This release is now available at GitHub.

We strongly recommend that everyone upgrade to this version, for security and quality of life updates.

Security Enhancements

• Skin Uploading Removed: Disabled skin uploads via both the web and UI to prevent malicious code execution in uploaded skins.
• Directory Protection: Prevented script execution within the Data directory.
• Metaweblog Disabled: Web services now disable Metaweblog by default and return a 404 error when disabled.

Bug Fixes & Stability

• Footer Placeholder Resilience: Fixed a critical bug where missing the phSiteFooter placeholder in a skin would crash the site—the placeholder is now optional.
• Configuration & Scripts: Resolved issues fetching style.config  in the StyleSheetCombiner, and corrected a method name in mojoModalScript.js .
• Database Queries: Fixed an issue causing errors with single blog queries.

You can see the full changelog here.

The latest version of mojoPortal is now available on GitHub!

We strongly recommend that everyone upgrade to this version of mojoPortal, as there were several important security fixes. 

Please note that all Commercial Add-Ons have corresponding releases and are required to support this release.

Security & Dependencies

• Security Enhancements:
  • Fixed an XSS vector in the Country List Administration page with the sort parameter.
  • Added password verification when assigning user roles (both on SecurityRoles and ManageUser pages), to prevent a content administrator from escalating their own account to admin.
  • Integrated the HtmlSanitize package/method into Core , StringExtensions , and input saving logic; added AppConfig controls to manage sanitization.
  • Sanitized incoming URLs in LinkBuilder  to prevent directory traversal.
  • Migrated from DotNetZip to DotNetZip.Original to prevent directory traversal.
• Dependency & Package Updates:
  • Database & Libraries: Updated MySQL.Data to 9.4.0 , SQLite to v3.53.2 (switched to x64), and Log4Net to 3.3.1 .
  • Framework / Packages: Removed AutoMapper and the Westwind library; added HtmlSanitize .

Search & Indexing Upgrades

• Search Infrastructure:
  • Converted Search Results and Search Controls to use Razor templating.
  • Added support for category indexing and searching (including Blog category search support).
  • Introduced an optional ItemImage property to the search index and added SKU querying on the search page.
  • Added a web.config option to disable NeatHtml in search results.
• Refactoring & Optimizations:
  • Cleaned up SearchIndex , IndexBrowser.aspx , and SearchResults.aspx .
  • Moved QueueIndexing from SiteUtils to IndexHelper .
  • Consolidated canIndex checks in HtmlContentIndexBuilderProvider .
  • Allowed specifying an alternate page for search indexers to treat as the location for SF module content.

Module Updates & Bug Fixes

• Blog:
  • Fixed broken category links, categories strings in business/edit logic, and added SQLite categories aggregate support.
  • Fixed issue where posts were not showing featured images in certain cases.
• SuperFlexi:
  • IndexItem now uses ModuleViewRoles.
  • Added FriendlyId to ModuleModel .
  • Made ModuleConfiguration.FeatureGuid public static.
  • Removed unused Edit2 page; added caching for generated classes.
• Forum & Calendar:
  • Fixed date calculation in Forum RSS feed for MySQL.
  • Removed unused PageIndex property from EventCalendar IndexBuilder.
• Core Systems & General Fixes:
  • Database/Data Access: Fixed a resource leak in GetUserLocation(Guid rowID) by properly closing the data reader; fixed issues in mp_UserRoles_SelectByUsername and SQLite GetRolesByUser scripts.
  • Routing & Multi-Tenancy: Created mojoPortal.Core.Configuration.MultiTenancy ; updated site matching logic to use siteId rather than hostname matching in mp_SiteHosts .
  • Workflow & UI: Fixed issue where deleting a user broke workflows; fixed avatar link producing duplicate class attributes.

Web, UI, & Developer Tooling

• Core Web Components:
  • Added CacheServiceContainer to handle clearing plugin caches when changing skin GUIDs.
  • Added DynamicTypeGenerator to build ad-hoc class types (with list property initialization), this is being leveraged by SuperFlexi to cache it's solutions.
  • Added UnitSeparatorExtensions and editorconfig to the project.
• Controls & Markup:
  • Module ID attributes now use a slugged version of the module title.
  • Added ability to attach custom attributes to script and style elements in .sfMarkup .
  • Updated SiteLabel to support child elements; added ControlAdapters for RadioButton , RadioButtonList , and CheckBoxList .
• Framework Bump: Updated Framework skin for mojo 3.0.0 and bumped AppCodeVersion to 3.0.0.

You can see the full changelog here.

Since 2004, mojoPortal has been committed to being accessible to all people. That's not always an easy task because there are many components of websites that just don't work well for some people with some disabilities. We also can't ensure that everyone who builds a site on mojoPortal makes the necessary effort to structure their content to make sure it is fully accessible. So, we've partnered with accessiBe, the leader in AI Solutions for Web Accessibility & ADA Compliance. With this partnership, mojoPortal will earn a little cash for each purchase made via our partner link, but that's not why we're partnering with accessiBe. We're partnering with accessiBe because it is simply the easiest and most complete accessibility platform on the market.

Hundreds of thousands of websites use accessiBe to help with ADA compliance and web accessibility, so with mojoPortal, you have a Bonafide system in place to help you make your mojoPortal site perfect for everyone!

Benefits & value for your site:

• Fully automated remediation within 48 hours
• Visible accessibility statement on site
• 24-hour automated ongoing compliance scans
• Monthly accessibility audit sent to the inbox
• Extension of market reach
• Enhancement of brand reputation

Integrating mojoPortal with accessiBe

It is super easy to integrate your mojoPortal site with accessiBe. All you need to do is copy the accessWidget that accessiBe gives you to the "Custom Content" section of Site Settings, click the Save button and you're done! Here's a screenshot of the area in Site Settings:

Get Started with accessiBe Today!

Integrating mojoPortal with accessiBe is a game-changer in web accessibility, simplifying and streamlining the process of becoming accessible and compliant using AI, machine learning, and computer vision.

Get started now!

We're happy to announce a new release of the mojoPortal Content Management System, version 2.9.2.

Please note that all Commercial Plugins have corresponding releases and are required to support this release.

Head over to our GitHub Releases Page to check it out.

General

• Removed unnecessary use of ForceSsl throughout the project
• Removed publish mode from Site Settings
• Some Help File cleanup
• Updated the mojoModalScript.js to allow use of any element as it's trigger
• Refactored the way roles are set up on new sites
• Setup now saves custom machine key to a file instead of to the web.config
• Cleaned up the "Social Links" SuperFlexi solution for better accessibility.

Bugfixes

• Fixed Web Forms issue where the default document would be empty, breaking the login and search modules on the home page
• Fixed issue where a blog post set to not index would break indexing for the entire blog
• Fixed issue where password salt would be saved to the password field
• Fixed issue with the RazorDropDownList where it would have to class attributes if you added CSS classes both on the control and programmatically
• Replaced use of deprecated escape and unescape with encodeURIComponent and decodeURIComponent in mojocombinedfull.js
• Fixed issue in SuperFlexi where exporting would not include any new fields if each previously saved item was not edited/updated/saved
• Fixed issue where the class building wasn't setting objects to the right type and to use the defaults with null values
• Fixed issue where mojo was doing a case sensitive match to a user's email, preventing users from getting their roles when logged in

Note: All commercial modules have been updated to support this release.