Elxis 5.6 Oxylus released!

[datahell]

Elxis 5.6 Oxylus released. You can download it from elxis.org.
In Elxis 5.6 (Oxylus) we have strengthen CMS security even more.
This is a quick change-log. Detailed presentation of Elxis 5.6 Oxylus will be available from elxis.org soon.

Security related

• Password policy configuration option (chars length, complexity, expiration)
• Enforce password expiration policy
• New exit page "pwchange" (for expired password change)
• Lock user account for 5 minutes after 3 unsucessfull login attempts
• Crypt helper: added sha256, sha384 and sha512 encryption arlgorithm
• Plugin Contact: Added security token
• Always set header X-Content-Type-Options: nosniff regardless the security level
• x-frame-options = SAMEORIGIN by default
• sha256 integrity hash html attribute in CSS and JS files
• nonce html attribute in CSS and JS files
• crossorigin="anonymous" in CSS ans JS files
• Added CSP nonce and {nonce} replacement for elxis config option
• Minifier: Calculate CSP sha-256 checksums
• Removal of inline events in all Elxis extensions and libraries
• New method preAuthCheck for the elxisAuth library

Other

• Page generators for content Categories, Articles, Tags and Archive
• Provide an ID to all module DIV wrappers (id="moduleX")
• Added Czech language
• Update JQuery from v3.6.0 to v3.7.1
• ElxisForm library: Option to add html attributes in Yes/No checkboxes
• Database tables: DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci

Fixes

• HTML helper: Fix unclosed tag
• Messages helper: Fix GROUP BY issue when sql_mode=only_full_group_by
• Administration login: Fix user trying to login from wrong URL
• Component user: Add missing label for Country
• Template Five: Fix possible XSS attack
• Fix Google maps plugin

[datahell]

Revisions 2732 and 2733 released today after the initial revision 2731. They both contain small fixes. Please always use the latest Elxis version.

Current version: Elxis 5.6 Oxylus rev2733.

elxis.org and elxis.net proudly run Elxis 5.6 Oxylus