IntraVox - Releases

Changed

• Automatic Template Installation: Default templates are now automatically installed during app install/update
• No longer requires manual occ intravox:setup command for templates
• Existing templates are preserved (idempotent installation)
• Templates are installed after demo data import completes

Added

• Default Page Templates: 7 professional page templates installed automatically during setup
• Department: Team info, services, and resources layout
• Event: Program schedule, speakers, and registration sections
• Knowledge Base: Documentation hub with categories, FAQ, and popular articles
• Landing Page: Visual homepage with hero, features, sidebar, and call-to-action
• News Article: Single article layout with hero image and related links
• News Hub: Central news page with carousel, featured articles, and categories
• Project: Project management page with status, milestones, team, and documents
• Template Preview Cards: Visual layout previews when creating pages from templates
• SVG-based schematic showing column layout, header rows, sidebars, and collapsible sections
• Widget type badges showing which components are used (heading, text, image, video, news, links, divider)
• Complexity indicator (Simple/Medium/Advanced) based on layout structure
• Column count and widget count statistics
• Enlarged Template Modal: Larger "Create new page" dialog with improved template gallery
• Grid layout with 220px minimum card width
• Scrollable gallery area (450px max height)
• Template Translations: All template titles and descriptions translated
• Dutch, English, German, and French translations
• Automatic fallback to original text for custom user templates
• Template Stock Images: Professional placeholder images included with each template
• Hero images, feature images, team photos, speaker portraits
• Images automatically copied when creating pages from templates

Changed

• Template installation now runs automatically during occ intravox:setup
• Templates are installed to {lang}/_templates/ for each language folder

Fixed

• Text Editor Table Spacing: Fixed blank lines between tables doubling on each save cycle
• TipTap inserts phantom <p> elements between block-level nodes, causing newline growth
• cleanMarkdown() now caps consecutive newlines at 3 (one visual blank line max)
• Preserves user-added blank lines while preventing accumulation
• Text Editor Asterisks: Fixed * and ** appearing in text after saving bold/italic combined with underline
• Mixed markdown + HTML (**text<u>underlined</u>**) now correctly serialized as pure HTML tags
• Error fallback now escapes content instead of returning raw markdown

Added

• Orphaned GroupFolder Data Management: New "Maintenance" tab in admin settings
• Scan for orphaned groupfolder data (from reinstalled Team Folders app)
• Recover content by migrating to the active IntraVox groupfolder
• Delete orphaned data permanently
• Useful for production environments recovering from Team Folders reinstallation

Improved

• Team Folders Error Messages: Renamed "GroupFolders" to "Team Folders" to match Nextcloud App Store naming
• More specific error messages when the Team Folders app is not installed or enabled
• Separate error messages for different failure scenarios (app not installed, folder creation failed, access denied, unexpected error)
• Full translations in Dutch, German, and French

Fixed

• Public Share Page Tree: Fixed current page not being highlighted in page structure popup when viewing via public share link
• Public Share Page Tree URL: Fixed 404 error on page structure in public share view (was calling /pagetree instead of /tree)
• Password-Protected Share Navigation: Fixed "page not found" error after entering password on public share links
• Generic "Could not create IntraVox GroupFolder" error now shows specific guidance based on the actual problem

Added

• Public Share Links: Full anonymous access to IntraVox pages via Nextcloud share links
• Share any folder scope (language root or subfolder) as a public link
• Anonymous users see pages, navigation, footer, page tree, and breadcrumbs without login
• Share scope enforced: only pages within the shared folder are accessible
• Rate limiting on all public endpoints to prevent abuse
• Public Page Viewer: Dedicated read-only view for anonymous visitors
• Full page rendering with all widget types (text, images, video, links, news)
• Navigation menu with mega-menu support
• Page tree sidebar for browsing available pages
• Breadcrumb navigation
• Footer display
• Responsive layout for mobile and desktop
• Password-Protected Shares: Full support for Nextcloud share link passwords
• Server-side password challenge screen (rendered before JavaScript loads)
• Session-based authentication — enter password once, navigate freely within scope
• Brute force protection (10 attempts/min per IP) with random timing delays
• Password verified via Nextcloud's IHasher (bcrypt) — plain text never stored
• API endpoints return 401 with passwordRequired flag for expired sessions
• Vue.js fallback password form for session expiry during navigation
• Share Dialog: Redesigned public link modal with full share context
• Scope indicator shows whether link shares a page, folder, or language root
• "Password protected" badge with lock icon when share has a password
• Navigation tree showing shared pages structure
• Clickable "Manage share in Files" link opens Nextcloud Files sharing sidebar
• Copy public link button
• Share Button: Always visible in page toolbar with two states
• Active state (theme color): share link exists — click to open share dialog
• Inactive state (muted): no share link — click for guidance on creating one
• Detects existing Nextcloud share links for the current scope
• Admin Shares Overview: New "Sharing" tab in IntraVox admin settings
• Lists all active Nextcloud share links on IntraVox content
• Shows scope, file path, creation date, and expiration
• Direct link to manage each share in the Files app
• Useful for auditing public access
• Sharing Disabled Warning: Clear feedback when NC link sharing is disabled
• Warning dialog with link to Nextcloud Sharing settings
• Explains the prerequisite for public sharing
• Public News Widget: News widget works in anonymous share view
• New API endpoint /api/share/{token}/news for fetching news without authentication
• Supports both sourcePageId and legacy sourcePath filtering
• Share-aware image URLs for media in news items
• Only shows pages within the share scope
• Public Media Access: Images and resources accessible via share token
• Page media: /api/share/{token}/page/{uniqueId}/media/{filename}
• Shared resources: /api/share/{token}/resources/media/{filename}
• Resource subfolders: /api/share/{token}/resources/media/{folder}/{filename}
• Links Widget Color System: Redesigned color options for intuitive background control
• Container background: 4 options — None, Light, Accent, Primary (with visual color swatches)
• Individual link background: 3 options — Default, Light, Primary (with visual color swatches)
• Default links blend transparently into their container/row background
• Automatic contrast detection: white text/icons on dark backgrounds, dark text on light
• Telemetry expansion: Added 7 new server configuration fields to anonymous usage statistics
• Country code, database type, default language, timezone, OS family, web server, Docker detection
• Send report now button: Manual telemetry report trigger in admin Statistics tab
• Breadcrumb Home label from navigation.json: Home breadcrumb now reads its label from the first item in navigation.json instead of hardcoded "Home"
• Public sharing documentation: Comprehensive guide covering setup, scope, password protection, security, and admin overview

Changed

• SystemFileService: Extended with news page retrieval for public context
• getNewsPagesForShare() uses system-level GroupFolder access (no user session)
• Recursive page discovery with share scope filtering
• Excerpt extraction from first text widget
• First image detection with share-aware URL rewriting
• Color Utilities Refactored: Separated DARK_BACKGROUNDS and LIGHT_BACKGROUNDS arrays in colorUtils.js
• New isLightBackground() function for accurate contrast detection
• --color-primary-element-light correctly classified as light background (was incorrectly dark)
• News widget layouts (List, Grid) updated to use new light background detection

Fixed

• Public Share Page Tree: Fixed page tree only showing homepage when sharing a language root folder
• extractSubtreeByScope() now correctly returns the full tree for language-root shares
• All subfolders and pages are visible in the sidebar navigation
• Links Widget Contrast: Fixed white text/icons on light backgrounds (Accent, Light)
• Links without explicit background now blend transparently into their container
• Correct contrast for all container/link background combinations
• Webpack Chunk Caching: Fixed TypeError: n[e] is undefined when opening page editor after rebuild
• Added content hash to chunk filenames ([contenthash:8]) to prevent stale cached chunks
• Telemetry countryCode and timezone: Country code now derived from default_phone_region instead of default_language. Timezone uses smarter fallback: Nextcloud config → php.ini → UTC
• Telemetry sending to wrong URL: Fixed telemetry using deprecated endpoint. Now correctly uses TelemetryService::sendReport()
• Homepage breadcrumb label: Fixed breadcrumb showing page title instead of navigation label on the homepage itself
• Files URL in Share Dialog: Fixed file ID using internal GroupFolder storage ID instead of user-mounted ID, and corrected URL format to include index.php prefix

Removed

• HMAC token system: Removed unused PublicPageService, PublicPageController, and templates/public.php — dead code from an earlier public sharing approach that was never used

Security

• All public endpoints use #[PublicPage] and #[NoCSRFRequired] attributes
• Share token validation before any data access
• Share scope path enforcement prevents access to pages outside the shared folder
• Anonymous rate throttling (60 requests/minute) on all public endpoints
• Password brute force protection (10 attempts/minute per IP) with random delays (100–300ms)
• Session-based password auth — password never sent to browser or exposed in API responses
• Nextcloud share link settings respected (shareapi_allow_links)

Fixed

• Code Block Rendering: Fixed code blocks corrupting after editing (#15)
• Backticks no longer accumulate when saving and re-editing code blocks
• Fixed double-processing of nested <code> tags inside <pre> elements
• Code block content now correctly preserved through save/load cycles

Changed

• Database Exception Handling: Use OCP\DB\Exception instead of Doctrine exceptions
• Follows Nextcloud coding standards for database-agnostic error handling
• Cleaner code without string-based error detection

Security

• svg-sanitize: Updated from ^0.20 to ^0.22 to fix medium severity vulnerability (GHSA bypass)

Fixed

• PostgreSQL Support: Fixed database compatibility issues for PostgreSQL users
• SetupService: Now correctly handles PostgreSQL duplicate key errors (SQLSTATE 23505)
• LicenseService: Added null check for shared folder to prevent crashes during setup
• AnalyticsService: Improved exception handling for unique constraint violations
• Installation on PostgreSQL: Setup no longer fails when re-running or retrying installation

Fixed

• App Store Cache: New version to bypass cached signature data in Nextcloud App Store
• No functional changes from 0.9.3

Fixed

• App Store Certificate Sync: Re-registered app with new certificate (serial 4824) to sync with App Store database
• Previous releases were signed correctly but App Store database had outdated certificate reference
• Resolves "Certificate 4822 has been revoked" error for all users
• No functional changes from 0.9.2

Documentation

• Added certificate verification section to RELEASE_CHECKLIST.md
• Added warnings about certificate management best practices