm-minor-and-patch group with 5 updates by @dependabot[bot] in https://github.com/Joomla-Bible-Study/Proclaim/pull/2024
- ci: bump github/codeql-action from 4.37.8 to 4.37.9 in the actions-minor-and-patch group by @dependabot[bot] in https://github.com/Joomla-Bible-Study/Proclaim/pull/2027
- chore(deps): allow @parcel/watcher's install script by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2040
- fix(media): serve a file from protected storage instead of linking to it by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2042
- fix(wiki): derive the requirement columns instead of carrying them through by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2048
- fix(media): stop repeating the site's base path when a URL is mapped to disk by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2049
- fix(health): look inside the protected folder, not just at its top level by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2051
- fix(analytics): count a play or download only when the visitor may have it by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2052
- build: verify a site on the previous release is actually offered this one by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2053
- test(health): run every passive check, instead of only reading them by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2054
- feat(health): report unfinished setup steps, which dismissing the banner hid by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2055
- chore(deps): refresh dev dependencies flagged by the weekly vendor check by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2056
- chore(deps): pick up build-tools v1.33.0 before the next release runs by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2057
- fix(admin): remove the half-copied workflow branch, and the batch button it was hiding by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2058
- feat(media): move a file into protected storage from inside Proclaim by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2059
- fix(podcast): leave protected files out of the feed, and say so in System Health by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2060
- feat(admin): make the restricted-media list explain why each file is on it by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2062
- refactor(query): build OR groups with the builder instead of typing brackets by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2063
- refactor(query): phase 1 of the bind conversion — the four heaviest files by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2064
- fix(admin): give the menu preset's quicktasks their missing strings by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2065
- chore(language): sync the six locales with this cycle's new strings by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2066
- feat(admin): swap server-type fields in place instead of reloading (#2037) by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2067
- refactor(query): whitelist ORDER BY columns instead of a no-op escape (#1994 phase 3) by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2069
- refactor(query): bind the schema.org helper's context/schema values (#1994 phase 1) by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2070
- refactor(query): bind the asset-lib's convertible values (#1994 phase 1) by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2071
- refactor(query): bind the setup wizard's params/type/menu values (#1994 phase 1) by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2072
- fix(stats): date-range filter used a non-existent column, + bind Cwmstats values (#1994 phase 1) by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2073
- refactor(query): bind the platform-stats sync's values (#1994 phase 1) by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2074
- refactor(query): bind the location wizard's params/rules values (#1994 phase 1) by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2081
- refactor(query): bind the guided-tour helper's uid/title_key lookups (#1994 phase 1) by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2082
- refactor(query): bind the YouTube addon's params/tag values (#1994 phase 1) by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2083
- refactor(query): finish the Phase-1 builder value binds — the convertible tail (#1994) by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2084
- fix(admin,site): two runtime fatals from symbols that never resolve (#2075, #2076) by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2085
- fix(podcast): verify TLS on the enclosure probe (#2078) by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2086
- fix(admin): keep UTF-8 intact when trimming dangling separators (#2077) by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2087
- chore: clear the safe half of the Qodana housekeeping list (#2079) by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2088
- docs(claude-md): state the Joomla 5.4 floor instead of 'Joomla 4+' by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2080
- fix(site): drop the series dropdown that reads data the view never builds (#2079) by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2090
- chore: pin the scripture submodules to lib 1.1.21 by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2091
- chore: pin scripturelinks to the released 1.2.14 by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2092
- refactor(admin): send CwmadminController's JSON through the shared trait (#2089) by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2093
- ci: run the PR checks on pull requests into main by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2095
- chore(deps-dev): bump friendsofphp/php-cs-fixer from 3.95.24 to 3.95.25 in the composer-minor-and-patch group by @dependabot[bot] in https://github.com/Joomla-Bible-Study/Proclaim/pull/2102
- ci: bump github/codeql-action from 4.37.9 to 4.38.0 in the actions-minor-and-patch group by @dependabot[bot] in https://github.com/Joomla-Bible-Study/Proclaim/pull/2104
- chore(deps): bump the npm-minor-and-patch group across 1 directory with 6 updates by @dependabot[bot] in https://github.com/Joomla-Bible-Study/Proclaim/pull/2105
- Write template code layouts through one validated path by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2108
- Stop a template code record overwriting a layout the package ships by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2111
- Stop a template title choosing an export path or a download header by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2113
- Stop sending the AI provider API key as a query parameter by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2115
- Stop sending Test API credentials as query parameters by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2120
- Run the E2E browser specs in CI, once per Joomla major by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2123
- Make the nightly monitors able to report by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2124
- Meet WCAG AA contrast on the control panel and location wizard by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2125
- Give the article-info definition lists their missing term by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2126
- Stop wrapping the item when loading template form data by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2128
- ci: bump github/codeql-action from 4.38.0 to 4.38.1 in the actions-minor-and-patch group by @dependabot[bot] in https://github.com/Joomla-Bible-Study/Proclaim/pull/2132
- chore(deps-dev): bump the npm-minor-and-patch group with 4 updates by @dependabot[bot] in https://github.com/Joomla-Bible-Study/Proclaim/pull/2131
- Probe the swapped-in server region with Simple Mode off (#2121) by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2133
- Keep the params the settings form does not define (#2134) by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2136
- Read saved form data under the key the controller writes (#2127) by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2137
- Report Schema.org records the edit form cannot see (#2138) by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2140
- Take the teacher form's fallback from getItem(), not the property it fills (#2139) by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2141
- Keep the evidence when an E2E test is flaky, and wait for the dialog's document (#2122) by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2142
- Say what granting template-code edit actually grants (#2099) by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2143
- Let the System Health summary chips filter the report by @bcordis in https://github.com/Joomla-Bible-Study/Proclaim/pull/2144
Full Changelog: https://github.com/Joomla-Bible-Study/Proclaim/compare/v10.7.0...v10.7.1
pkg_proclaim-10.7.1
| Downloaded | 0 times |
| File size | 4.80 Mb |
| MD5 Signature | f2214d7b8f0635aff54acb28691a4180 |
| SHA1 Signature | b39681e7484106d044f68f685f16eafae24cba7b |
| SHA-256 Signature | 9ffa7dff60c5a747832b6364547c38b11bb760e346ac56cc06529e9e388814fb |
| SHA-384 Signature | c8ea34445d4bd8a02ef9ed8c144c580478bb4df35a8b3102e604af28bfb36f91e380d83c012eb51e38faf74122af67e2 |
| SHA-512 Signature | 5fffaa0e61617deb147b9f5fd04316010e8ce284f624a7e4f46f42f48d0af3a668b505b5c6ea57167e0cfc8db49555cb4c36e7bfdbbb96cdd1f19e6d70a18bf6 |
| Compatibility |
pkg_proclaim download
