Before any questions arise: Version number 1.6.6 was skipped for technical reasons. Version 1.6.7 wasn't actually planned, as we are currently working on version 1.7.0 with significant changes and improvements. However, since its release is still some time away, and version 1.6.5 is vulnerable under certain circumstances, an interim update was necessary.

Installation and Update

Installation can be performed using the ZIP files linked in the installation instructions on wbce.org (german) and by running the unzip script (upload the latter along with the ZIP file and rename it back to *.php).

The WBCE Updater admin tool is recommended for updating.

The installation/update package can also be downloaded from GitHub as usual.

What's new?

Security update for frontend login
The XSS vulnerability that necessitated this unscheduled patch is, of course, fixed in this version.

elFinder updated
elFinder has been updated to version 2.1.67.

CAPTCHA for login screen only when needed
The CAPTCHA check introduced in version 1.6.5 for the CMS login screen now only appears if there have been an unusually high number of failed login attempts—regardless of the IP address used.

This additional protection can be disabled, for example, if the instance is already protected by other means, the Fraggy backend theme is being used, or if it would be unreasonable to expect users to solve a CAPTCHA. In this case, a new entry must be added to the config.php file:

define('NO_LOGIN_CAPTCHA',true);

Furthermore, CAPTCHA protection is not active if the session cookie is disabled by adding the corresponding entry to the config.php file.

WBCE Flat Backend Theme Responsive
The standard WBCE Flat backend theme is now also usable on tablets and smartphones.

WBCE Updater Admin Tool
Future updates can be conveniently performed using the new WBCE Updater admin tool.

Various Minor Fixes
Fixed an issue with email validation in PHP versions 8.4 and above, added a config.php option for email address as login, and set the bot honeypot as the default in all miniform default templates.

Updated jQuery Libraries
jQuery Migrate - v3.6.0, jQuery UI - v1.14.2.

PHPMailer Update
Updated to version 7.0.2.

System Requirements

PHP 8.2.x - PHP 8.4.x. PHP 7.4.x is no longer supported, and PHP 8.5.x is not yet supported.

Even though this is rather inconvenient, we recommend updating. If you haven't updated in a while and are still using version 1.5.x or older, please read the release notes for version 1.6.0 beforehand.

Many thanks to everyone who contributed ideas and ideas to this version. And also many thanks to all donators who support WBCE and its team.

Installation or Update

Installation or update can be done using the ZIP files linked on wbce.org in the installation guide or the update guide, by uploading the ZIP file together with the corresponding unzip script (rename the latter back to *.php after upload).

What’s new?

CAPTCHA for login screen
The CMS login is now protected with a CAPTCHA (using the one configured under Admin-Tools > CAPTCHA and Advanced Spam Protection). This strengthens protection against brute-force attacks.

• If the Loginbox Droplet is used, it must be updated manually. The updated version can be downloaded in the AOR.   

• The Fraggy Backend Theme also needs updating. If it doesn’t update automatically, the new download is available on GitHub.

It’s possible to disable this extra protection, for example if your instance is already secured by other means or if entering a CAPTCHA would be unreasonable for users. In this case, add the following new entry in config.php:   

define('NO_LOGIN_CAPTCHA', true);  

The CAPTCHA protection is also inactive if the session cookie usage has been disabled in config.php. See the documentation notes for details.

Changes in user-to-group assignment

Under certain conditions—and with sufficient malicious intent—it was previously possible for existing users to add themselves unlawfully to the system group “Administrators” and/or send manipulated requests to the server. This should now (hopefully) no longer be possible. 

To implement this protection mechanism, it was necessary to restrict permissions:
If users have permission to create/edit user accounts but are not members of the “Administrators” group, they can now only assign other users (and thus implicitly themselves) to groups they already belong to. 

For example, if “Alfred” is a member of the “Red” group but not “Blue”, he can only assign “Berta” to “Red”; “Blue” won’t be displayed as an option.

Minimum password length

The minimum password length has been increased to 12 characters.

Updates to included modules and libraries

• News with Images updated to version 5.0.29 – this fixes a potential security issue when using tags.

• wbstats updated to version 0.2.5.8 – fixes an error occurring when certain characters appeared in host names.

• jQuery updated to version 3.7.1.

• PHPMailer updated to version 7.0.1.

System requirements

Supported versions: PHP 8.1.x – PHP 8.4.x
PHP 7.4.x is no longer supported, and PHP 8.5.x is not yet supported.

Although updates can be bothersome, upgrading is strongly recommended.
Anyone still running version 1.5.x or older should first read the release notes for 1.6.0.

Many thanks to everyone who contributed ideas and work to this version.

Installation or update

The installation/update can be done using the zip files linked on wbce.org in the installation or update instructions (german, but Google Translate is your friend :-P)  and calling the corresponding unzip script (upload the latter together with the zip and rename it back to *.php).

What's new?

• Most important: Supported PHP versions start with PHP 8.1, lower PHP versions are no longer supported and WBCE CMS 1.6.4. won't run with them. But! WBCE CMS now works with PHP 8.4.

• This release is a maintenance and security release in which some bugs have been fixed, the included third-party scripts and libraries have been updated (PHPMailer, Twig) and minor security holes have been eliminated here and there.

It is recommended to perform an update. If you haven't done so for a while and are still using 1.5.x or older, you should read the release notes for 1.6.0 first.

Many thanks to everyone who contributed ideas and contributions to this version.

Installation or update

The installation/update can be done using the zip files linked on wbce.org in the installation or update instructions (german, but Google Translate is your friend :-P)  and calling the corresponding unzip script (upload the latter together with the zip and rename it back to *.php).

What's new?

• This release is a maintenance release in which some bugs have been fixed, the included third-party scripts and libraries have been updated (PHPMailer, Twig) and minor security holes have been eliminated here and there.

• The way languages are installed has changed for reasons™. If necessary (which is rarely the case), the language file must be uploaded via FTP and then made known to the system using the "Reload" button.

• NWI and the Addon Monitor have undergone detailed improvements. Inconsistencies when updating templates and modules have also been eliminated (thanks to gchriz).

• The SimplePageHead module has been adapted; it now first outputs the page title and then the website title. In order not to torpedo SEO efforts, it is not included in the update package below, but can/must be updated manually - download in the AOR.

The version is released for PHP 7.4.14 - PHP 8.3.x. PHP versions above or below this are no longer/not yet supported. It is recommended to use at least PHP 8.0.

It is recommended to perform an update. If you haven't done so for a while and are still using 1.5.x or older, you should read the release notes for 1.6.0 first.

Many thanks to everyone who contributed ideas and contributions to this version.

What's new?

• This release is "only" a maintenance release in which some bugs have been fixed and included third-party scripts and libraries have been updated.

• The version is released for PHP 7.4.14 - PHP 8.2.x. PHP versions above or below are no longer/not yet supported. It is recommended to use at least PHP 8.0 - this is the last version that still runs PHP 7.4.x.

• If you already have WBCE CMS 1.6.1 running, you don't necessarily need to update now, but everyone else should probably bring themselves to update now. See also the release notes for 1.6.0.

Many thanks to everyone who contributed to this version with ideas and contributions.

P.S.: Donations are welcome and will definitely contribute to the continued existence of the project and the motivation of everyone involved. At this point, a very, very big thank you to everyone who paid into the donation pot.

installation or update

The installation/update can be carried out as usual, i.e. either "classically" by individually uploading the files from the "wbce" directory in the package or using the zip files linked on wbce.org in the installation or update instructions (german, but Google Translate is your friend :-P) and calling the corresponding unzip script ( upload the latter together with the zip and rename it back to *.php).

What's new?

• Unfortunately, there is a security issue with the customized variant of Miniform included in the WBCE core. This release (logically) includes a patched version. An update, at least of the Miniform module, is therefore absolutely necessary and must be carried out as soon as possible.

• The CKEditor has been updated, also for security reasons (yes, the world is bad). Another reason to update.

• Although the last release was admittedly not that long ago, there was a need for various smaller bug fixes, e.g. in the "News with Images" module.

Many thanks to "young pope" for reporting the issues, Ruud (dev4me.com) for providing a fix at record speed, and colinax for updating CKEditor.

P.S.: Donations are welcome and definitely contribute to the continuation of the project and the motivation of everyone involved.

installation or update

The installation/update can be carried out as usual, i.e. either "classically" by individually uploading the files from the "wbce" directory in the package or using the zip files linked on wbce.org in the installation or update instructions (german, but Google Translate is your friend :-P) and calling the corresponding unzip script ( upload the latter together with the zip and rename it back to *.php).

As usual, it can be updated directly from all previous versions to 1.6.1 without intermediate steps.

When updating from versions prior to 1.5.0, please also note the information in the release notes for version 1.5.0 (but this does not mean that you have to update to 1.5.0 first and then to 1.6.1).

WBCE gets better with each iteration.

I want to personally thank Bianka (WebBird) for her help with the Database class changes.
Christoph (collinax) for the many implementations of libraries.
Bernd for all the changes he made with modules and so much more.
And Florian who is really managing this project very well.  Although we are but a few contributors he manages to keep this project alive and kicking.

For all who work professionally with WBCE, please consider a donation. It really makes a difference.

Christian