The latest version of mojoPortal is now available on GitHub!

We strongly recommend that everyone upgrade to this version of mojoPortal, as there were several important security fixes. 

Please note that all Commercial Add-Ons have corresponding releases and are required to support this release.

Security & Dependencies

• Security Enhancements:
  • Fixed an XSS vector in the Country List Administration page with the sort parameter.
  • Added password verification when assigning user roles (both on SecurityRoles and ManageUser pages), to prevent a content administrator from escalating their own account to admin.
  • Integrated the HtmlSanitize package/method into Core , StringExtensions , and input saving logic; added AppConfig controls to manage sanitization.
  • Sanitized incoming URLs in LinkBuilder  to prevent directory traversal.
  • Migrated from DotNetZip to DotNetZip.Original to prevent directory traversal.
• Dependency & Package Updates:
  • Database & Libraries: Updated MySQL.Data to 9.4.0 , SQLite to v3.53.2 (switched to x64), and Log4Net to 3.3.1 .
  • Framework / Packages: Removed AutoMapper and the Westwind library; added HtmlSanitize .

Search & Indexing Upgrades

• Search Infrastructure:
  • Converted Search Results and Search Controls to use Razor templating.
  • Added support for category indexing and searching (including Blog category search support).
  • Introduced an optional ItemImage property to the search index and added SKU querying on the search page.
  • Added a web.config option to disable NeatHtml in search results.
• Refactoring & Optimizations:
  • Cleaned up SearchIndex , IndexBrowser.aspx , and SearchResults.aspx .
  • Moved QueueIndexing from SiteUtils to IndexHelper .
  • Consolidated canIndex checks in HtmlContentIndexBuilderProvider .
  • Allowed specifying an alternate page for search indexers to treat as the location for SF module content.

Module Updates & Bug Fixes

• Blog:
  • Fixed broken category links, categories strings in business/edit logic, and added SQLite categories aggregate support.
  • Fixed issue where posts were not showing featured images in certain cases.
• SuperFlexi:
  • IndexItem now uses ModuleViewRoles.
  • Added FriendlyId to ModuleModel .
  • Made ModuleConfiguration.FeatureGuid public static.
  • Removed unused Edit2 page; added caching for generated classes.
• Forum & Calendar:
  • Fixed date calculation in Forum RSS feed for MySQL.
  • Removed unused PageIndex property from EventCalendar IndexBuilder.
• Core Systems & General Fixes:
  • Database/Data Access: Fixed a resource leak in GetUserLocation(Guid rowID) by properly closing the data reader; fixed issues in mp_UserRoles_SelectByUsername and SQLite GetRolesByUser scripts.
  • Routing & Multi-Tenancy: Created mojoPortal.Core.Configuration.MultiTenancy ; updated site matching logic to use siteId rather than hostname matching in mp_SiteHosts .
  • Workflow & UI: Fixed issue where deleting a user broke workflows; fixed avatar link producing duplicate class attributes.

Web, UI, & Developer Tooling

• Core Web Components:
  • Added CacheServiceContainer to handle clearing plugin caches when changing skin GUIDs.
  • Added DynamicTypeGenerator to build ad-hoc class types (with list property initialization), this is being leveraged by SuperFlexi to cache it's solutions.
  • Added UnitSeparatorExtensions and editorconfig to the project.
• Controls & Markup:
  • Module ID attributes now use a slugged version of the module title.
  • Added ability to attach custom attributes to script and style elements in .sfMarkup .
  • Updated SiteLabel to support child elements; added ControlAdapters for RadioButton , RadioButtonList , and CheckBoxList .
• Framework Bump: Updated Framework skin for mojo 3.0.0 and bumped AppCodeVersion to 3.0.0.

You can see the full changelog here.