ProcessWire Weekly #651

Latest core updates: ProcessWire 3.0.275 (dev) and ProcessWire 3.0.260 (master)

As Ryan explains in his latest weekly update, this week there are two new versions: 3.0.275 for the dev branch, and 3.0.260 for the stable master branch. Here's a quick sneak peek into what's new in these two versions.

ProcessWire 3.0.260 master

In short, 3.0.260 master version is all about security hardening: tighter access checks, improved CSRF protection, and fixes for potential XSS issues across the admin:

• Tighter permission checks on page cloning, image selection and variations, Lister and live-search filtering, bookmark editing, selector counts, and template import.
• Image resizing, cropping, and saving now all require a CSRF token, and the image features in CKEditor and TinyMCE send one.
• Admin navigation labels and page-add titles are now strictly escaped.
• TinyMCE always saves the sanitized value, and front-end editing rejects invalid or unauthorized fields.
• One leftover session debug message was removed.

There are no new user-facing features in this release, but since it’s a security update, updating your site(s) is highly recommended. As Ryan explains in his post, we will be backporting potentially security related updates from the dev branch to the master branch from time to time — this way you can always get important security updates, regardless of which version you prefer.

ProcessWire 3.0.275 dev

ProcessWire 3.0.275 is our latest development version, and — relative to 3.0.274 — it has more than 90 new commits. Some of them have already been covered in our previous issues, but here's what's new since last week:

• PageTable gets a “Join fields” setting that loads item fields together with the items, and Page field inputs now show unpublished pages struck through and hidden pages faded, as in the page tree.
• The retry policy for transient database errors is configurable, page finds retry after a lost connection, and results are ordered consistently when sort values tie.
• Invalid submitted dates for a datetime field now show an error and keep the previous value instead of being silently cleared, with stricter validation overall.
• Follow-up security refinements to the selector count and Lister access checks from 3.0.260, plus a fix for roles losing their page-view permission after reload.
• Fixes for front-end editing, images, TinyMCE, repeaters, languages, page names, advanced search, LazyCron, ZIP uploads and several admin UI issues.
• The remaining PHP 8.4 and 8.5 deprecations have been fixed.

That's all for our core updates section this week. For more details, be sure to check out the latest weekly update from Ryan as well. Thanks!

New admin theme: AdminThemeBridge

AdminThemeBridge is a new admin theme for ProcessWire, created by Alexei Tarasov. It’s still in beta, but it looks very promising. Its goal is a faster, more modern admin, built with native web components and a small TypeScript runtime instead of jQuery.

For a while I've been building something bigger than my usual in-house modules, and it's ready for other eyes now. Bridge (a working name) is an admin theme for ProcessWire that renders the admin with native web components and a small TypeScript runtime, without jQuery — while every existing Inputfield and Process module keeps working unchanged.

— Alexei Tarasov

Here’s what AdminThemeBridge offers over other themes:

• Faster and lighter in the author’s Lighthouse tests, with no jQuery on most screens.
• Designed to keep existing modules working via an on-demand legacy fallback.
• Smoother editing: saving without a reload, light and dark schemes, and an adjustable scale.
• Multi-select, bulk actions and drag-and-drop for pages and files.
• Better keyboard and screen-reader support.

AdminThemeBridge is still in beta, but it has been tested quite a bit, by human users as well as with automated tests. It has some known limitations, but the author considers it close to leaving beta. Its built-in fallback to the legacy stack is designed to keep existing modules working, and most third-party modules did in the author’s tests.

For more details and full details about the Lighthouse tests and so on, be sure to also check out the forum post introducing AdminThemeBridge. If you'd like to give it a try, you can clone or download it from the AdminThemeBridge GitHub repository.

Big thanks to Alexei for creating this admin theme and sharing it with the ProcessWire community — we're going to keep tabs on how it evolves from here!

Site of the week: Wessex Community Action

Our latest site of the week belongs to Wessex Community Action, an independent charity that serves as the Council for Voluntary Services for Wiltshire, England, dedicated to supporting and strengthening the local community sector.

The organization provides vital guidance, training, and funding advice to help charities, social enterprises, and voluntary groups set up and manage their operations effectively. Additionally, they advocate for the needs of the voluntary sector, organize skill-building workshops, and connect residents with local volunteering opportunities through platforms like Wiltshire Together.

The Wessex Community Action website was created by Suspire Media. This site has a nice, clean design, with well-thought-out content hierarchy, and plenty of content for those interested in the charity, their mission and impact, volunteering, networking, or the latest news and events related to their work.

As for some behind the scenes details, the front-end of this site is based on the Uikit front-end framework, bundled with some additional front-end features, such as the jQuery library and Simple Social Share. As for ProcessWire modules, there's only one that we could spot here, and that is the indexing and searching utility SearchEngine.

Our congratulations to Wessex Community Action for their ProcessWire powered website, as well as the team at Suspire Media for a job well done!

Stay tuned for our next issue

That's it for the 651st issue of ProcessWire Weekly. We'll be back with more news, updates, and content Saturday, 7th of November. As always, ProcessWire newsletter subscribers will get our updates a few days later.

Thanks for staying with us, once again. Hope you've had a great and productive week, and don't forget to check out the ProcessWire forums for more interesting topics. Until next week, happy hacking with ProcessWire!