@ryancramerdesign Hi Ryan, here is the webP support for PW core image engines. Please refer to this forums post for some explanation: https://processwire.com/talk/topic/14236-webp-support/page/2/?tab=comments#comment-184583

If you like, we can discuss it here or you can contact me via PM or email ([email protected]).

This change allows you to add fileCompilerExclusions to a module's info array. This is useful for those who have vendor and lib directories in their modules that may break after being compiled.

Refer: https://github.com/processwire/processwire-requests/issues/18

When getting an image file's information, the program does not care about XXE vulnerability, which could lead to sensitive information leakage or DoS attack. In Pageimage class(wire\core\Pageimage.php), function getImageInfoSVG parses file without any sanitation ,whose content may contain attack vectors.

	protected function getImageInfoSVG($filename = '') {
		$width = 0;
		$height = 0;
		if(!$filename) $filename = $this->filename;
		$xml = @file_get_contents($filename);
		
		if($xml) {
			$a = @simplexml_load_string($xml)->attributes();

Affected software : Processwire CMS

Version : v.1.3.6

Type of vulnerability : XSS (Cross-Site Scripting)

Author : Noth

Description:
Processwire CMS is susceptible to cross-site scripting attacks, allowing malicious users to inject code into web pages, and other users will be affected when viewing web pages

PoC :

Step 1 : login system

Step 2 : Go to "/processwire/page/edit/?id=1"

Step 3 : insert "XSS" test grammar in "Titile" and save it. XSS Payload : ">

Step 4 : Go back to the login system page

Test Video : https://drive.google.com/file/d/1j06Id6IHf5aUOTnU8w9wSujjGLuX3Wn9/view?usp=sharing

This PR fixes an old and annoying bug:

Before:

Its a little hard to see, but the following happens:

• opened inputfield: arrow blinks
• collapsed inputfield: toggles correctly
• ajax: opens correctly, blinks instead of closing

This is really bad UX because the Inputfield behaves in 3 different ways to the same action (click header)!

After:

With this fix in place all inputfields toggle correctly on the first click on the header. It just does the click on the icon automatically instead of flashing it!

It seems like setAndSave shortcut method does not play well with an array of fields unput.

This code does not work:

$page->setAndSave(array(
    'next_action' => 'JustTest',
    'next_action_time' => time() + 12 * 3600,
));

This one does:

$page->setAndSave(array(
    'next_action' => 'JustTest',
));

and this one too (of course):

$of = $page->of();
$page->of(false);
$page->next_action = 'JustTest';
$page->save('next_action');
$page->next_action_time = time() + 12 * 3600;
$page->save('next_action_time');
$page->of($of);

Or I messed something up)

Now supports showIf and requiredIf fields with names like skyscraper[0]name, skyscraper[1]name and so on in the same form.

This isn't useful in ProcessWire at present since fieldnames can't contain brackets, but is useful when I've been using PW as a framework/library and wanted to use inputfield dependencies in my frontend forms where I do have some array-based fieldnames.

Thought I'd submit it as it's a harmless change and might be useful in future or to someone else doing what I'm doing.

Hey Ryan, this is an old issue dating back to 2014: https://processwire.com/talk/topic/8329-how-to-closedelete-notifications/

I always get lots of - persistent - notifications after login:

I need to close every single one of them. This PR adds an additional X to close all at once:

Note that I've only updated the unminified JS

Hey @ryancramerdesign

I want to customize the backend of my app that I'm developing a little bit. Copying the whole module just for replacing the branding in the footer is so much overhead! That's why I created this PR that makes it possible to replace single files of the admintheme while keeping all the others. That means you can still upgrade the core without getting an outdated admin theme!

Not sure what you think about the render() method being hookable? If you think that is adding too much overhead I'm fine with a non-hookable version as it's easy to overwrite the whole file anyhow.

Thx in advance!

Changes Made: +++++++++++

1] Added visibility(public/private/protected) for the constant. http://php.net/manual/en/language.oop5.constants.php#language.oop5.basic.class.this

2] Changed double quote to single quote wherever necessary. http://php.net/manual/en/language.types.string.php https://www.codeproject.com/Articles/988255/PHP-Single-Quotes-versus-Double-Quotes

3] Optimized the code by using Null Coalesce Operator instead of ternary operator http://php.net/manual/en/language.operators.comparison.php#language.operators.comparison.coalesce

4] Added expected exception in CacheFile->save function since we are using $this->wire('files') which tends to throw WireException.

5] Condition changed from !in_array($page->process, array('ProcessLogin')) to $page->process != 'ProcessLogin'.

Hopefully this helps, will be adding more changes to it after this PR merged.

Please let me know if you have any queries.

It's really useful to be able to define the columns shown when clicking the "show" links for viewing results. This supports that like this:

I actually think it would be nice to add other options too, like how edit / view links should be handled etc, but wanted to see if you'd at least be willing to support the changed in this PR first.

Me again ✌️. I want my RSS feed items to have the full content, not just a summary. According to the spec, the <description> field is supposed to be used for this, but MarkupRSS does not allow it for two reasons:

1. It doesn’t convert relative to absolute links.
2. It double-encodes markup by enclosing entity-encoded content in CDATA. This makes (most?) feed readers show the markup instead of rendering it. Both entity escaping and CDATA should be rendered as per the spec, but the combination of both doesn’t work.

This PR removes entity encoding from the <description> element and adds the URL conversion that was previously only applied to <content>. It also extends this conversion to account for single quotes such as href='/path'.

Here is another link on supplying only the <description> element: https://validator.w3.org/feed/docs/warning/NeedDescriptionBeforeContent.html

Thank you!

Hi, the idea for this came from this forum thread by @BernhardBaumrock. It’s a small but imho quite useful addition.

I’ve tried to keep changes to a minimum. It’s virtually entirely a CSS thing because the download button is a simple element, but to make it work nicely I had to make the CSS independent of the label element and I renamed .gridImage__trash to .gridImage__btn to make it more generic. This somewhat opens the door for more such buttons – it actually clutters up the UI surprisingly little: (Obviously that’s just a dumb mockup. The actual PR only adds the second button, as pictured here.)

Buttons will be in reverse order in “list” view.

I’ve tested it successfully with both stock themes. Hope it’s not too messy. Thanks for your consideration!

Hey @ryancramerdesign this PR fixes all files that have non-unix line endings. That is not just a cosmetic fix, it's really annoying because my IDE always shows several files as "changed" while they are actually not. They do even not disappear when reverting those "changes". It looks like this:

This is one file before the change:

And this is the file after running dos2unix (https://stackoverflow.com/a/7068241/6370411)

Hey @ryancramerdesign I have a setup where I need to write the config of the site dynamically via PHP. Manipulating the original config.php file is really NOT easy... But it would be trivial to write the new config as JSON file. For that to work it would be nice to have this:

$config->readFromFile('/path/to/config.json');