Release notes for Elxis 5.6 Oxylus.

Elxis 5.6 Oxylus released. You can download it from elxis.org.
In Elxis 5.6 (Oxylus) we have strengthen CMS security even more.
This is a quick change-log. Detailed presentation of Elxis 5.6 Oxylus will be available from elxis.org soon.

Security related

• Password policy configuration option (chars length, complexity, expiration)
• Enforce password expiration policy
• New exit page "pwchange" (for expired password change)
• Lock user account for 5 minutes after 3 unsucessfull login attempts
• Crypt helper: added sha256, sha384 and sha512 encryption arlgorithm
• Plugin Contact: Added security token
• Always set header X-Content-Type-Options: nosniff regardless the security level
• x-frame-options = SAMEORIGIN by default
• sha256 integrity hash html attribute in CSS and JS files
• nonce html attribute in CSS and JS files
• crossorigin="anonymous" in CSS ans JS files
• Added CSP nonce and {nonce} replacement for elxis config option
• Minifier: Calculate CSP sha-256 checksums
• Removal of inline events in all Elxis extensions and libraries
• New method preAuthCheck for the elxisAuth library

Other

• Page generators for content Categories, Articles, Tags and Archive
• Provide an ID to all module DIV wrappers (id="moduleX")
• Added Czech language
• Update JQuery from v3.6.0 to v3.7.1
• ElxisForm library: Option to add html attributes in Yes/No checkboxes
• Database tables: DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci

Fixes

• HTML helper: Fix unclosed tag
• Messages helper: Fix GROUP BY issue when sql_mode=only_full_group_by
• Administration login: Fix user trying to login from wrong URL
• Component user: Add missing label for Country
• Template Five: Fix possible XSS attack
• Fix Google maps plugin

I will explain to you what may happened.

There is no delete button for translations. A translation gets deleted when the value is empty. When saving an article, or whatever, the translations system checks the strings that have been submitted for all languages. If the value for a language is empty, or not provided, it is marked for deletion.

en: Hello
el: Γειά
de: Hallo
it: Ciao

If you set de = "" (empty) then the corresponding translation will be deleted from the database.

Example
You have an article title in 4 languages, de, en, it, es
You unpublish Italian language (it)
You go and edit the article. As Italian is unpublished only values for de, en and es get proceeded (there is no "it"). Therefor the saved in database value for it is empty and so gets deleted.
When you re-enable Italian language and go to edit the same article you will see that there is no value for the "it".

If you lost many translations due to the above reason it means that you have the language set to OFF for a long time and in the meanwhile you edit many items.
This is absolutely normal behavior and this is how the translations system works. The deletion of empty/unused strings is in order to remove items from the database not needed any more.

Switching ON and OFF language does not affect translations saved in database. What can mess up things is changing the default language. This creates an inconsistency in translations table.

If you want to write javascript inside html body use the nonce attribute. The value of nonce can be retrieved from elxisDocument::getNonce() method (requires Elxis 5.6 or newer).

Example

<script nonce="<?php echo $eDoc->getNonce(); ?>">
    javascript code here
</script>

To check if you have Elxis 5.6:

if ($elxis->getVersion() >= 5.6) {
    ...
}

The nonce attribute tells the browser that this piece of inline code has not been injected to the content by third parties and it is safe to execute. The value of nonce is cryptographic secure and it changes on every click. Elxis put the nonce value on document headers when using a CSP policy.