About

What's new

This document summarizes what changes for administrators and users of the sites built on Natora-Core.

Version 1.10.0 — October 3, 2026

Text editor

One simple text editor (bold, italic, underline, lists, emoticons, character counter) is available to every module, for example private messages or the journal.

Modules

The modules list and the catalog tell core modules, shared modules and site-specific modules apart, with a color badge and an origin filter.
Module menus are sorted in the declared order; an entry a module no longer declares is hidden instead of staying visible.

Tables and display

Column sorting also works in the tables of public pages.
Durations are fully shown in the site language (for example "5 years 2 days").
The profile can host blocks added by other modules.

Compatibility

The site runs on PHP 8.5 without warnings, while staying compatible with PHP 8.2 to 8.4.

Media library

The explorer breadcrumb keeps its appearance, whatever the site theme.

Menus

A module can group its pages under a non-clickable heading (for example "Members"), without duplicates on updates.

Version 1.9.0 — October 1, 2026

Modules and updates

Core modules now have their own version number, just like installable modules.
On an existing site, administration can record the historical starting version without reinstalling modules or replaying old database changes.
The catalog clearly shows the installed and available versions, then lets later updates run normally.
This transition is designed for already-running production sites: recording the baseline version is separate from applying the actual update.

Media management

The media library now looks and behaves more like a file explorer, with a collapsible folder panel on the left.
A breadcrumb shows the current folder and folders can be opened directly from the tree.
One media item, or a whole checked selection, can be dragged into another folder.
Files dropped into the library are uploaded directly into the currently open folder.
Moving media never changes the underlying file or its public address, so pages already using it keep working.
The new explorer texts are available in French and English.

Version 1.8.6 — September 30, 2026

Installation and configuration

The installer now has an email step for SMTP, sender and contact settings, with a connection test. The step can be skipped when email is not needed yet.
Legal page addresses (terms, privacy, cookies and legal notice) can be configured per site, and a link can be hidden.
The installable app handles transparent icons better and its install action is shown in the account menu when available.

Profiles and media

Sites can choose and order the fields shown on profile cards. Nickname and language are now part of the fields managed by the Core.
Profile searches and sorting handle letter case and accents more naturally.
Modules can use their own image profiles when uploading media.

Administration and reliability

The sitemap collects URLs from active modules, removes duplicates and respects exclusions and noindex pages.
The contact form success message is no longer duplicated or lost after a redirect.
Some administration scripts are loaded only on the screens that need them, reducing unnecessary assets elsewhere.
Module status also reports versioned modules that do not own database tables.
Google Analytics can use its regional collection address with the site's security policy.
The framework version can optionally be shown under “Powered by Natora-Core”.
The captcha refresh icon is now supplied directly by its module.

Version 1.8.5 — September 28, 2026

Media library

Media can be organised in folders, three levels at most: filter by folder, folder chosen when uploading, creation, renaming and deletion from "Manage folders". Several ticked media move at once.
Files and their addresses do not change: the pages showing the images stay intact.
The editor's media picker also offers the folder filter.
The media library search updates while typing without interrupting the input.

Installable app

The site can be installed as an app on a computer, Android or iPhone: "Install the app" shows in the account menu when the browser offers it. Name, colours and icons are set for each site.
Style changes show without forcing a page refresh (Ctrl + F5).

Modules

In the module list, selecting a group lists its modules by name.

Statistics

Google Analytics records the visits again: its new collection addresses were blocked by the site security policy.

Version 1.8.4 — September 28, 2026

Modules

The module catalog shows the names and descriptions in the interface language, sorted by name; each administration module follows the module it administers ("Shop", "Shop (administration)").
The module groups (Account, Site, Commerce…) show in plain words in the filters of the catalog and of the module list.

Pages and editor

Page titles (home, about, legal notice…) have a size suited to the text, and the table styles offered by the editor finally show.
The page styles and the editor are provided by the framework and are updated with it. A site can add its own styles and symbols in its configuration.

Version 1.8.3 — September 28, 2026

The footer links (Terms of service, Cookie policy, Legal notice) lead to their pages again.

Version 1.8.2 — September 28, 2026

Sign-in and sign-out can no longer fail with "Invalid or expired token" on a newly installed site.
The home page can be a page edited from the administration ("home" page), like the "About" page; otherwise it shows the site name and a welcome message.

Version 1.8.1 — September 27, 2026

A new site has a public menu: Home, About and Contact.
The last page of the installer is shown with its styles again.
An installed site opens normally, even if the install/ folder is still there.

Version 1.8.0 — September 27, 2026

Installing a new site in the browser

A new site is now installed from the browser: while the install/ folder exists, the site shows the installer. Steps: server checks, site settings, database (with a "Test the connection" button), first administrator account, then a summary.
An installation key, read from the install/key.txt file, is asked first: only someone with access to the site's files can install it.
The administrator chooses their password (it is no longer generated) and may be called admin.
At the end, the install/ folder is deleted automatically and the site opens; the last page leads to the sign-in and to the module catalog, from which the blog, the shop, the members area… are installed.
The administration menu of a new site is only visible to signed-in administrators (Modules, Roles and Permissions: super administrators only).

Administration

Permissions › Prune finally shows its result: deleted permissions and kept permissions. It also deletes the permissions of the modules removed from the site, with their grants.
Installing a module also installs its administration (for example the Shop and the Shop administration).
Menus are refreshed as soon as a module is installed, enabled or disabled (they could keep their previous state for up to an hour).

Fixes

Changing a password from a user's record shows the confirmation message again.
In maintenance mode, the styles and scripts of the sign-in and administration pages load again.
Bringing tables into line (bin/schema.php) works on MariaDB with generated columns.

Version 1.7.0 — September 26, 2026

Modules: catalog and installation

Administration › Modules › Catalog lists the available modules (Blog, Shop, Members, Messages, Mailing, Google sign-in…) with their state: available, installed, update available. A button installs a module: its tables are created, it is enabled and its permissions are granted (everything for the super administrator, viewing for administrators). A module that needs another one installs it first, and its administration module is installed with it.
The catalog search filters modules while typing, and the group filter applies immediately (no more "Search" button).
Automatic menus: on the first installation of a module, its menu entries are added automatically — in the site menu (for example "Blog") and in the administration menu (for example "Shop › Products, Orders…"). Each one is only visible to those allowed to use it, and disappears when the module is disabled.
Menus no longer show the sections of modules removed from the site.

Google sign-in

Google sign-in becomes a separate module. A site that used it must install the "Google sign-in" module from the catalog and copy its credentials into its configuration (see the technical documentation): otherwise the button no longer appears.

Menus and header

The header links and tooltips (My orders, Notifications, Private messages) are translated on every page; they stayed in English outside their own section.
In the administration menus, a section restricted to a permission only appears to the users who have that permission.

Confirmation messages

After saving, deleting or an error in the administration, the confirmation message is now always shown. It used to disappear on many forms, because the page reloaded before it could be seen.

User management

When editing one's own account, the Role and Status fields are greyed out, with an explanation: nobody can change their own role or status. Before, they looked editable but the change was not saved.
The "i" tooltip next to the username no longer shifts down when clicked, shows above the neighbouring fields and is translated into the interface language.

Media

Pagination correctly shows "Page 2 of 5" (and its equivalent in each language) instead of an unsuitable word in English, German and Spanish.

Error pages

If a module is enabled but its tables have not been created in the database yet, a "Module not installed" page is shown instead of a generic server error.
The server error page is translated.

Translations

A few labels fixed: "Desactivar" in Spanish (a typo showed "DDesactivar") and "Yes" / "No" capitalized in English.

Page editor

Tables keep their alignment, images their style, and percentage widths and heights are kept.

Version 1.6.2 — September 23, 2026

Modules and permissions

Disabling a module now disables its permissions; enabling the module again brings them back, without losing their role grants saved earlier.

Sign-in

Clicking a password reset link while already signed in now shows a message before the redirection, instead of a silent redirection.

Dashboard

The buttons to clear the caches (templates and menus) are now at the top of the dashboard, centered, instead of the former "Caches" list further down.
The "User management" and "Module management" links are now buttons.

Page management

The name of each page is a link that opens the public page in a new tab, in its own content language.
The Name, Slug, Updated and Scheduled columns can be sorted by clicking their header.
The "Updated" column shows the date in French (month in full) when the interface is in French.
The file of a page can be downloaded directly from the File column; the custom CSS of a page can be downloaded from its edit page when it has one.
Manual drag-and-drop reordering has been replaced by column sorting.
The search is fully dynamic; there is no more "Search" button.

Menu management

A "Name" column appears before the slug; the action buttons show their text again.
The "Edit" button becomes "Rename" and no longer allows changing the slug of a menu, so as not to break existing links.

Media management

A new "Format" filter (file type) appears in the search, and adjusts automatically to the chosen Type.
Deleting a media file now asks for confirmation first.
The "Filter" button is gone: the search (Type, Format, text, number per page) updates by itself, no need to click anymore.
Switching between grid and list view no longer resets the current search.
With several hundred media files shown, opening the variants of an image no longer blocks page scrolling for several seconds.
The page title is now "Media management" (instead of "Media library").

Page transitions

The transition effect (fade) between pages is no longer provided automatically by the framework: each site now enables it itself through its own module. Once enabled, there is nothing else to configure.

Version 1.6.1 — September 20, 2026

Module translations

Modules can provide their translations without extra files to copy into the site, including permission labels and emails. The site's existing translations remain compatible.

Version 1.6.0 — September 19, 2026

Navigation and languages

Public and administration menus remain available when a translation is missing: each missing label is taken from the site's default language.
Internal menu links keep the selected language, even when the menu label is shown in another language. This also applies to links to the home page and to mobile menus.
The message saying that a page is shown in a fallback language no longer appears twice after a redirect, especially on the home page or when entering the administration. It remains available on the following pages.
In the menu editor, the list of languages follows the site's current configuration: an old language code is no longer offered because of old pages. Saved translations are not changed automatically.
The language selectors of forms keep a stable width: choosing a short name no longer truncates longer names in the list.
Loading menus avoids some needless repeated reads.

Administration

In the user list, the Actions column disappears when no edit or deletion is allowed on the accounts shown.
In module management, the Actions and reordering columns are hidden without the right to edit.
The administration home becomes a real dashboard: registered, active and inactive accounts, sign-ups over the last 30 days and module status, depending on viewing rights. Links open the available management screens.
The framework version and the presence of the template and menu caches are shown. Super administrators can clear these caches separately after confirmation. The changelog remains available in a collapsible section.
Only super administrators can edit the changelog. Other administrators can still read it on their dashboard.
The user table can be sorted by ID, name, email, role, status or creation date. Sorting applies to all results, before they are split into pages; links keep the search.
The creation date of users is shown in French format when the interface is in French.
The edit, delete and add controls of media take the actual rights into account, including after dynamic filtering. A read-only administrator no longer sees actions they are not allowed to perform.
The media library shows the right number of files after filtering and loads image variants more efficiently.
The colors of the administration and of the mailing lists use the site's palette. Buttons keep a readable text on hover and after a visit.
Action confirmations are consistent: a single prompt per action, and cancelling really prevents it.

Mailing lists

French and English translations of the mailing administration completed: campaigns, recipients, subscribers, subscriptions and blacklist reasons.
Fixed the loading of the script used to select the audience of a campaign.

Performance

In development, public pages and the administration reuse their already compiled templates and detect their changes. The information shown stays up to date, without caching page content.
Image lists can load their fallback variants in a single query, instead of one query per image.
Catalogs and management screens that show many images benefit from it, keeping the existing images and fallback rules.

Security and reliability

Downloads and module resources are hardened to prevent access to files outside the allowed locations or not meant to be public.
The rights to edit an account are checked again when saving, even if only its details change. A change of rights between opening and saving the form is taken into account.
Viewing the module list no longer creates database records: their initialization remains tied to an authorized action.
A technical administrator can re-enable, at code level, a module disabled by mistake, without editing the database directly.
Modules bundle more of their own templates, styles, scripts and error messages. Public downloads, avatars and permission lists no longer depend needlessly on administration screens.
Partial customizations of a site keep the missing default files. Styles and scripts are better cached and refreshed when their content changes.
Fixed cases where the form error messages of a module could be missing or come from another context.
Stronger automated checks for Google sign-in, profiles, rights, downloads and modules. A module that fails at startup no longer makes the next startup look successful.

Version 1.5.5 — September 12, 2026

Sign-in with a Google account, in addition to the usual username and password, on the sign-in page.
A second kind of anti-robot check ("captcha"), Cloudflare Turnstile, usable instead of the classic captcha depending on the site's configuration.
The PayPal payment button can now show a different amount, currency and text depending on the page language (French, English, etc.), instead of the same text for every language.

Version 1.5.4 — September 12, 2026

In the media library (Administration > Media): a file can be downloaded under its original name (instead of an unreadable technical name), the "Type" filter is now translated, and the type selector of the media picker filters the list correctly again when the type changes.
A PayPal payment button, placed anywhere in the text of a page by typing [paypal-button]. Deliberately limited to a single page (chosen in the site's configuration) so as not to clutter the editing of other pages.

Version 1.5.3 — September 12, 2026

The mobile administration menu (Administration > Menus, mobile view) was empty while the public site's one worked — fixed.
The "Back" button of the "Access denied" page did nothing when clicked — fixed.
Several texts ("Edit items", "Number of items", protected menu message) were shown in English or as technical codes instead of being translated — fixed.
Security: only a super administrator can now delete a menu (previously any administrator with the delete permission could).
In Administration > Menus: the "Edit"/"Delete" buttons are replaced by icons (as in user management), and the "New" button is now aligned right.

Version 1.5.2 — September 12, 2026

The account activation email sometimes showed {app_name} instead of the site name in its signature — fixed.
In menu management (Administration > Menus):
- A dedicated Icon field for each menu item, separate from the "CSS class" field.
- A Clear the menu cache button to show the latest changes on the public site immediately.
- Fixed a menu item wrongly shown as "Scheduled" right after its page was published.
- The form to add a menu item was reorganized (icon, status and buttons moved), and the title of the edit page now shows the menu name.
Fixed a stray space that could remain at the start of a CMS page title after editing.

Version 1.5.1 — September 12, 2026

Fixed the error messages of the sign-up form (and of the forgotten password and contact forms) that were sometimes shown as raw technical codes instead of readable text, especially for captcha errors.

Version 1.5.0 — September 10, 2026

Improved internal documentation of the project (no visible impact for users).

Stronger security

An in-depth security review fixed several flaws, including:

An administrator can no longer give themselves, by mistake (or abuse), rights they should not have, nor edit a role or an account of a higher level than their own.
Sign-in is better protected against session theft: changing one's password automatically signs out the other sessions open elsewhere.
Password reset links can no longer be reused once used or after a password change.
CMS content (pages, custom styles) is better filtered to prevent the injection of malicious code.
A flaw that could, in some cases, send a user to an external site after signing in has been fixed.
A critical flaw allowed a disguised file (for example a script) to be uploaded through file uploads in the administration; it is now blocked.
The technical page shown only in development mode has been secured against code injection.

Permission management (administration)

A new Synchronize button in Administration > Permissions automatically creates the missing permissions — no need to type them by hand anymore.
A new Purge button deletes the permissions that became useless (disabled or removed modules), without ever touching the essential system permissions or those still in use.
The permissions essential to the administration (management of permissions, roles and users) can no longer be deleted by mistake.
Several labels of the add permission form that stayed in English were fixed.
The search and the filter of the permission list are now instant (no need to reload the page).

Role and user management

A new screen to grant or deny individual permissions to a specific user, in addition to those of their role.
Fixed a bug that could make a role lose permissions when saving, if the list had been filtered just before.
Fixed the display of an administrator's current role in the edit form of their own account.
Fixed a visual problem that squashed the text in the new grid of individual permissions.

Other fixes

Scheduled publication of a CMS page ("publish on a given date") finally really works.
Emails (activation, password reset, contact) now keep the reply-to address correctly.
Texts shown in French by default in some forms (sign-up, sign-in, maintenance) when they should show in English without a translation have been fixed.
The group filter and the search of a user's individual permissions page are now instant.

Version 1.4.3 — September 7, 2026

Fixed the display of menus and CMS pages in some special cases (pages whose address starts with a digit, language change).
Password reset emails display correctly again, and their translations were reviewed.
Administration clean-up: the media picker, the site icons and the manifest images now always reload up to date after an update.

Version 1.4.2 — September 6, 2026

The email sending queue now automatically recovers stuck sends and cleans up old completed ones.
Fixed a bug that sometimes prevented signing out.
Removed debugging traces that were written to the server logs at each sign-in.
Improved the reliability of image processing in the administration.

Version 1.4.1 — August 3, 2026

Technical groundwork to restrict, in the future, some interactions between members (for example blocking users), with no immediate visible impact.

Version 1.4.0 — July 27, 2026

Search engine optimization (SEO)

Pages now automatically generate better information for search engines and social networks (title, description, Facebook/Twitter preview, canonical link), which can be customized page by page.

User profile

New profile layout, wider and clearer, with accessible tabs.
Profile, avatar and account option forms reorganized to be easier to read, especially on mobile.

Module management

The modules installed in a project are now detected automatically, with their own name, icon and activation state, visible in Administration > Modules.

Version 1.3.0 — July 20, 2026

A complete email campaign system: message templates, campaigns, recipient lists, send tracking, blacklist and statistics, with its own administration interface.

Version 1.2.3 — July 19, 2026

First version of the mailing lists: subscription with email confirmation, preference management and unsubscription, in French and English.

Version 1.2.2 — July 19, 2026

A performance diagnostic tool for technical teams, with no impact on the experience of the site's visitors.

Version 1.2.1 and 1.2.0 — July 2026

A more reliable background email sending system, with automatic retries after a temporary failure.

Version 1.1.2 — July 17, 2026

Fixed a display bug in the order of the site menus in the administration.

Version 1.1.1 — June 18, 2026

Fixed broken internal redirects in some special URL cases.
Restored the display of visit statistics (online visitors, daily counters).

Version 1.1.0 — June 8, 2026

Administration actions (menus, permissions, modules, media, users) now show clear and consistent error messages, including when the page does not exist or access is denied.
Fixed a bug that could show the same confirmation message twice after some actions.

Version 1.0.4 and 1.0.3 — April-May 2026

Stronger security of sign-in sessions (secure cookies).
Protection against unauthorized actions when editing the changelog in the administration.
Less technical information publicly visible on the production site.

Version 1.0.2 and 1.0.1 — February-March 2026

A technical /health page to quickly check that the site and its database work correctly.
General stabilization of the site's inner workings.

Version 1.0.0 — January 6, 2026

First stable version of Natora-Core, with:

A site available in several languages (French/English) with addresses suited to each language.
A complete sign-in system: sign-up, sign-in, sign-out, "remember me", account activation and password reset.
A contact form protected against abuse.
Visit statistics that respect visitors' consent.