Merge branch 'release/2.0.22'

Author: rhukster

CHANGELOG.md

@@ -1,3 +1,46 @@
+# v2.0.22
+## 08/31/2026
+
+1. [](#new)
+    * The `url()` Twig function now takes a language, so a link to a route that isn't a page - a search page, a form action - can carry the site's language prefix: `{{ url('/search', lang=true) }}`
+    * Blueprints can use a `media` field type, which saves a picked file as its path and keeps a list of them when the field allows more than one
+    * Page collections can now exclude one or more template types with `notOfType()`, the counterpart to the existing `ofType()` [#3910](https://github.com/getgrav/grav/issues/3910)
+    * The scheduler can now run the jobs that have missed their scheduled time, rather than only the ones due this very minute. Run it with `bin/grav scheduler --catch-up`, which is what you want on a site that has no cron entry set up
+1. [](#improved)
+    * Twig in page content can no longer read the site's configuration through the `print_r`, `vardump`, `json_encode`, `yaml_encode` and `string` filters. The check that was meant to stop it had been asking whether the whole site was in sandbox mode, which Grav never does — it decides per template — so it had been letting everything through. Thanks to @Vectrain51
+    * The `|map`, `|filter` and `|reduce` Twig filters now check for themselves whether the template calling them is sandboxed, rather than relying on Twig to work it out. Thanks to @DhiyaneshGeek
+    * The scheduler no longer rebuilds a queued job from an unsigned queue file, so a file written into the queue folder by something other than Grav can at most re-run a job the site was already set up to run. The page index also refuses to build objects while reading its cache. Thanks to @elite0529
+    * Plugin and theme descriptions are now rendered in Parsedown's safe mode before admin displays them, so a description carrying raw HTML shows as text rather than being rendered. Thanks to @alham-rizvi
+    * The debugger's Clockwork data endpoint now answers only requests coming from the server itself, or requests presenting the secret set in the new `debugger.token` option. Cookies and API tokens are no longer recorded in profiler data whatever the `censored` option is set to
+    * Building a URL is now faster, which adds up over the hundreds of asset and link URLs a single page render produces
+    * The scheduler now records whether a run was started by cron or by hand, and a run you started yourself no longer counts as evidence that cron is set up
+    * `bin/grav scheduler -r` now records the run against each job, the same as a scheduled run, so the next run knows what has already happened
+    * A field that is rejected only for being too long or too short now says so, and gives both the length submitted and the limit, instead of the same "Invalid input" any other bad value gets
+    * Multiline fields no longer carry a length limit low enough to affect real writing. Set `max: 0` on a field to remove the limit altogether
+1. [](#bugfix)
+    * The `|reduce` Twig filter now actually reduces. It was running the `|map` code by mistake and throwing away the starting value, so `[1,2,3]|reduce((c, v) => c + v, 0)` gave back a list instead of `6`. Thanks to @DhiyaneshGeek
+    * A form field's `minlength` and `maxlength` are now checked when the form is submitted, not only by the browser. They were being written into the page as HTML attributes but ignored on the server, so anything that skipped the browser's own check went straight through [#642](https://github.com/getgrav/grav-plugin-form/issues/642)
+    * A field with a `step` set now accepts the lengths and counts that land on a step, and rejects the ones that do not. The check was the wrong way round, so it rejected exactly the values it was meant to allow
+    * A long page can be saved from the admin again. Page content was capped at 65,536 characters, so anything longer than roughly twenty pages of text was refused, and the only way to edit it was to write the file directly [#3643](https://github.com/getgrav/grav/issues/3643)
+    * A site installed in a subfolder no longer mangles URLs whose path repeats the install folder's name, such as an image at `/images/subdir/photo.jpg` on a site installed at `/subdir`
+    * A link to a page that carries a query string or an anchor, such as `/blog?page=2`, now resolves to the page and keeps its language prefix, instead of being passed through as a plain path
+    * On a site installed in a subfolder, links written with the full path now resolve to the page, so they pick up the site's language and page extension
+    * A cache folder that the web server cannot write to no longer takes the whole site down. Grav now logs a warning naming the folder and serves the request without the cache, so the front end and the admin both stay reachable and the Problems plugin can report what is wrong [#4260](https://github.com/getgrav/grav/issues/4260)
+    * The same failure writing `user/config/versions.yaml` no longer stops the site either [#3688](https://github.com/getgrav/grav/issues/3688)
+    * Errors about a file that cannot be written now name the folder and say whether it is missing or not writable, instead of only reporting the file
+    * A session cookie name starting with `__Secure-` or `__Host-` now keeps that prefix and is sent with the settings browsers require for it, so the extra protection those prefixes give actually applies. Thanks to @wakqasahmed for the fix [#3773](https://github.com/getgrav/grav/issues/3773)
+      Note: sites whose `system.session.name` contains capitals, underscores or a leading or trailing dash will get a slightly different cookie name after this update, which signs their users out once.
+    * The scheduler no longer reports that cron is not set up when the crontab entry is written in a valid but slightly different style, such as one using `&&` or an absolute path to `bin/grav`
+    * On a site with a custom scheduler job of its own, looking up a job by name no longer misses every job the system and its plugins register, so the backup and cache jobs can be found and run individually
+    * A scheduler job that finished its work but could not then write its output file, send its notification email or run its callback no longer aborts the whole run. The remaining jobs run, every result is still recorded, and the problem is written to the log
+    * A scheduler job registered without a schedule of its own no longer causes an error when its next run time is worked out
+    * `bin/grav scheduler -j` no longer fails on a site with jobs registered by a plugin, and `-d` no longer fails on a job that has never run
+    * A scheduler job that runs one of Grav's own command line scripts now works when the scheduler is triggered from the web rather than from cron. Those jobs used to fail with "env: php: No such file or directory", because the web server does not have php on its path
+    * A scheduler job registered as a whole command line, such as `bin/plugin myplugin sync`, now runs. Only the executable and its arguments given separately used to work, so a job written the other way looked for a file whose name contained spaces and failed every time it ran
+    * A site served from a subpath by a proxy no longer loses that subpath when a trailing slash is redirected, which previously sent visitors outside the site. The homepage of such a site also no longer redirects to the bare domain. Thanks to @wakqasahmed for the fix [#3822](https://github.com/getgrav/grav/issues/3822)
+    * With `force_ssl` turned on, a page that does not exist now redirects to HTTPS like every other page, instead of serving the 404 over plain HTTP. Thanks to @wakqasahmed for the fix [#3703](https://github.com/getgrav/grav/issues/3703)
+    * Image settings are no longer applied to audio, video, SVG or document media. An embedded MP3 kept its player instead of being turned into a linked thumbnail, and media URLs no longer pick up stray `loading`, `decoding` and `fetchpriority` values, which happened on every site whether or not those settings had been changed. Thanks to @wakqasahmed for the fix [#4264](https://github.com/getgrav/grav/issues/4264)
+
 # v2.0.21
 ## 08/22/2026
 

SECURITY.md

@@ -26,6 +26,7 @@ Every published advisory is a signal to operators that they need to act today. W
 * **Anything an admin or super-admin can do within their granted capabilities.** Editing config, running CLI or scheduler tasks, installing plugins and themes, writing Twig into templates, using the file manager, reaching the filesystem through admin-only tooling.
 * **Publisher-authored content executing in the publisher's own scope.** Twig or markdown that a page editor writes and that runs as that page editor is the feature.
 * **`Security::detectXss()` bypasses.** `detectXss()` is a heuristic denylist used to flag suspicious content for humans. It is explicitly **not** a security boundary, it never was complete, and it cannot be. Grav's actual XSS defense is escaping at output. A new string that slips past the pattern list is not a vulnerability and we will not issue advisories for it. If you have found content that renders unescaped at output, that *is* in scope, so report that instead and show the rendered sink.
+* **`Utils::isDangerousFunction()` bypasses.** Like `detectXss()`, this is a denylist: a list of PHP function names the Twig callback filters refuse. It exists to make the common mistakes loud, not to enumerate every harmful function in PHP, and it cannot. The Twig content sandbox is the actual boundary, and inside sandboxed content the callback filters reject string callables outright, closure or nothing. A report that a function absent from the denylist can be called is not a vulnerability. A report that a **string callable of any kind** executes inside sandboxed content is, and we want that one, so show the sandboxed template and the rendered output.
 * **Account or email enumeration** through registration, password reset, or login messaging. This is documented, intentional behavior in the default configuration.
 * **Self-XSS**, or any issue requiring the victim to paste a payload into their own browser or admin form.
 * **Reports with no working proof of concept.** Static analyzer output, LLM-generated code readings, and "this pattern looks unsafe" reports without a demonstrated exploit path are closed. We do not have the capacity to build the PoC for you.

system/blueprints/config/system.yaml

@@ -1346,6 +1346,13 @@ form:
               validate:
                 type: bool
 
+            debugger.token:
+              type: text
+              size: medium
+              label: PLUGIN_ADMIN.DEBUGGER_TOKEN
+              help: PLUGIN_ADMIN.DEBUGGER_TOKEN_HELP
+              autocomplete: 'off'
+
             debugger.shutdown.close_connection:
               type: toggle
               label: PLUGIN_ADMIN.SHUTDOWN_CLOSE_CONNECTION

system/blueprints/pages/default.yaml

@@ -34,6 +34,9 @@ form:
                 type: markdown
                 validate:
                   type: textarea
+                  # Page body has no length ceiling: `0` opts out of the default
+                  # multiline guard, which used to reject long pages (#3643).
+                  max: 0
 
             header.media_order:
               type: pagemedia

system/config/system.yaml

@@ -179,6 +179,7 @@ debugger:
   enabled: false                                 # Enable Grav debugger and following settings
   provider: clockwork                            # Debugger provider: debugbar | clockwork
   censored: false                                # Censor potentially sensitive information (POST parameters, cookies, files, configuration and most array/object data in log messages)
+  token: ''                                      # Shared secret a remote client must send as `X-Clockwork-Auth` to read `/__clockwork/` profiler data. Empty means loopback-only
   shutdown:
     close_connection: true                       # Close the connection before calling onShutdown(). false for debugging
 
@@ -218,7 +219,7 @@ session:
   initialize: true                               # Initialize session from Grav (if false, plugin needs to start the session)
   read_and_close: false                          # Release the session lock right after the initial read (read-only start); the first write re-acquires it. Lets requests sharing a session id run concurrently instead of serializing on PHP's per-session lock. Opt-in: read-modify-write across a request is no longer atomic.
   timeout: 1800                                  # Timeout in seconds
-  name: grav-site                                # Name prefix of the session cookie. Use alphanumeric, dashes or underscores only. Do not use dots in the session name
+  name: grav-site                                # Name prefix of the session cookie. Use alphanumeric, dashes or underscores only. Do not use dots in the session name. A `__Secure-` prefix requires HTTPS; a `__Host-` prefix additionally forces no cookie domain and a site-wide path
   uniqueness: path                               # Should sessions be `path` based or `security.salt` based
   secure: false                                  # Set session secure. If true, indicates that communication for this cookie must be over an encrypted transmission. Enable this only on sites that run exclusively on HTTPS
   secure_https: true                             # Set session secure on HTTPS but not on HTTP. Has no effect if you have `session.secure: true`. Set to false if your site jumps between HTTP and HTTPS.

system/defines.php

@@ -9,7 +9,7 @@
 
 // Some standard defines
 define("GRAV", true);
-define("GRAV_VERSION", "2.0.21");
+define("GRAV_VERSION", "2.0.22");
 define("GRAV_SCHEMA", "1.8.0_2026-06-09_0");
 define("GRAV_TESTING", false);
 

system/languages/en.yaml

@@ -97,6 +97,8 @@ GRAV:
         VALIDATION_FAIL: '<b>Validation failed:</b>'
         INVALID_INPUT: 'Invalid input in'
         UNEXPECTED_VALUES: '(unexpected value(s): %s)'
+        LENGTH_TOO_LONG: '(%s characters, maximum is %s)'
+        LENGTH_TOO_SHORT: '(%s characters, minimum is %s)'
         MISSING_REQUIRED_FIELD: 'Missing required field:'
         XSS_ISSUES: "Potential XSS issues detected in '%s' field"
     MONTHS_OF_THE_YEAR: ['January', 'February', 'March', 'April', 'May', 'June', 'July', 'August', 'September', 'October', 'November', 'December']

system/src/Grav/Common/Config/CompiledBase.php

@@ -11,8 +11,10 @@
 
 use BadMethodCallException;
 use Exception;
+use Grav\Common\Grav;
 use RocketTheme\Toolbox\File\PhpFile;
 use RuntimeException;
+use Throwable;
 use function filter_var;
 use function function_exists;
 use function get_class;
@@ -228,7 +230,6 @@ protected function loadCompiledFile($filename)
      *
      * @param  string  $filename
      * @return void
-     * @throws RuntimeException
      * @internal
      */
     protected function saveCompiledFile($filename)
@@ -255,14 +256,73 @@ protected function saveCompiledFile($filename)
             'data' => $this->getState()
         ];
 
-        $file->save($cache);
-        $file->unlock();
+        // The compiled file is a cache and can always be rebuilt from the source
+        // YAML. If it cannot be written we serve the request from the freshly
+        // parsed files instead of taking the whole site down: this runs during
+        // config init, before the logger, the error handler and the Problems
+        // plugin exist, so an exception here 500s every route including /admin
+        // and leaves no in-browser way back. (#4260)
+        try {
+            $file->save($cache);
+            $file->unlock();
+
+            $this->preloadOpcodeCache($file);
+
+            $file->free();
 
-        $this->preloadOpcodeCache($file);
+            $this->modified();
+        } catch (Throwable $e) {
+            static::logCacheWriteFailure($filename, $e->getMessage());
+
+            $file->unlock();
+            $file->free();
+        }
+    }
 
-        $file->free();
+    /**
+     * Record that a compiled cache file could not be written and that the request
+     * is being served uncached.
+     *
+     * Degrading is the right behaviour, but doing it silently hides what is
+     * almost always a directory permission problem, so name the directory and say
+     * what is wrong with it. The logger is resolved defensively and the whole
+     * call is guarded, so reporting a degraded cache can never itself become the
+     * fatal we are recovering from.
+     *
+     * @param string $filename Cache file that could not be written.
+     * @param string $reason   Failure reported by the writer.
+     * @return void
+     */
+    public static function logCacheWriteFailure(string $filename, string $reason): void
+    {
+        $dir = dirname($filename);
+        if (!is_dir($dir)) {
+            $hint = sprintf('the directory %s does not exist', $dir);
+        } elseif (!is_writable($dir)) {
+            $hint = sprintf('the directory %s is not writable by the web server user', $dir);
+        } else {
+            $hint = sprintf('the directory %s is writable, so the file itself may be owned by another user', $dir);
+        }
+
+        $message = sprintf(
+            'Could not write compiled cache %s (%s) - %s. Serving this request uncached.',
+            $filename,
+            $reason,
+            $hint
+        );
+
+        try {
+            $log = Grav::instance()['log'] ?? null;
+            if ($log) {
+                $log->warning($message);
+
+                return;
+            }
+        } catch (Throwable) {
+            // Logging is best-effort: never let it mask the recovery it reports.
+        }
 
-        $this->modified();
+        error_log('Grav: ' . $message);
     }
 
     /**