NeoFrag Reborn 1.2.27

The Discord bot moves to version 0.2.4: images travel between the forum and Discord in both directions (see its own changelog). Version 0.2.3 keeps working.

Added

• An image sent on Discord shows up in the forum (with Discord bot 0.2.4): the bot keeps it on the site, checked like an image pasted in the editor, instead of a mere link to Discord. The API gains the POST /api/v1/forum/images endpoint for this.
• Email validation of sign-ups (Settings → Registration management, "Email validation" box, off by default): the new member receives a link, valid for two days. They cannot log in before opening it; if they try, a new link is sent. This feature, inherited from NeoFrag, was left unfinished and had no setting in the administration.

Fixed

• Accented text no longer shows up encoded. A title, a username, a label or the site name containing "é" or "—" could appear as é or —: in conversations, the Shop, Donations, a post's table of contents, RSS feeds, the administration… These texts are now all displayed the same way, and two automatic checks keep the mistake from coming back (one reads the code, the other the site's pages). Mention and search suggestions, email subjects, the data read by search engines (site name, a post's title and author) and webhooks also receive plain text.
• An avatar's initial showed "&" for a name starting with an accented letter (administration, a donation campaign page).
• Signing up with Discord, GitHub or Google requires accepting the rules, when the site has some: a screen shows them, and the account is only created once the box is ticked — as with the sign-up form, which these accounts bypassed.
• The menu no longer leads to a missing module: the link of a module that is not installed or is turned off (Forum, Gallery, News…) stayed in the menu — one click, a page not found. It disappears, and comes back when the module is turned on again. A link to a published custom page stays; one to an unpublished page disappears too.
• On a site without the Events module, the Teams page no longer writes a warning to the error log.
• The ☰ button of the administration works on large screens: it was shown there without doing anything; it now folds the side menu, and opens it again, remembering the choice. On a phone, it opens the menu as before.
• The avatar of a forum post's author is larger: 80 px (36 px on a phone), instead of the 40 px every theme gave it.
• An image in a signature, or in a gallery album's description, is displayed: the page showed the HTML code (<p><img …></p>) instead of the image. Signatures and descriptions already saved are displayed without being entered again.
• The plain-text version of emails is readable: paragraphs were glued together, accents encoded, and a link ended up followed by the next word — unusable in a mail client that only shows text.
• A tampered form no longer crashes the page: a checkbox sent in a form no browser ever sends is ignored, like an unticked box.
• On a demo site, the administrator account created at installation stays hidden on hover and in the moderation history, as on its page: the member card shown on hover gave its name, groups and visit dates, and the moderation history its name.