feat(core): HTMLy 2026 Modernization Release v3.2.0 - Security, REST API v1, MCP Server, Webhooks, Admin UI & Fixes - #1062
Open
lightnet19 wants to merge 28 commits into
Conversation
When a draft and a published post share the same filename, deleting the stale draft entry from the admin draft list could accidentally remove the already-published file instead of the actual draft. Root cause: delete_post() validated only that the target file was inside the /content/ directory, but did not verify it actually resided in a /draft/ sub-folder when called from a draft-deletion context. Changes: - admin.php: add optional \ parameter to delete_post(). When true, the function resolves the real file path and aborts if the resolved path does not contain '/draft/', preventing any non-draft file from being removed through the draft UI. - admin.php: add .md extension guard so only Markdown content files can ever be passed to unlink(). - htmly.php: both delete-post route handlers now detect whether the submitted file path contains '/draft/' and forward the resulting boolean as \ to delete_post().
…I agent guidelines
…ries, Tags, Media Upload, System Health)
…r package for AI Agents
…m, and Ctrl+K Command Palette
… RSS item GUID standard (danpros#1059)
…ns.txt and update robots.txt
…8n, MCP server, and docs portal
…h header handling, and modern security headers
…re/.updateignore for API & Node assets
…imagesize, and harden upload.php
…and clean FUNDING.yml
…ini.example & webhooks.ini.example templates
…all denied) and 2.2 compatibility
…m/resources documentation
…rden session cookie security (httponly, secure, samesite)
…d update themes documentation
…ay keys in htmly.php
…tion, HTTPS timeout requests, and secure session cookies
lightnet19
changed the title
… security hardening notes
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of Improvements
delete_post()to properly enforce that file deletions are strictly scoped to the/draft/directory when deleting draft posts. Real path validation and extension constraints prevent accidental deletion of live posts sharing identical filenames with legacy drafts..htaccess, disabled directory listing, forced session expiration, and hardenedinstall.phpandupload.phpentry points.