Cms Laravel Package

Product Decisions This Supports

• Security remediation prioritization. 3.6.2 closes eight distinct exposure classes in one release: unauthenticated read of any indexed field via /feed/rss/{collection}, draft leakage into feeds, partial-match email lookup in sign-in and password reset (account takeover on shorter addresses), account enumeration in login errors, unauthenticated bulk-mail and object-listing endpoints on Pro, over-permissioned new access groups, bcrypt hashes returned to any client with public Read, and stored XSS via deck item labels and list option labels. Treat this as a forced upgrade, not a routine bump: schedule it as a security release with an owner, a deadline, and a customer comms plan.
• Upgrade cost must be scoped before commitment. Three items are behavior-breaking, not silent fixes:
  1. RSS feeds now 404 by default. Only blog and feed collections are auto-enabled; every other collection needs Publish RSS Feed turned on in settings. Any collection whose feed mapped title/content/date/author/media via URL parameters must have the same values set on the collection's RSS Feed card — URL-based mapping is now ignored.
  2. Public Read stripped from sensitive collections (auth, playground, mailer, automations, Site Builder pages, data views) by a one-time migration. Any anonymous front-end reading one of these breaks and needs an API key or access group.
  3. Password hashes and binary values are never returned. REST PUT that omits the password now preserves the stored hash (a GET-then-PUT round trip no longer locks users out), but API and MCP writers that relied on full-replace semantics must adapt: MCP update_object now merges like patch_object.
• Build vs buy on developer/authoring experience. Two new field types — markdown (source editor, stored as written) and styledmarkdown (Tiptap visual editor saving Markdown instead of HTML) — mean the roadmap no longer needs a bespoke Markdown editor or a Markdown-to-HTML pipeline; render with |markdown. Both store the same string, so a schema can switch between them without migration, and a field nobody edits is never rewritten. This is a legitimate "buy" answer against custom field work.
• CI/CD gating is now a product capability. tcms check runs the Server Checker from the CLI in the admin utility's order (bundle integrity, license, server info, directory permissions, required and optional PHP extensions) with --json and --config (secrets redacted), and exits 1 when the install cannot run. Deploy scripts can gate on it, so we can move "does this environment meet requirements?" from post-deploy discovery to pre-deploy failure. Note the documented caveat: checks run in the CLI's PHP, so extension and cache rows can differ from what a page request sees.
• Operational visibility for bulk email. Send History on a template's edit page shows sent, failed, skipped and pending counts, marks test sends to an override address, and refreshes after each queue. This converts "nothing in the admin showed what a bulk send actually did" into a supportable, auditable workflow — relevant for any customer running lifecycle or newsletter sends.
• Whitelabel and embedded-login fit. showRememberMe: false on cms.form.loginForm() or in the whitelabel login options removes the persistent-login checkbox, useful for shared-device, kiosk, or compliance-driven deployments without forking the login form.
• Observability for custom admin pages. cms.adminAssetsHead() now emits the Sentry snippet when the sentry setting is on, scoped with allowUrls to Total CMS's own assets and dashboard pages so customer scripts are not reported. This makes custom admin layouts (including Stacks Admin Core) first-class, and the upload bug fixed in this release would previously have gone unreported on those pages.
• Feature-flag and permission defaults as a roadmap lever. A new access group now starts with Mailer, Data Views, Builder and all utilities off, matching programmatic defaults rather than the admin form's old pre-selection. Existing groups are unchanged. This supports least-privilege positioning in security reviews and procurement.

When to Consider This Package

Adopt or upgrade now if:

• You run any collection with a public URL and indexed fields, any auth collection with public Read, or any Pro site exposing the Mailer API — 3.6.2 is a live-data-exposure fix, and every day on 3.6.1 keeps those paths open.
• You write MCP agents or API clients against the CMS. The merge semantics of update_object and the password/binary omission are contractual behavior you need to design around, not discover in production.
• You need Markdown authoring with a real visual/source toggle without building an editor, or you're standardizing content on Markdown to survive a later front-end swap — markdown and styledmarkdown share a storage format, so the choice is reversible.
• You need deploy-time environment verification: tcms check with --json and exit-code semantics fits a pipeline gate far better than a manual admin utility visit.
• You need audit trails for bulk sends, or you're shipping a whitelabel admin and want login form control plus error reporting on your own admin pages.

Look elsewhere, or plan significant remediation, if:

• Your architecture depends on anonymous public Read of auth, mailer, automations, Site Builder, data views, or playground collections. The one-time migration removes it unconditionally (matched by schema, so renamed collections are included); you must move those readers to an API key or access group.
• You depend on URL-parameter field mapping in RSS feeds, or on feeds for non-blog collections, and cannot redeploy those collections' RSS Feed settings alongside the upgrade.
• You rely on full-replace semantics from MCP update_object, or on REST PUT round trips that previously rewrote the password field.
• You embed stored HTML in deck label patterns or relational list option labels. Labels are now sanitized in the browser and on the server (SVG icons and simple formatting still render), and list fields default to allowHTML: false — a list relying on HTML in option labels needs allowHTML: true. Any code field, or any field with htmlclean off, was never sanitized on save and should be treated as a content-audit item.
• You need the checker's extension and cache results to match page requests exactly; the CLI runs in its own PHP and the output says so.

How to Pitch It (Stakeholders)

To executives: This is a security release that closes eight real holes, several of which let unauthenticated users read data they should never have seen — indexed fields through RSS, password hashes on auth records, object ids and titles from the Bulk Mailer endpoints, and a password-reset flow where [email protected] could set the password on [email protected]. It also fixes login messages that disclosed whether an account exists. Alongside the fixes we get four capabilities worth talking about: a CLI server checker that can fail a deploy instead of an admin noticing problems afterward, Markdown authoring fields, per-collection RSS feed controls, and a Send History view for bulk email. The cost is a coordinated upgrade: three changes are behavior-breaking — RSS feeds are off unless a collection opts in, public Read is stripped from sensitive collections, and API/MCP writers stop receiving or overwriting password and binary values. Those are the right defaults, but they need a rollout plan and customer notice rather than a silent patch bump.

To engineering: Ship 3.6.2 as a planned security release with a migration checklist, not a passive dependency bump. Concretely: (1) inventory every collection with a public URL and decide per collection whether RSS should be on — only blog and feed collections are auto-enabled, everything else 404s until you flip Publish RSS Feed, and any feed that mapped fields in its URL must have those values set on the collection's RSS Feed card since URL parameters are now ignored; (2) find every anonymous reader of auth, mailer, automations, Site Builder, playground and data views collections and move them to an API key or access group before the one-time migration lands; (3) audit API and MCP writers — PUT omitting the password now preserves the hash, and MCP update_object merges like patch_object, so replace-style agents will silently stop clearing fields, which is safer but different; (4) review deck label patterns and relational list option labels for HTML dependency, remembering that code fields and fields with htmlclean off were never sanitized on save; (5) add tcms check --json to the pipeline and gate on exit 1, accepting that CLI extension and cache rows may differ from page requests; (6) confirm custom admin layouts call cms.adminAssetsHead() so the newly scoped Sentry reporting covers them. Verify drafts stay out of every feed regardless of include/exclude, and treat this release's password-hash removal as a reason to rotate any hashes that may have been served under public Read.