ProcessWire Weekly #650

Latest core updates

This week we have a brief weekly update from Ryan, explaining how he's currently tied up with other things, but we do still have some new commits in the dev branch. Here's what's new since last week:

• Two new opt-in CSRF features, contributed by Adrian Jones (PR #356): a signed token mode which keeps CSRF tokens valid across session expiry or browser back and forward navigation, and a same-origin fallback that accepts legitimate POSTs from browsers that withhold cookies.
• As a minor improvement, the page editor now logs stale CSRF tokens correctly as "stale", rather than "missing".
• Several access-related improvements: the template import feature is now limited to superusers only, image variations and WebP copies follow the view permissions of the original image, the front-end editor only returns values for fields that the user is allowed to save, and admin live search no longer matches or counts pages based on fields that the user can't view.
• Some minor fixes, including proper entity-encoding for bookmark labels in the "Add New" menu, and debug mode no longer printing a filesize() warning when an image resize fails.

Most of these updates also come with regression tests, utilizing ProcessWire's own built-in testing feature.

That's all for our core updates section this week. We'll be back next week with more updates, but in the meantime keep on reading for other news and updates!

New module: OutputTransformer

OutputTransformer is a new third-party module from atis.pro. In a nutshell this module hooks into the page rendering phase of ProcessWire and polishes the final HTML output through three transformations:

• Cleanup collapses whitespace, rebuilds tags more compactly, and removes comments — while keeping conditional comments and <!--noindex--> comments. It treats comments, tags, text, and raw-text elements separately, keeps attribute values unchanged, and leaves the contents of script, pre, textarea, and CDATA tags alone.
• Typografy adds typographic polish using mundschenk-at/php-typography for most languages, or atispro/emt-php8 for Russian. Both of these are separate dependencies, installable via Composer.
• Replace swaps arbitrary symbols or strings in the final output.

You can exclude markup from transformation by wrapping it in <no-cleanup>, <no-typografy>, or <no-replace> tags, or alternatively by configuring per-transformation PCRE patterns via module settings. The module is built to fail safe: if a regex error, an exception, or a placeholder problem occurs, the affected transformation is skipped for that page, and the error gets logged.

If you'd like to give OutputTransformer a try, you can install it via the built-in modules manager in the admin, or clone or download it from the OutputTransformer GitHub repository. If you require assistance or have questions or suggestions for the author, head down to the OutputTransformer support forum thread.

Big thanks to atis.pro for creating this module and sharing it with the ProcessWire community!

Site of the week: dothiscookingthing.de

Our latest site of the week is dothiscookingthing.de, a German food blog and recipe website with the goal of making home cooking simple, fun, and stress-free.

The site is run by Alexandra Thomas, who cooks and creates the content, and Markus Thomas, who is behind the technical side of things, camera work, and web design. Content is split into sections by type: recipes, ingredients, blog, and general-purpose info pages about the project. The blog is quite active and already features various interesting posts, and the recipes section alone is reason enough to visit this site!

The current iteration of the site was recently featured in the showcase section of the ProcessWire support forum by Markus, and here are some highlights:

• This site uses Custom Page Classes to keep business logic organized and separate from layout files, includes automatically generated schema.org JSON-LD metadata for recipes for an SEO boost, and makes use of the Repeater Matrix module for flexible content creation.
• The front-end of this site was built using the Tailwind utility-first front-end framework, bundles Alpine.js and the HTMX library for hassle-free interactive features (such as a dynamic serving calculator), and has mobile-friendly UI and PWA (Progressive Web App) offline support.
• The admin has been customized to make editorial work intuitive and fast, and the site also features an automated glossary that provides easy cross-linking by dynamically linking ingredients back to relevant recipes.

Our congratulations to both Alexandra and Markus for getting a splendid new version of dothiscookingthing.de up and running, and thanks for sharing it with us!

Stay tuned for our next issue

That's it for the 650th issue of ProcessWire Weekly. We'll be back with more news, updates, and content Saturday, 31st of October. As always, ProcessWire newsletter subscribers will get our updates a few days later.

Thanks for staying with us, once again. Hope you've had a great and productive week, and don't forget to check out the ProcessWire forums for more interesting topics. Until next week, happy hacking with ProcessWire!