Skip to content

WackoWiki

v6.3.0 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 8d Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

javascript mariadb mysql php sqlite wackowiki
+2 more
wiki wiki-engine

Affected surfaces

auth

ReleasePort's take

Moderate signal
editorial:auto 8d

Version 6.3.0 enforces strict CSP nonces for all inline scripts and adds host‑secure cookie prefixes, while moving PHP dependencies to Composer‑managed vendor/ and renaming core routes.

Why it matters: Security hardening via CSP nonces (severity 80) and Host‑Secure cookies (severity 75) protects against script injection; breaking changes require migration before upgrade.

Summary

AI summary

Broad release touches Helper Functions, Syntax & Markup Extensions, Upgrade Guide, and Security & Platform Hardening. Breaking: Removed legacy highlighter tags (css, ini, html, java, pascal, sql); migration required via admin_replace

Changes in this release

Security High

Enforces strict CSP nonces for all inline scripts.

Enforces strict CSP nonces for all inline scripts.

Source: llm_adapter@2026-07-18

Confidence: high

Security High

Applies `__Host-` and `__Secure-` cookie prefixes for session cookies.

Applies `__Host-` and `__Secure-` cookie prefixes for session cookies.

Source: llm_adapter@2026-07-18

Confidence: high

Breaking High

Moves all external PHP libraries from `lib/` to Composer‑managed `vendor/`.

Moves all external PHP libraries from `lib/` to Composer‑managed `vendor/`.

Source: llm_adapter@2026-07-18

Confidence: high

Breaking High

Renames core handler routes to prefixed `_` form (e.g., `page/_edit`).

Renames core handler routes to prefixed `_` form (e.g., `page/_edit`).

Source: llm_adapter@2026-07-18

Confidence: high

Feature Medium

Adds full undo/redo stack across editor sessions.

Adds full undo/redo stack across editor sessions.

Source: llm_adapter@2026-07-18

Confidence: high

Feature Medium

Introduces live preview rendering as you type in WikiEdit.

Introduces live preview rendering as you type in WikiEdit.

Source: llm_adapter@2026-07-18

Confidence: high

Feature Medium

Provides first‑class dark mode with OS detection and manual toggle.

Provides first‑class dark mode with OS detection and manual toggle.

Source: llm_adapter@2026-07-18

Confidence: high

Feature Medium

Adds new table attribute syntax for colspan, sticky headers, and CSS classes.

Adds new table attribute syntax for colspan, sticky headers, and CSS classes.

Source: llm_adapter@2026-07-18

Confidence: high

Feature Medium

Rewrites WikiEdit as ES2023 modules with state management, AbortController, autosave, search/replace, live preview, syntax highlighting, fullscreen mode, drag‑and‑drop images, markdown conversion, popup forms, toolbar customization, and resizable editor.

Rewrites WikiEdit as ES2023 modules with state management, AbortController, autosave, search/replace, live preview, syntax highlighting, fullscreen mode, drag‑and‑drop images, markdown conversion, popup forms, toolbar customization, and resizable editor.

Source: granite4.1:30b@2026-07-18-audit

Confidence: low

Feature Medium

Integrates Phiki Highlighter v2.2.0 replacing legacy Pear highlighter; supports 350+ languages via TextMate grammars.

Integrates Phiki Highlighter v2.2.0 replacing legacy Pear highlighter; supports 350+ languages via TextMate grammars.

Source: granite4.1:30b@2026-07-18-audit

Confidence: low

Dependency Medium

Removes `Clipboard.js` dependency; uses native `navigator.clipboard`.

Removes `Clipboard.js` dependency; uses native `navigator.clipboard`.

Source: llm_adapter@2026-07-18

Confidence: high

Deprecation High

Removes legacy highlighters (`css`, `ini`, `html`, `java`, `pascal`, `sql`).

Removes legacy highlighters (`css`, `ini`, `html`, `java`, `pascal`, `sql`).

Source: llm_adapter@2026-07-18

Confidence: high

Bugfix Low

Repairs TOC generation logic for newly created pages.

Repairs TOC generation logic for newly created pages.

Source: granite4.1:30b@2026-07-18-audit

Confidence: low

Bugfix Low

Fixes invalid selector tokens affecting "Copy to Clipboard" handlers.

Fixes invalid selector tokens affecting "Copy to Clipboard" handlers.

Source: granite4.1:30b@2026-07-18-audit

Confidence: low

Refactor Low

Refactors complex legacy helpers (MarkUp, _LSum, _RSum, _TSum).

Refactors complex legacy helpers (MarkUp, _LSum, _RSum, _TSum).

Source: granite4.1:30b@2026-07-18-audit

Confidence: low

Full changelog

WackoWiki v6.3.0 — Major Feature Release

This release represents a massive architectural overhaul, bringing modern JavaScript tooling, a completely rewritten editor experience, hardened security defaults, and a flexible new syntax highlighter.


Headline Features

WikiEdit: Complete Rewrite (ES2023 + ES Modules)

The editor has been modularized into ES6 modules with a dedicated state management layer and a AbortController for all fetch calls.

| Feature | Description |
| :--- | :--- |
| Autosave | Never lose drafts again; automatic background persistence. |
| Full Undo/Redo Stack | Deep history management across sessions. |
| Search & Replace | Full regex-supported find/replace inside the editor. |
| Live Preview | Real-time rendering as you type. |
| Syntax Highlighting | Code blocks highlighted inside the editor. |
| Fullscreen / Zen Mode | Distraction-free writing (widescreen centered). |
| Drag & Drop + Paste Images | Upload assets directly into the edit buffer. |
| Markdown ↔ Wacko Converter | Seamless format switching via toolbar. |
| Popup Forms | Guided modals for complex Links and Tables. |
| Toolbar Customization | Add/remove/reorder buttons via config. |
| Resizable Editor | Drag handle to adjust height. |

Dev Note: Complex legacy helpers (MarkUp, _LSum, _RSum, _TSum) have been refactored. Autocomplete selection bugs are fixed.


Security & Platform Hardening

  • Content Security Policy (CSP) Nonces: All inline scripts now use strict nonces.
  • Cookie Prefixes (RFC 6265bis): __Host- and __Secure- prefixes applied for session integrity.
  • Native Clipboard API: Removed Clipboard.js dependency; uses modern navigator.clipboard with robust fallback.
  • Fixed Invalid Selector Tokens: Patched potential broken "Copy to Clipboard" handlers.

Core Architecture & Routing

| Change | Impact |
| :--- | :--- |
| Virtual _ Handler Prefix | Handlers moved to page/_edit, page/_show, etc.
Fixes namespace collisions where user pages named Something/edit clashed with core handlers. |
| Composer vendor Folder | All external PHP libraries moved out of lib/ into vendor/ (managed via Composer). |
| Config Array Upgrade | Configuration updates now respect $wacko_config_defaults live, ignoring potentially stale cache. |
| TOC Generation Fix | $this->toc logic repaired for newly created pages. |


UI & Theming

  • Dark Mode: First-class support with OS detection (prefers-color-scheme) and manual toggle.
  • Double-Click Edit Comments: Rapid inline editing for comment sections.

Syntax & Markup Extensions

Phiki Highlighter (v2.2.0)

Replaces the legacy Pear highlighter. Fast, modern, supports 350+ languages via TextMate grammars.

Migration Required: Obsolete highlighters removed (css, ini, html, java, pascal, sql).
Action: Run the admin_replace action to auto-migrate:

%%(css)   →  %%(hl css)
%%(sql)   →  %%(hl sql)
... etc

Table Markup Improvements

New attribute system for rows, cells, and tables.

New Syntax:

!| col | col |!            # Header row with attributes
#|(attr=value)             # Row attributes

Supported Attributes:
| Attribute | Values | Scope |
| :--- | :--- | :--- |
| span | number | Cell/Colspan |
| side | top \| bottom | Header/Foot position |
| class | alternate, sticky, default[left\|center\|right...], colN[left\|right...], col-N[left\|right...] | Styling hooks |

CSS Selectors Added:

  • .alternate — Zebra striping
  • .sticky — Fixed header on scroll
  • .default[left|center|right|top|middle|bottom] — Global cell alignment
  • .colN[...] — Column N alignment (1–25)
  • .col-N[...] — Column N from right alignment (1–9)

Helper Functions

  • New table_attr() parser for the extended markup.
  • Wrapper page now accepts col option.

Internationalization (i18n)

New complete translations added:

  • 🇭🇷 Croatian (hr)
  • 🇹🇭 Thai (th)
  • 🇹🇷 Turkish (tr)
  • 🇻🇳 Vietnamese (vi)

Dependency Updates

| Library | Version | Status |
| :--- | :--- | :--- |
| Phiki | 2.2.0 | New (Replaces Pear) |
| Legacy Highlighters | — | Removed |


Upgrade Guide

  1. Run Composer: composer install --no-dev (populates vendor/).
  2. Run Migrations: Execute the installer script.
  3. Migrate Highlighters: Run the admin_replace action to convert %%(lang)%%(hl lang).
  4. Check Routes: If you have custom handlers or pages named edit, show, properties, etc., verify they resolve correctly under the new page/_* namespace.
  5. Clear Cache: Delete cache/config/ and cache/template/ (or run admincache action).
  6. Test CSP: Verify your web server passes the Content-Security-Policy header with nonces.

Credits

Huge thanks to contributors for the Phiki integration, the translation teams for HR/TH/TR/VI, and everyone testing the WikiEdit rewrite.


Full Changelog: https://github.com/WackoWiki/wackowiki/compare/6.2.1...6.3.0
Documentation: wackowiki.org

Breaking Changes

  • Removed legacy highlighter tags (css, ini, html, java, pascal, sql); migration required via `admin_replace` action.
  • Core handlers now use virtual `_` prefix namespace (`page/_edit`, `page/_show`, etc.), breaking pages named like `Something/edit` that clashed with core routes.

Security Fixes

  • Implemented CSP nonces for all inline scripts to enforce strict content security policy.
  • Applied `__Host-` and `__Secure-` cookie prefixes per RFC 6265bis for session integrity.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track WackoWiki

Get notified when new releases ship.

Sign up free

About WackoWiki

WackoWiki is a light and easy to install multilingual Wiki-engine.

All releases →

Related context

Related tools

Beta — feedback welcome: [email protected]