This release is now available at GitHub.

We strongly recommend that everyone upgrade to this version, for security and quality of life updates.

Security Enhancements

• Skin Uploading Removed: Disabled skin uploads via both the web and UI to prevent malicious code execution in uploaded skins.
• Directory Protection: Prevented script execution within the Data directory.
• Metaweblog Disabled: Web services now disable Metaweblog by default and return a 404 error when disabled.

Bug Fixes & Stability

• Footer Placeholder Resilience: Fixed a critical bug where missing the phSiteFooter placeholder in a skin would crash the site—the placeholder is now optional.
• Configuration & Scripts: Resolved issues fetching style.config  in the StyleSheetCombiner, and corrected a method name in mojoModalScript.js .
• Database Queries: Fixed an issue causing errors with single blog queries.

You can see the full changelog here.

The latest version of mojoPortal is now available on GitHub!

We strongly recommend that everyone upgrade to this version of mojoPortal, as there were several important security fixes. 

Please note that all Commercial Add-Ons have corresponding releases and are required to support this release.

Security & Dependencies

• Security Enhancements:
  • Fixed an XSS vector in the Country List Administration page with the sort parameter.
  • Added password verification when assigning user roles (both on SecurityRoles and ManageUser pages), to prevent a content administrator from escalating their own account to admin.
  • Integrated the HtmlSanitize package/method into Core , StringExtensions , and input saving logic; added AppConfig controls to manage sanitization.
  • Sanitized incoming URLs in LinkBuilder  to prevent directory traversal.
  • Migrated from DotNetZip to DotNetZip.Original to prevent directory traversal.
• Dependency & Package Updates:
  • Database & Libraries: Updated MySQL.Data to 9.4.0 , SQLite to v3.53.2 (switched to x64), and Log4Net to 3.3.1 .
  • Framework / Packages: Removed AutoMapper and the Westwind library; added HtmlSanitize .

Search & Indexing Upgrades

• Search Infrastructure:
  • Converted Search Results and Search Controls to use Razor templating.
  • Added support for category indexing and searching (including Blog category search support).
  • Introduced an optional ItemImage property to the search index and added SKU querying on the search page.
  • Added a web.config option to disable NeatHtml in search results.
• Refactoring & Optimizations:
  • Cleaned up SearchIndex , IndexBrowser.aspx , and SearchResults.aspx .
  • Moved QueueIndexing from SiteUtils to IndexHelper .
  • Consolidated canIndex checks in HtmlContentIndexBuilderProvider .
  • Allowed specifying an alternate page for search indexers to treat as the location for SF module content.

Module Updates & Bug Fixes

• Blog:
  • Fixed broken category links, categories strings in business/edit logic, and added SQLite categories aggregate support.
  • Fixed issue where posts were not showing featured images in certain cases.
• SuperFlexi:
  • IndexItem now uses ModuleViewRoles.
  • Added FriendlyId to ModuleModel .
  • Made ModuleConfiguration.FeatureGuid public static.
  • Removed unused Edit2 page; added caching for generated classes.
• Forum & Calendar:
  • Fixed date calculation in Forum RSS feed for MySQL.
  • Removed unused PageIndex property from EventCalendar IndexBuilder.
• Core Systems & General Fixes:
  • Database/Data Access: Fixed a resource leak in GetUserLocation(Guid rowID) by properly closing the data reader; fixed issues in mp_UserRoles_SelectByUsername and SQLite GetRolesByUser scripts.
  • Routing & Multi-Tenancy: Created mojoPortal.Core.Configuration.MultiTenancy ; updated site matching logic to use siteId rather than hostname matching in mp_SiteHosts .
  • Workflow & UI: Fixed issue where deleting a user broke workflows; fixed avatar link producing duplicate class attributes.

Web, UI, & Developer Tooling

• Core Web Components:
  • Added CacheServiceContainer to handle clearing plugin caches when changing skin GUIDs.
  • Added DynamicTypeGenerator to build ad-hoc class types (with list property initialization), this is being leveraged by SuperFlexi to cache it's solutions.
  • Added UnitSeparatorExtensions and editorconfig to the project.
• Controls & Markup:
  • Module ID attributes now use a slugged version of the module title.
  • Added ability to attach custom attributes to script and style elements in .sfMarkup .
  • Updated SiteLabel to support child elements; added ControlAdapters for RadioButton , RadioButtonList , and CheckBoxList .
• Framework Bump: Updated Framework skin for mojo 3.0.0 and bumped AppCodeVersion to 3.0.0.

You can see the full changelog here.

Since 2004, mojoPortal has been committed to being accessible to all people. That's not always an easy task because there are many components of websites that just don't work well for some people with some disabilities. We also can't ensure that everyone who builds a site on mojoPortal makes the necessary effort to structure their content to make sure it is fully accessible. So, we've partnered with accessiBe, the leader in AI Solutions for Web Accessibility & ADA Compliance. With this partnership, mojoPortal will earn a little cash for each purchase made via our partner link, but that's not why we're partnering with accessiBe. We're partnering with accessiBe because it is simply the easiest and most complete accessibility platform on the market.

Hundreds of thousands of websites use accessiBe to help with ADA compliance and web accessibility, so with mojoPortal, you have a Bonafide system in place to help you make your mojoPortal site perfect for everyone!

Benefits & value for your site:

• Fully automated remediation within 48 hours
• Visible accessibility statement on site
• 24-hour automated ongoing compliance scans
• Monthly accessibility audit sent to the inbox
• Extension of market reach
• Enhancement of brand reputation

Integrating mojoPortal with accessiBe

It is super easy to integrate your mojoPortal site with accessiBe. All you need to do is copy the accessWidget that accessiBe gives you to the "Custom Content" section of Site Settings, click the Save button and you're done! Here's a screenshot of the area in Site Settings:

Get Started with accessiBe Today!

Integrating mojoPortal with accessiBe is a game-changer in web accessibility, simplifying and streamlining the process of becoming accessible and compliant using AI, machine learning, and computer vision.

Get started now!

We're happy to announce a new release of the mojoPortal Content Management System, version 2.9.2.

Please note that all Commercial Plugins have corresponding releases and are required to support this release.

Head over to our GitHub Releases Page to check it out.

General

• Removed unnecessary use of ForceSsl throughout the project
• Removed publish mode from Site Settings
• Some Help File cleanup
• Updated the mojoModalScript.js to allow use of any element as it's trigger
• Refactored the way roles are set up on new sites
• Setup now saves custom machine key to a file instead of to the web.config
• Cleaned up the "Social Links" SuperFlexi solution for better accessibility.

Bugfixes

• Fixed Web Forms issue where the default document would be empty, breaking the login and search modules on the home page
• Fixed issue where a blog post set to not index would break indexing for the entire blog
• Fixed issue where password salt would be saved to the password field
• Fixed issue with the RazorDropDownList where it would have to class attributes if you added CSS classes both on the control and programmatically
• Replaced use of deprecated escape and unescape with encodeURIComponent and decodeURIComponent in mojocombinedfull.js
• Fixed issue in SuperFlexi where exporting would not include any new fields if each previously saved item was not edited/updated/saved
• Fixed issue where the class building wasn't setting objects to the right type and to use the defaults with null values
• Fixed issue where mojo was doing a case sensitive match to a user's email, preventing users from getting their roles when logged in

Note: All commercial modules have been updated to support this release.

The latest official public release of the mojoPortal Content Management System, mojoPortal 2.9.1, is now available. 

Where to Get It?

Head over to our GitHub Releases Page. Please note that all Commercial Plugins have corresponding releases and are required to support this release.

What's New?

.NET Framework 4.8

We've updated mojoPortal to version 4.8 of .NET Framework for the latest security patches and performance updates.

We had considered going to version 4.8.1, but 4.8.1 only includes updates to the Windows UI and Windows Forms frameworks, and ARM64 support.

Since 4.8.1 doesn't offer mojoPortal any advantages and it would remove support for Windows Server 2019, we believe that version 4.8 is the best option for mojo.

OpenID Connect/OAuth

We've updated mojoPortal so that site owners can configure their sites with an OpenID Connect. See our documentation for setup information.

Compatible Identity Access Management providers are:

• Keycloak (i7MEDIA's current favorite)
• Microsoft Entra ID - coming soon
• Auth0 - coming soon
• Active Directory Federation Services - coming soon
• ForgeRock Identity Platform - coming soon
• etc.

This brings all the advantages of OpenID Connect to mojoPortal such as:

• Single Sign-On across multiple applications
• Two Factor Authentication
• Third Party (Social Media) logins
• and more

This update will remove the obsolete OpenID setup which relied on Janrain Engage. This service was no longer stable and extremely difficult to setup due to broken pages on the third party Janrain website. User accounts created using the old setup will be retained but users will need to request a password reset. The configuration tab under Site Setttings\3rd Party Auth is still available but is no longer used. It will be removed or repurposed in a future release.

SuperFlexi Social Links Solution

We added an option for the Nextdoor: Neighborhood Network social networking service to the Social Links solution.

Better OpenGraph Support

OpenGraph meta elements are now created for every page automatically.

Misc

• MySQL 8+ is now required for MySQL installations. If you are running an older version you can delete the contents of the 2.9.0.3 mojoportal-core upgrade script to make this version work with it. More changes will be made in future releases so you need to get your database environment upgraded ASAP.
• Added a way to configure the information for default admin account.
• Added "Restore Skins" and "Copy New Skins" buttons on the Site Settings page.
• Cleaned up the Setup page. Added context and some style. Still in need work.
• System Log download will use site name in filename.
• Contact Form: You can now select which Rich Text Editor you want to use for the Message field.
• Redirection to canonical preferred domain respects SSL settings.

Bug Fixes

• Fixed issue in the SkinConfig code that was causing the site to error at random times.
• The Avatar was not properly updating on the User Profile and Manage Users pages.
• The iFrame module had an issue where its module title wasn't using the same elements as every other module.
• Some skin file URLs were incorrect when using Folder based Multi-Tenancy.
• Ensure NeatHtml.js is loaded when using SanitizeHtml method.
• There was an issue with the browser being redirected to a secure connection from an insecure connection while using a Preferred Hostname not using it's Friendly URL.
• Turkey Standard Time was missing (thank you, otuncelli!).
• Fixed styling of LogLevel=FATAL messages (thank you, otuncelli).
• Fixed incorrect type checking in AuthHandlerHttpModule (thank you, otuncelli).
• The File Manager wasn't enforcing the .zip extension when using the Compress action.
• The File Service was unzipping files types that it should not have.
• The File Picker control in SuperFlexi would overwrite the file URL with a full path when editing an existing item.
• Sometime values wouldn't be properly converted when doing an import in SuperFlexi.
• Added validation to fields in several features.

Other Changes

• Deprecated FolderGallery feature. Users should switch to BetterImageGallery
• Removed obsolete HtmlView.aspx

Developer's Corner

• Added "textarea" option for ControlType in custom ModuleSettings
• Added RazorDropDownList control to support option groups
• Moved StringExtensions, StringHelper, and XMLHelper from mojoPortal.Web.Framework to mojoPortal.Core
• Added methods to get site specific web.config settings
• Removed ConfigHelper from mojoPortal.Web.Framework
• Added GlobalUsings to most projects
• Removed mojoPortal.Business.ImageHelper
• Consolidated Panel classes
• Removed several obsolete controls and classes
• Removed EmptyPanel usage in aspx and ascx files 
• Moved SMTP classes from mojoPortal.Net to mojoPortal.Web. Left namespaces as mojoPortal.Net.
• Removed mojoPortal.Net project.
• Added CollectionExtension class with ToDictionary and ToDelimitedString methods
• Consolidated ListExtensions and CollectionExtensions
• Added FileSystemHelper to make loading file system easier, less repeated code.
• Added RemovePunctuation to StringExtensions
• Added HashtableExtensions
• Added Union StringExtension
• Moved HtmlInclude to its own project under Solution Folder 'Plugins' as an example. May do the same with other features.
• Moved SuperFlexi to Plugins
• Added LinkBuilder string extension to help standardize and sanitize links 
• Moved RemoveMarkup and RemoveAngleBrackets from mojoProtal.Web.Framework to mojoPortal.Core.StringExtensions
• Switched to Newtonsoft.Json in StringHelper
• Replaced ContainsCaseInsensitive with Contains override method similar to .net core
• Added PageUrlService
• Added RoleStringHelper
• Refactored SiteLogo
• Replaced Ionic.Zip with DotNetZip
• Localized Email Test strings
• Made service used by QRCodeImage control configurable
• Added CustomCssClass setting to Child Page Site Map, Custom Menu, Recent Content, Sign In, and Site Search modules.
• Default Modal template is added to the body element if phSiteFooter isn't found.
• Changed modal script to use event delegation
• Added callback option to mojoModalScript.js
• Cleaned up Subkismet and SimpleMath captcha code and layout
• Changed Admin Menu to use JSON for extra menu items
• Cache Tool now clears HttpRuntime, TinyMCE caches

Skinning & Design

• New Menu Control supporting Razor/CSHTML Templating. Framework skin will use this control.
• Replaced failsafe layout.Master with framework
• Expanded skin config.json to support DisplaySettings and EditorConfigs
• Updated RSS Styling
• Help dialog now uses bootstrap CDN, it no longer uses the CSS Handler
• Removed obsolete controls, check "Upgrading Skins" documentation for more information.