NeoFrag Reborn 1.2.26

The Discord bot moves to version 0.2.3: it no longer writes a discord.js warning on every private reply (see its own changelog). Version 0.2.2 keeps working.

Added

• The rules and the welcome message are translated language by language: Settings → Registration management has one tab per site language, and every visitor reads the rules — and receives the message — in the language of the page. A language that does not have its own text yet shows the shared text: a site that had only one keeps it for all its languages, nothing changes until it is translated.
• The changelog exists in English (CHANGELOG.en.md; the French version remains the reference).
• Every addon now has its thumbnail, in the same format (960 × 600): the API and Discord modules had none, the four catalog themes kept an older, smaller picture, and three core widgets had none in Themes & addons. A few still show an empty or unconfigured addon. A new addon can no longer be published without its own.

Changed

• The catalog descriptions say what each addon does: thirty of them fit in a few words or only presented themselves as "gaming". They now describe what the addon really does, and who it is for, in all six languages; five were even wrong (the Teams widget does not show members, the Downloads widget shows the most downloaded files…).
• The Events module is called "Events", no longer "Gaming events": no catalog title carries the word "gaming" anymore.
• The Payments module requires the Gamification module, which credits the purchased points and VIP days: without it, a payment was collected and nothing was credited. When installing the site, choosing Payments adds Gamification; from the marketplace, it must be installed first. If it is missing or disabled later, sales close and the administration says so; a payment received is not marked as processed, and Stripe will send it again.

Fixed

• An image pasted (Ctrl+V) or dropped into the text editor is saved — forum reply, comment, administration page, staff room of private messages: it showed up broken, then disappeared on publishing. It is now sent to the site and stays in the message. This is reserved for signed-in members: a JPEG, PNG, GIF or WebP image of 5 MB at most. The site saves a fresh copy, which strips the hidden information of a photo (where it was taken, for instance). Beyond 2,000 pixels on a side, the image is scaled down; beyond 8,192 pixels on a side or about 12.6 million pixels, it is refused. An animated GIF becomes a still image. On the demo site, image uploads stay closed.
• The welcome message displays cleanly: written in the rich editor, it reached the messages with its tags showing (<h3>, <p>…). It is now turned into text (headings, bulleted or numbered lists, links made clickable), and its title no longer shows é instead of an accented letter.
• The welcome message is also sent when someone signs up with Discord, GitHub or Google: only the sign-up form sent it.
• The two-factor authentication QR code is displayed: the activation screen (Account security → Enable 2FA) showed the image code in a text box instead of the image to scan — forms did not know this kind of field and treated it as text.
• The Partners widget logos lead to the partner's site and count the visit: they led to a missing page since 1.0.0, and the "Visits" counter no longer moved. The Partners page also goes through the counted visit.
• The "Pay" (Payments) and "Buy" (Shop) buttons work: they called a missing address.
• Subscribing to the newsletter from the widget works: the address typed in was lost on the way. The confirmation link in the email was relative (useless in an email client), like the unsubscribe link of campaigns: both are now full addresses. And if the email cannot be sent, the subscription is canceled and the visitor is told, instead of reading "sent".
• The links in forum and messaging emails (mention, subscription, conversation) are full addresses: relative, they led nowhere.
• Polls follow the "Show results" setting (after voting, when closed, never) — on their page as in their widget, which always showed them. Managers always see them, with a note.
• Widgets follow their module's rules: the Galleries widget no longer shows draft, scheduled, trashed or group-restricted albums; the Forum widget, no excerpt from VIP-only categories nor empty lines for deleted messages; the Events widget and calendar, no scheduled event before its time; the Recruitment widget follows "Hide unavailable offers".
• A link to a page of the site, inserted in the editor, keeps its full address: the editor shortened it into a path (../../…) that only worked from the editing page — shown anywhere else, it led nowhere.
• The roadmap (ROADMAP.md) says the code has been published since October 4, 2026.

Security

• Two old technical messaging addresses displayed messages without protecting them: a message containing code could have run in the browser there. No page used them anymore, and access to the conversation was already required; they now display messages like the conversation itself.
• The Facebook and Twitter buttons of the Partners page no longer follow a javascript: link entered in the administration: such addresses are filtered and escaped, as the partner's website already was.
• The Shop's "Buy" button and the "Pay" button now check that the request really comes from the site: a malicious page can no longer make a signed-in member buy an item without knowing it.
• A purchase can no longer be counted twice: the point debit, the stock and ownership are checked and written in a single transaction — two simultaneous purchases no longer sell the last item twice, nor debit a balance twice. Points earned and VIP days are also added in one go: two gains at the same moment no longer overwrite each other. An item worth 0 points can now be obtained without a debit (it was refused, "not enough points").
• Newsletter sign-ups are rate-limited: 5 requests per hour per IP address, 3 per day per email address — enough to stop confirmation emails being sent in bulk to chosen addresses.
• A poll whose results are hidden no longer shows its total vote count in the list.