Cms Laravel Package

Getting Started

Upgrade with composer update and then run the new server checker before anything else:

php artisan tcms check          # human-readable, admin-utility order
php artisan tcms check --json   # for CI / deploy gates (exits 1 on fatal install issues)
php artisan tcms check --config # merged config with secrets redacted

tcms check covers bundle integrity, license, directory permissions and required/optional PHP extensions — gate deploys on its exit code rather than on a smoke-test page load. Pair it with tcms info (which now reports the real domain) and schema:lint, which after 3.6.2 also warns when a schema lists a password property in index.

Then work through the 3.6.2 upgrade notes in this order, because they are behavioural and silent if skipped:

1. Run migrations — a one-time migration strips public read from auth, playground, mailer, automations, Site Builder pages and data views.
2. Audit RSS — every collection except blog/feed now returns 404 from /feed/rss/{collection} until Publish RSS Feed is enabled in its settings.
3. Re-key anonymous front ends — anywhere your site read one of the collections above anonymously now needs an API key or an access group.
4. Check access groups — only newly created groups changed defaults; existing ones must be audited by hand.

First real use case: a blog collection using the new markdown or styledmarkdown field, rendered with |markdown, with the RSS Feed card filled in and a draft Hidden Field.

Implementation Patterns

Content authoring with Markdown fields. Two fields store the same string, so you can migrate a schema between them without a data transformation:

• markdown — CodeMirror source editor (plain textarea where CodeMirror isn't loaded), toolbar, preview, split fullscreen; uploads insert Markdown links.
• styledmarkdown — the Tiptap visual editor constrained to Markdown-expressible syntax, with a source mode and preview. Content it can't round-trip (raw HTML, comments, footnotes, abbreviations, linked images) opens in source mode and prompts before switching to visual.

Render both with |markdown in templates. Set htmlclean: true only if you actually want the sanitizer — by default these fields trust the stored source, unlike code.

RSS as a collection setting, not a URL contract. The canonical feed is /feed/rss/{collection}. Build filtered variants with include, exclude, limit, name and description — this is what the Feeds utility generates. Put title, content, date, author, media, link, image and language on the collection's RSS Feed card; URL-supplied mappings are now ignored. The Hidden Field (default draft) is the only supported way to influence which objects appear, and it applies to every schema.

API and MCP write paths. Treat passwords as write-only:

• A PUT that omits the password key preserves the stored hash, so GET-then-PUT round trips are safe.
• MCP update_object now merges like patch_object; don't rely on full-replace semantics, since agents never see password or binary values.
• Never list password properties in index — index rebuilds won't store them and schema:lint will complain.

Front-end auth. Sign-in and password reset now match the email address exactly. In your own forms, stop branching on the error text: both unknown address and wrong password return Invalid login credentials, and inactive/expired/login-limited states only surface after a correct password. Pass cms.form.loginForm({ showRememberMe: false }) (or the whitelabel login option) to drop the persistent-login checkbox for shared or kiosk devices.

Bulk mailer integration. /api/action/mailer/bulk, /preview and /objects now require a session or API key whose access group grants mailer. POST /api/action/mailer stays public for front-end form actions, so split your server-side sends onto a keyed client and leave only the form-action call anonymous. Use the template's Send History card (sent/failed/skipped/pending, test sends flagged) instead of building your own audit trail.

Admin customisation. Any custom admin page or Stacks Admin Core page must call cms.adminAssetsHead(); it now emits the Sentry snippet itself, scoped with allowUrls to Total CMS assets and dashboard pages.

Gotchas and Tips

• RSS 404s after upgrade are expected, not breakage. Only blog and feed collections are auto-enabled. Turn on Publish RSS Feed per collection, then move any field mapping out of the feed URL and onto the collection card.
• Draft leakage is fixed for everyone, but the mechanism changed: any include/exclude in the URL used to disable draft filtering, for blogs too. If you depended on that, set a different Hidden Field on the collection instead.
• Public Read removal is schema-matched, so renamed collections are covered — but content collections are untouched, so don't assume the migration fixed everything. Verify each hidden-from-admin sensitive collection with an anonymous request.
• Password hashes may already be in your DB. Saving a schema drops a password property from index, but run schema:lint and rebuild indexes to confirm. Read permissions no longer decide hash exposure; nothing exposes it.
• List fields default to allowHTML: false. A relational or list field whose option labels contain markup (or that a deck label pattern points at) will render stripped. Opt back in per field with allowHTML: true only after checking the source is sanitized.
• Deck labels are sanitized browser- and server-side. SVG icons and simple formatting survive; anything relying on raw stored HTML will not. code fields and fields with htmlclean off remain the sharp edges.
• Access-group defaults changed for new groups only. A group created in the admin used to arrive with Mailer, Data Views, Builder and all utilities pre-ticked; now it starts from the same empty baseline as groups created programmatically. Existing groups are unchanged — audit them explicitly.
• tcms check runs in the CLI's PHP. Extension and opcache/cache rows can legitimately differ from a web request; the output says so. Don't use it as a substitute for a page-level health check.
• styledmarkdown will not rewrite untouched fields, but switching an edited field to visual mode asks for confirmation. In bulk-import or API-driven workflows, prefer markdown to avoid the source/visual conversation entirely.
• Extension points: the --config flag gives you a redacted merged config for diffing between environments; cms.form.loginForm options and the whitelabel login options are the supported hooks for login UI changes rather than overriding the view.