v1.11.0 [09/10/2026]
- Added
page-builder sections from add-ons: an active add-on can offer its own sections in the Section Library by adding a
cms-sections.jsonto its folder, with the section's builder script, its template and an optional method that prepares its data, all inside the add-on (how to write one). A name two add-ons declare, or a built-in section's, is offered by neither, and the sections leave the library and the site when the add-on is deactivated. - Security
the web server's protective rules now ship in the root
.htaccess: folder listing off; the package's own files, dot-files, database dumps, logs, backups and configuration files refused;resources/,build/,tools/,tests/andstorage/refused, with an add-on's code folders and PHP undercore/andframework/except the scripts meant to be requested; and the security headers, with HSTS on HTTPS. The rules sit outside the WBAMS markers, so regenerating the managed rules keeps them. A site updated in place keeps its own.htaccessand must copy them in — see Upgrading to 1.11.0. - Security
wrong client sign-ins are limited on the sign-in page, the cart's sign-in and the client API: after 5 for one account name, or 20 from one address, in 15 minutes even the right password is refused with the usual message until the 15 minutes have passed. A new password through the reset email lifts it. Password reset emails are limited to 3 per address and 10 per visitor in 15 minutes; past that the page answers as usual and sends nothing.
- Security
the session cookie is
SameSite=Lax, PHP's strict session mode refuses session ids it never issued, and signing in replaces the session id and ends the old one. PayPal (standard) now sends the customer back with a plain link, so the session is there when they land on the invoice. - Security
a payment's transaction id is printed as text everywhere it shows, in the admin area and the client's invoice. An id holding markup used to run as script in the admin area.
- Security
private knowledgebase articles, and those in a hidden category or none, are left out of every listing for visitors who may not open them, including search results and
sitemap.xml. A hidden knowledgebase or download category answers 404 to visitors, and the updates archive lists a month only once an update in it is out. - Security
a request that sends a parameter as a list (
?language[]=x) is answered as if the parameter were absent, instead of with an error page. - Fixed
the old knowledgebase addresses work again:
/knowledgebase/{article}.html, an article under a category other than its main one,/knowledgebase/{id}/{name}and/files/category/{id}/{name}.htmlanswer with a permanent redirect to the readable address. Since 1.10.0 they had answered "page not found". - Updated
on a site with friendly URLs, a page asked for in the basic form (
index.php?rp=/updates/x.html) answers with a permanent redirect to its clean address, so each page has one address. GET and HEAD only. - Fixed
website pages can be found by search engines again: every page but the home page had said "noindex, nofollow" whatever its Search Visibility setting.
sitemap.xmllists each page once, leaves out pages set to Do not index this page, and lists the knowledgebase's articles and the published updates. See Search and sharing. - Fixed
long pages on phones, which mobile Safari reloaded and then gave up on. Sections no longer ask for so much graphics memory, a section's entrance starts as soon as its top is on screen, the classic sections' pictures load as they come near the screen, and Serepok's loading screen lifts once the page has loaded or 2.5 seconds after it is ready.
- Fixed
menus: the right item is marked on pages reached through
index.php?rp=, a link totel:,mailto:orsms:is used as it is, andjavascript:,data:andvbscript:links are refused. A section's link to a WBAMS page works in either URL style, and can be written as@module:knowledgebase. - Fixed
the Updates page lists each update once in the visitor's language, instead of listing every translation as a separate story; the Draisap knowledgebase home counts each article once.
- Fixed
products: a product group can be created and edited again; Duplicate a Product copies the type's own settings; Allow multiple quantities is no longer offered for software, membership and donation products, which are sold one per order line.
- Fixed
saving a single service on its admin page fires
OnPreMembershipEdit,OnMembershipUpdatedandOnControlMembershipUpdated, as the bulk edit already did; activating an add-on that takes over an earlier add-on's settings keeps what its activation did. - Fixed
admin pages open in their final layout instead of showing an older header first and then jumping; Apps & Integrations opens in seconds when the apps feed does not answer; the Project Management board works again; a webmail logo chosen before the media library moved shows again.
- Updated
a site that sells nothing draws no cart unless it holds something, and no sign-in buttons for visitors when sign-up is off; the 404 page's Contact Support button and the contact page's support card show only when a ticket department is visible. Phone numbers in the top bar, footer and contact page are dialable links.
- Fixed
contrast and display in both themes: secondary grey text reads at 4.5:1 or more, Draisap's dark-mode accent, info and error colours are lifted, Serepok's orange scheme is darker, buttons keep their text colour in dark mode, the browser's theme colour follows the site's primary colour, long FAQ questions wrap, and Spanish knowledgebase and update type labels are translated.
- Updated
no database changes; the upgrade replaces files and advances the version.