The latest version of mojoPortal is now available on GitHub!

We strongly recommend that everyone upgrade to this version of mojoPortal, as there were several important security fixes. 

Please note that all Commercial Add-Ons have corresponding releases and are required to support this release.

Security & Dependencies

• Security Enhancements:
  • Fixed an XSS vector in the Country List Administration page with the sort parameter.
  • Added password verification when assigning user roles (both on SecurityRoles and ManageUser pages), to prevent a content administrator from escalating their own account to admin.
  • Integrated the HtmlSanitize package/method into Core , StringExtensions , and input saving logic; added AppConfig controls to manage sanitization.
  • Sanitized incoming URLs in LinkBuilder  to prevent directory traversal.
  • Migrated from DotNetZip to DotNetZip.Original to prevent directory traversal.
• Dependency & Package Updates:
  • Database & Libraries: Updated MySQL.Data to 9.4.0 , SQLite to v3.53.2 (switched to x64), and Log4Net to 3.3.1 .
  • Framework / Packages: Removed AutoMapper and the Westwind library; added HtmlSanitize .

Search & Indexing Upgrades

• Search Infrastructure:
  • Converted Search Results and Search Controls to use Razor templating.
  • Added support for category indexing and searching (including Blog category search support).
  • Introduced an optional ItemImage property to the search index and added SKU querying on the search page.
  • Added a web.config option to disable NeatHtml in search results.
• Refactoring & Optimizations:
  • Cleaned up SearchIndex , IndexBrowser.aspx , and SearchResults.aspx .
  • Moved QueueIndexing from SiteUtils to IndexHelper .
  • Consolidated canIndex checks in HtmlContentIndexBuilderProvider .
  • Allowed specifying an alternate page for search indexers to treat as the location for SF module content.

Module Updates & Bug Fixes

• Blog:
  • Fixed broken category links, categories strings in business/edit logic, and added SQLite categories aggregate support.
  • Fixed issue where posts were not showing featured images in certain cases.
• SuperFlexi:
  • IndexItem now uses ModuleViewRoles.
  • Added FriendlyId to ModuleModel .
  • Made ModuleConfiguration.FeatureGuid public static.
  • Removed unused Edit2 page; added caching for generated classes.
• Forum & Calendar:
  • Fixed date calculation in Forum RSS feed for MySQL.
  • Removed unused PageIndex property from EventCalendar IndexBuilder.
• Core Systems & General Fixes:
  • Database/Data Access: Fixed a resource leak in GetUserLocation(Guid rowID) by properly closing the data reader; fixed issues in mp_UserRoles_SelectByUsername and SQLite GetRolesByUser scripts.
  • Routing & Multi-Tenancy: Created mojoPortal.Core.Configuration.MultiTenancy ; updated site matching logic to use siteId rather than hostname matching in mp_SiteHosts .
  • Workflow & UI: Fixed issue where deleting a user broke workflows; fixed avatar link producing duplicate class attributes.

Web, UI, & Developer Tooling

• Core Web Components:
  • Added CacheServiceContainer to handle clearing plugin caches when changing skin GUIDs.
  • Added DynamicTypeGenerator to build ad-hoc class types (with list property initialization), this is being leveraged by SuperFlexi to cache it's solutions.
  • Added UnitSeparatorExtensions and editorconfig to the project.
• Controls & Markup:
  • Module ID attributes now use a slugged version of the module title.
  • Added ability to attach custom attributes to script and style elements in .sfMarkup .
  • Updated SiteLabel to support child elements; added ControlAdapters for RadioButton , RadioButtonList , and CheckBoxList .
• Framework Bump: Updated Framework skin for mojo 3.0.0 and bumped AppCodeVersion to 3.0.0.

You can see the full changelog here.

We're happy to announce a new release of the mojoPortal Content Management System, version 2.9.2.

Please note that all Commercial Plugins have corresponding releases and are required to support this release.

Head over to our GitHub Releases Page to check it out.

General

• Removed unnecessary use of ForceSsl throughout the project
• Removed publish mode from Site Settings
• Some Help File cleanup
• Updated the mojoModalScript.js to allow use of any element as it's trigger
• Refactored the way roles are set up on new sites
• Setup now saves custom machine key to a file instead of to the web.config
• Cleaned up the "Social Links" SuperFlexi solution for better accessibility.

Bugfixes

• Fixed Web Forms issue where the default document would be empty, breaking the login and search modules on the home page
• Fixed issue where a blog post set to not index would break indexing for the entire blog
• Fixed issue where password salt would be saved to the password field
• Fixed issue with the RazorDropDownList where it would have to class attributes if you added CSS classes both on the control and programmatically
• Replaced use of deprecated escape and unescape with encodeURIComponent and decodeURIComponent in mojocombinedfull.js
• Fixed issue in SuperFlexi where exporting would not include any new fields if each previously saved item was not edited/updated/saved
• Fixed issue where the class building wasn't setting objects to the right type and to use the defaults with null values
• Fixed issue where mojo was doing a case sensitive match to a user's email, preventing users from getting their roles when logged in

Note: All commercial modules have been updated to support this release.

The latest official public release of the mojoPortal Content Management System, mojoPortal 2.9.1, is now available. 

Where to Get It?

Head over to our GitHub Releases Page. Please note that all Commercial Plugins have corresponding releases and are required to support this release.

What's New?

.NET Framework 4.8

We've updated mojoPortal to version 4.8 of .NET Framework for the latest security patches and performance updates.

We had considered going to version 4.8.1, but 4.8.1 only includes updates to the Windows UI and Windows Forms frameworks, and ARM64 support.

Since 4.8.1 doesn't offer mojoPortal any advantages and it would remove support for Windows Server 2019, we believe that version 4.8 is the best option for mojo.

OpenID Connect/OAuth

We've updated mojoPortal so that site owners can configure their sites with an OpenID Connect. See our documentation for setup information.

Compatible Identity Access Management providers are:

• Keycloak (i7MEDIA's current favorite)
• Microsoft Entra ID - coming soon
• Auth0 - coming soon
• Active Directory Federation Services - coming soon
• ForgeRock Identity Platform - coming soon
• etc.

This brings all the advantages of OpenID Connect to mojoPortal such as:

• Single Sign-On across multiple applications
• Two Factor Authentication
• Third Party (Social Media) logins
• and more

This update will remove the obsolete OpenID setup which relied on Janrain Engage. This service was no longer stable and extremely difficult to setup due to broken pages on the third party Janrain website. User accounts created using the old setup will be retained but users will need to request a password reset. The configuration tab under Site Setttings\3rd Party Auth is still available but is no longer used. It will be removed or repurposed in a future release.

SuperFlexi Social Links Solution

We added an option for the Nextdoor: Neighborhood Network social networking service to the Social Links solution.

Better OpenGraph Support

OpenGraph meta elements are now created for every page automatically.

Misc

• MySQL 8+ is now required for MySQL installations. If you are running an older version you can delete the contents of the 2.9.0.3 mojoportal-core upgrade script to make this version work with it. More changes will be made in future releases so you need to get your database environment upgraded ASAP.
• Added a way to configure the information for default admin account.
• Added "Restore Skins" and "Copy New Skins" buttons on the Site Settings page.
• Cleaned up the Setup page. Added context and some style. Still in need work.
• System Log download will use site name in filename.
• Contact Form: You can now select which Rich Text Editor you want to use for the Message field.
• Redirection to canonical preferred domain respects SSL settings.

Bug Fixes

• Fixed issue in the SkinConfig code that was causing the site to error at random times.
• The Avatar was not properly updating on the User Profile and Manage Users pages.
• The iFrame module had an issue where its module title wasn't using the same elements as every other module.
• Some skin file URLs were incorrect when using Folder based Multi-Tenancy.
• Ensure NeatHtml.js is loaded when using SanitizeHtml method.
• There was an issue with the browser being redirected to a secure connection from an insecure connection while using a Preferred Hostname not using it's Friendly URL.
• Turkey Standard Time was missing (thank you, otuncelli!).
• Fixed styling of LogLevel=FATAL messages (thank you, otuncelli).
• Fixed incorrect type checking in AuthHandlerHttpModule (thank you, otuncelli).
• The File Manager wasn't enforcing the .zip extension when using the Compress action.
• The File Service was unzipping files types that it should not have.
• The File Picker control in SuperFlexi would overwrite the file URL with a full path when editing an existing item.
• Sometime values wouldn't be properly converted when doing an import in SuperFlexi.
• Added validation to fields in several features.

Other Changes

• Deprecated FolderGallery feature. Users should switch to BetterImageGallery
• Removed obsolete HtmlView.aspx

Developer's Corner

• Added "textarea" option for ControlType in custom ModuleSettings
• Added RazorDropDownList control to support option groups
• Moved StringExtensions, StringHelper, and XMLHelper from mojoPortal.Web.Framework to mojoPortal.Core
• Added methods to get site specific web.config settings
• Removed ConfigHelper from mojoPortal.Web.Framework
• Added GlobalUsings to most projects
• Removed mojoPortal.Business.ImageHelper
• Consolidated Panel classes
• Removed several obsolete controls and classes
• Removed EmptyPanel usage in aspx and ascx files 
• Moved SMTP classes from mojoPortal.Net to mojoPortal.Web. Left namespaces as mojoPortal.Net.
• Removed mojoPortal.Net project.
• Added CollectionExtension class with ToDictionary and ToDelimitedString methods
• Consolidated ListExtensions and CollectionExtensions
• Added FileSystemHelper to make loading file system easier, less repeated code.
• Added RemovePunctuation to StringExtensions
• Added HashtableExtensions
• Added Union StringExtension
• Moved HtmlInclude to its own project under Solution Folder 'Plugins' as an example. May do the same with other features.
• Moved SuperFlexi to Plugins
• Added LinkBuilder string extension to help standardize and sanitize links 
• Moved RemoveMarkup and RemoveAngleBrackets from mojoProtal.Web.Framework to mojoPortal.Core.StringExtensions
• Switched to Newtonsoft.Json in StringHelper
• Replaced ContainsCaseInsensitive with Contains override method similar to .net core
• Added PageUrlService
• Added RoleStringHelper
• Refactored SiteLogo
• Replaced Ionic.Zip with DotNetZip
• Localized Email Test strings
• Made service used by QRCodeImage control configurable
• Added CustomCssClass setting to Child Page Site Map, Custom Menu, Recent Content, Sign In, and Site Search modules.
• Default Modal template is added to the body element if phSiteFooter isn't found.
• Changed modal script to use event delegation
• Added callback option to mojoModalScript.js
• Cleaned up Subkismet and SimpleMath captcha code and layout
• Changed Admin Menu to use JSON for extra menu items
• Cache Tool now clears HttpRuntime, TinyMCE caches

Skinning & Design

• New Menu Control supporting Razor/CSHTML Templating. Framework skin will use this control.
• Replaced failsafe layout.Master with framework
• Expanded skin config.json to support DisplaySettings and EditorConfigs
• Updated RSS Styling
• Help dialog now uses bootstrap CDN, it no longer uses the CSS Handler
• Removed obsolete controls, check "Upgrading Skins" documentation for more information.

We're very pleased to announce the official public release of the next version of the mojoPortal Content Management System, mojoPortal 2.9. This version is full of feature enhancements, usability improvements, and general bug fixes.

We've examined dependencies, upgraded packages, removed bloat, reorganized, and tested, tested, tested! Many highlights are outlined here and the changelog is at the bottom of the post. This is a production-ready release but, as with any system, we highly recommend users perform a full backup of their files and database before upgrading.

Where to Get It?

Head over to our GitHub Releases Page.

Version Number & Release Timeframe

You'll notice the last release was version 2.7 and this release is version 2.9. We've intentionally skipped version 2.8 because while it has been quite a while since our last public release of mojoPortal, we have indeed been working on mojoPortal. Version 2.8 has been in use for some time by many of our own customers and we have distributed it to many of our partners. The primary reason we never released 2.8 publicly is it did not support sqlite or pgsql. In fact, we contemplated dropping support for both of those database platforms but we decided to keep them because 1) we love pgsql and 2) the sqlite version of mojoPortal is more popular than the pgsql version. Admittedly, neither of those reasons are very good so there may come a time when we drop support for one or both of them.

NOTE We had to make a new release of 2.9 on June 20, 2023 because some files were missing from the original release files. There is no functional difference between these versions.

Highlights

• Google Analytics 4 Support
• hCaptcha Support. hCaptcha has feature parity with reCAPTCHA. Using one or other is as simple as selecting either one in Site Settings.
• Keyword Blacklist. Administrators can maintain a list of keywords and phrases which they want to block from being submitted on forms.
• Full Razor (cshtml) support in SuperFlexi
• Skin-based styles and templates which can be used by wysiwyg editors (ckEditor and TinyMCE)
• AirDatepicker replacement for jQuery and other datepickers by default.
• Homepage Override option (Site Settings > Advanced).  Forces selected page to be the homepage regardless of site menu structure.
• Custom Menu Feature allows menus to be created from Site Map data by choosing a starting page. Menu is built automatically. Menu Docs
• Custom SMTP Headers and SMTP testing tool. Email Docs
• Site-Wide head and foot content. Allows for adding any content to the head element or just above closing body element through Site Settings. Can be applied to all non-admin CMS pages or all admin pages. We don't like the name, suggest one in the forums.
• AjaxControlToolkit removed from base mojo, it is now only required for FormWizardPro.
• Security Advisor will now check for default admin account.
• SSL enforced for all pages when SSLIsAvailable = true
• Restart Application button in System Information
• Update Check in System Information

SuperFlexi

• Users can set the name of export files when exporting SuperFlexi data
• Items can be set with specific View and Edit roles
• Solutions using Razor can utilize built-in paging support
• Added PageSize module setting
• Can now set name of export file
• Can now use ViewRoles and EditRoles to control who can view and edit individual items.
• New Advanced File Picker for control types "imagePicker" and "linkPicker"

New SuperFlexi Solutions

• Quick Image 
• Cookie Consent

Blog

• Metadata editing is more user friendly
• No longer indexing blog posts that aren't published
• Fixed a bug where featured post could be set on unpublished posts
• HTML is no longer allowed in post subtitle.

Event Calendar (basic)

• Show Time option allows showing the time of events in the month view, uses "Short" time pattern
• Enable Map and Show Map allow showing a google map on the event detail page

Contact Form

• Keyword Blacklist support
• WYSIWYG is properly focused on label click and tab
• Removed "Use Input Address as From Address" because it will result in message being seen as SPAM.

Forum

• Prevent script from being added to forum title
• Moved post anchor in PostList to wrapping post div

Design/Skins

• CacheTool now clears the theme.skin cache when the skin version is updated
• Additional AdminDisplaySettings to site settings See Class on GitHub
• New SkinConfig feature.
• Razor for the MemberList and Admin menu pages
• CoreDisplaySettings class
  • using in login.aspx register.aspx pages
• CacheTool now clears 'theme.skin' cache
•  SkinVersionGuid is now reset during setup
• System content templates are no longer included by default.

Multi-Tenancy

• Host mappings are now cached, reducing trips to the db
• Root Site Admins can edit Site Closed message for all site

Development

• New Input types in ModuleSettings: Number, Color, Range, Password, Email
• New ToDataTable(this List<T> items) extension
• Moved custom MSSQL integer_list_tbltype type from SuperFlexi setup scripts to core setup scripts. No functional change.
• Added ShowInMenu and CssClass to SitemapJson Class
• New XMLHelper to standardize XML handling and security (GitHub)
• New Controller to fetch/update UserProfile information (GitHub)
• mojoButton now allows setting button so we can use "button" element
• Removed old scripts from ClientScript
• UIHelper.SetOrAppendCss now checks for class before adding it
• Added UIHelper.RemoveCss extension to WebControl
• Renamed CSVSplitter to SqlDataRecordList in MSSQL layer
• Added "replacement" option to RemoveLineBreaks string extension
• Added RemoveMultipleSpaces string extension
• Unified mojoMembershipProvider to one set of public virtual methods for all encoding & decoding functions
• Allow placing saltKey before or after password in mojoMembershipProvider
• Added PaymentGatewayType to PaymentGateways
• Removed obsolete FileDialog.aspx
• Updated and expanded existing but unused tagging system.
• New mojoPortal.Core project/namespace. Moving non-web functionality from mojoPortal.Web and mojoPortal.WebFramework here.
• DialogBasePage now inherits from mojoBasePage

Security

• All pages now force SSL by default when SSLIsAvailable.
• ForceSSL checks to see if SSLIsAvailable and only forces SSL if it is, making other code simpler because one no longer needs to check SSLIsAvailable before calling ForceSSL
• Fixed Issue with Azure not recognizing the SSL correctly
• Added UseHSTSHeader web.config property to allow server to manage HSTS headers
• Added HSTSHeaders web.config property and replaced hard-coded values with its value. Default is "max-age: 63072000;"
• Scripts are now stripped from uploaded XML files

Role Manager

• Added Display Name, System Name and Descriptions to Roles. System Name cannot be changed but Display Name can.
  • Updated code in Roles to use the Display Name when creating roles during setup and simplified the code for listing the roles in module settings
• Fixed issue with roles being escalated to full administrators

Core

• Default MachineKey now uses HMACSHA256/3DES. Reminder: People should really create their own MachineKey
• Changing terminology from "MultipleSites" to "Multi-Tenancy"
• Replaced jcrop with cropperjs
• Allow Google Translate on SSL pages
• Updated to sqlite3
• Removed MediaElementJS, we now only rely on html5 controls
• Keyword Blacklist support in Internal Comments system
• No longer loading contents of register page when it is redirecting elsewhere
• Added "data-loader" data attributes to script elements to aid in troubleshooting
• Automatically localized AirDatepicker
• Removed many obsolete 3rd party tools
  • websnapr, flash, qtfile, impromptu, sizzle, SiteOffice, ImageFit, ClueTip, MarkItUp, YahooMediaPlayer, FlickrGallery, Yui, greybox, dotLess, SilverLight
• Removed PasswordStrengthMeter and mojoRating
• StaticFileExtensions are configurable through StaticFileExtensions web.config property
• Standardized id="Html" on html elemnt for adding lang and dir attributes
• Made supportedDatabases check case insensitive in setup
• hCaptcha/reCAPTCHA url and other settings are now configurable.
• Fix issue with NeatHTML preventing Search Results from displaying in Firefox
• Fixed "User Folder" (My Files) in File Manager
• Added .webmanifest mime type to web.config.
• Increased default folder and file upload limits
• Removed fieldset element from several forms
• Usability improvements to ManageUsers.aspx when managing deleted users
• IndexBrowser now included under Administration/Advanced Tools
• Added search function to redirect management page
• Implement CSHTML for Newsletter Admin and AdminMenu pages

WANT MORE? A more detailed list of changes is available with this release on GitHub and through a comparison of v.2.7 to v.2.9.