RaxBoard Core — Core
A new release is now available on the RaxBoard Marketplace.
Version: 1.8.5 (build 20260902)
Compatibility: RaxBoard >=1.0.0
What's new
# RaxBoard 1.8.5 (build 20260902)
A security and feature release built around customer feedback. Upgrading is recommended.
## Security
**Unmapped admin pages were reachable by any limited admin.** The admin area registry allows any `/admin/*` path that resolves to no known section — documented behaviour, but twelve routes had never been mapped. The sharp one was `/admin/api-keys`: the controller carried no permission check of its own, and its create action accepted an arbitrary `username` as the key owner while the scope list includes the wildcard `*`. An administrator granted only, say, the smilies section could mint a REST token acting as the super admin. The cosmetic page map already knew this screen; the security map did not. All twelve paths are now mapped, key creation for another account is restricted to full administrators, and the sign-in screen stays deliberately open.
**The contact form was an unauthenticated mail endpoint with no rate limit.** `/contact/send` appeared in none of the throttle layers. It is now limited to five submissions per fifteen minutes, keyed by IP and email address.
## New
**FAQ editor — Admin → FAQ.** Frequently asked questions were editable only as raw JSON inside a textarea on the general options page. There is now a dedicated screen with a row per question, ordering, and add/remove — with the raw JSON preserved in a collapsible panel for anyone who prefers it. Everything works without JavaScript: rows are server-rendered, "add" is a submit button, removing an entry means clearing it and saving, and ordering is a plain number field.
Moving the key off the options page has a second benefit. That page is a single form with roughly 315 fields validated all-or-nothing, so one malformed character in the FAQ JSON aborted the entire save and silently discarded every other unsaved edit. The options screen now restores what you typed when a save fails, and names the field that caused it.
**Custom pages.** Pages already existed in substance — slug routing, per-language translations, an icon, an active flag and a write-time HTML sanitiser — but there was no way to say "this row is a standalone page, not a help article". A page type now separates them: a page is served at `/pages/{slug}`, stays out of the help centre and its sidebar, and a help article no longer answers on the page URL. A meta description field was added for search engines.
Related fix: `/pages/{anything}` used to answer `200` with an empty shell. That soft 404 invited search engines to index invented URLs; it now returns a real 404.
**Contact page intro text.** The contact page rendered an empty bordered card when the board had no contact content — visible to every visitor. The card now holds an admin-editable introduction (Admin → Options → General), falls back to a translated default, and disappears entirely when both are empty rather than rendering as an empty box.
**CAPTCHA on the contact form.** The existing three-provider CAPTCHA subsystem (reCAPTCHA, hCaptcha, Turnstile) gained a contact scope, shown to guests only and switched on by default. Boards with no provider configured are unaffected — the check fails open, exactly as it does for the other scopes.
## Improved
**Help centre layout.** Help entries were rendered with the profile "About" key-value table primitive, which in six of the seven shipped themes is a narrow two-column grid at 13px, flattened to full-width strips by a later rule. The icon had no tile or size anywhere except one theme. Help entries now use their own card grid with a proper icon tile and a coloured accent, defined in core CSS so every theme inherits it. Aslitium, which already ships its own help card design, is left untouched.
Also fixed on that page: excerpts were double-escaped, so a seeded HTML entity printed literally as `—` instead of an em dash.
## Fixed
- Add-on upgrades no longer overwrite translations edited in Admin → Languages. Phrase seeding on upgrade now inserts new keys and leaves existing rows alone; a fresh install still seeds everything. Every bundled add-on was updated to the new contract.
- The HTML sanitiser used for page content now decodes entities before checking link protocols, closing a bypass where `javascript:` and similar encodings passed through.
- The guest-post CAPTCHA option had no translated label or description and rendered as a raw key in the options screen.
## Database
Six new migrations: **1071** admin section phrases · **1072** FAQ admin section · **1073** contact intro and empty-card fix · **1074** contact CAPTCHA · **1075** help layout across all styles · **1076** page type, content format and meta description on pages.
Get it
View on the Marketplace
— Posted automatically by the RaxBoard Marketplace.
