NeoFrag Reborn 1.2.23

The Discord bot moves to version 0.2.1: nothing changes in how it works — it becomes a project in its own right, with its license, its NOTICE and its own changelog. Installing it is only useful to those who want these files; 0.2.0 keeps working.

Changed

• The sitemap no longer lists an empty section: news, recruitment, an FAQ, teams… with nothing to show are no longer offered to search engines, which would only find a "nothing yet" page there. The section comes back by itself with its first content. Contact, the guestbook, the newsletter, the web radio and donations remain listed: they always have something to offer.
• Backups no longer pile up: each update takes a full one (16 MB and more), and nothing removed them. The site always keeps the five most recent ones, and removes the others after thirty days; a file placed by hand in backups/ is never touched.
• The installation checks everything the CMS needs. The wizard checked neither openssl (without it, saving a secret — email server, captcha, two-factor authentication — fails with an error), nor fileinfo (without it, every file upload is refused), nor iconv (the QR code for two-factor authentication), nor Argon2 password hashing, without which creating the administrator account failed. It now checks them and refuses to continue if one is missing; install/cli.php requires exactly the same list, PHP version included, instead of two extensions. Monitoring and the administration dashboard show the same list. PHP 8.2 or later is required; the product is tested up to PHP 8.5.
• nginx and Caddy: the package finally ships the configuration examples the guides promised (nginx.conf, Caddyfile), generic, and which deny the same sensitive folders and files as Apache's .htaccess — the old nginx example left install/, tools/, tests/ and docs/ reachable, and the excerpt in the deployment guide only protected three folders out of eight.
• Each addon says who wrote it. The addons from the original NeoFrag keep their authors, Michaël BILCOT and Jérémy VALENTIN — the login connectors and the languages, which signed nothing, now name them, and the original English translations credit their translators again, FoxLey and eResnova. Ports credit their author: the Clock (ArkaNiX), the Extend theme (Chewbaka), the file manager (HiddenBlob, HiddenCMS) and Donations (HiddenBlob, after majiid). The rest is signed "NeoFrag Reborn". The Nebula, Blockcraft, Forge and Granite themes move to the LGPL, like the product; Extend keeps its author's license (CC BY-NC-SA). Each LGPL addon's license points to the official LGPL text.
• HSTS: the header set by the .htaccess no longer extends to subdomains and no longer declares the site eligible for the browsers' preload list (includeSubDomains and preload removed): set by default, they bound all the subdomains of whoever installed the CMS for a year.

Fixed

• A site installed from the package recorded no errors. The package did not contain the logs/ folder, and nothing created it: PHP wrote its errors to the server log, Monitoring → Error log stayed empty and called the folder "not writable". The package now ships logs/, cache/ and backups/ with their protection, and a site that has no logs/ recreates it by itself: updating is enough to repair a site that is already installed.
• The wiki documentation no longer has dead links. Three references from its pages to documents the site does not have (the tools manual, part of the deployment guide) led to an error page; they now keep only their text. The marketplace guide no longer mentions "third-party" addons that do not exist, nor procedures reserved for the project's server.
• Settings → Search engines refused to save as soon as a description, a tagline or a title for search engines contained many accented letters: each one counted as several characters, and a 139-character Portuguese description exceeded the 160 limit. A Google or Bing verification code pasted as a whole tag was refused in the same way. Redirects and per-content SEO follow the same rule.
• The SEO report recognizes a Google Search Console property verified through the domain's DNS (instead of calling it "not declared"), and advises submitting the sitemap that gathers all languages, /sitemap.xml, rather than the one for the displayed language only. When Google is verified, it no longer calls Bing "not declared": Bing Webmaster Tools can import a site from Google Search Console without placing anything on the site, so the report cannot see it.
• humans.txt, robots.txt and the IndexNow key: a missing address — an empty humans.txt, an unknown key — returns a plain "not found", without writing an error to the site log for every bot that requests it.