# CPalius CMF 2.0.4

**Released:** 2026-09-18 · **Channel:** stable · **Critical:** no

Turkish: [2.0.4-tr.md](2.0.4-tr.md)

This release carries everything since 2.0.1. Versions 2.0.2 and 2.0.3 were
tagged in the source repository but never published here, so if your panel has
been reporting 2.0.1 as the newest version, this update brings you the private
messaging module and the forum fixes from those two versions as well.

## What's new

**Maintenance mode now actually does something.** The switch has existed in
Settings for a long time, but nothing ever read it — turning it on left the site
wide open. It now serves a maintenance page to visitors, with a heading and a
message you write yourself, in every language your site has. Staff keep full
access, and the panel and login pages stay reachable so you can never lock
yourself out. The page answers with HTTP 503 and a Retry-After header, which
tells search engines the downtime is temporary and protects your existing
rankings.

**Your own mail templates, sent by hand.** Until now the mail template screen
only let you rewrite the mails CPalius sends by itself. You can now create your
own template, write it in each language, and send it from the panel to one
member, to everyone with a given role, or to every active member. Sends are
queued rather than fired off in one go, and each recipient gets the mail in
their own language with their own details filled in. Inactive and banned
accounts are skipped, and a single send is capped at 2000 recipients.

**The cron URL is finally on the screen.** CPalius has always had an HTTP cron
endpoint, but the panel never showed its address — so a very common outcome was
an installation where nothing scheduled ever ran and nobody could see why.
Automation → Cron now shows the exact URL to paste into your hosting panel, a
ready-made crontab line, and the command to use if you have SSH.

**Scheduled tasks are yours to schedule.** Tasks that ship with CPalius and its
modules used to carry a fixed schedule baked into the source. You can now change
when each one runs, and switch any of them off, from the same screen. Your
choice is stored separately from the code, so an update cannot quietly undo it,
and a "reset to default" button is there when you want the shipped schedule
back.

**Forum mentions that work like you expect.** Typing `@` in the composer now
suggests members as you type, so you stop guessing at spellings. A posted
mention is a link to that member's profile — including in older posts, which are
linked as they are displayed. Hovering a mention opens a small card with their
avatar, title, post count and join date, and a button through to the full
profile.

**Referring to an earlier post.** Writing `#3` in a reply now links to the third
post of that topic, and hovering it shows who wrote it, when, and the opening of
what they said. Readers no longer have to leave page 10 to see what page 1 said.

**Quote only what you are answering.** Select any part of a post and a small bar
appears offering to quote just that selection, or add it to a multi-quote. The
existing per-post Quote button is unchanged.

**A richer post editor.** Headings, five text sizes, six text colours and four
highlight colours have been added to the forum toolbar. The colours are a fixed
palette taken from your theme rather than a free colour picker — which means a
post can never come out unreadable against your forum background, and colours
stay right if you change theme.

**The postbit is yours to arrange.** Studio → Forum → Postbit lets you choose
which blocks appear in the author column beside each post — avatar, name, custom
title, topic-starter badge, rank, counters, join date, module buttons — and in
what order. There is a custom CSS box for styling beyond that. The avatar and
the username cannot both be hidden, so a post is always attributable.

**Blog related posts moved and became configurable.** The related-posts list has
moved out of the sidebar to a full-width section below the comments, where it
can show covers and excerpts. Studio now controls whether it appears, its
heading, how many posts it shows, and where they come from: the post's own
category, posts sharing its tags, a category you pick, or simply the newest
posts.

## Fixes

**Telemetry and log entries are no longer lost.** Scanner and bot traffic often
carries bytes that are not valid UTF-8. Any request containing them failed to
save — so the security events most worth recording were exactly the ones being
dropped, and the only trace was a "Telemetry log write failed" warning. Such
requests are now recorded, with the malformed bytes cleaned up.

**A failed log write no longer takes the rest of the batch with it.** The same
malformed input could abort a whole batch of pending log entries, silently
losing the unrelated ones behind it.

**The private messages settings screen no longer errors.** Opening Studio →
Messages → Settings produced a fatal error in 2.0.2. This was fixed in 2.0.3,
which was never published; it reaches you here.

## Upgrade notes

**Two new tables are created for you.** This release stores cron schedule
overrides and your own mail templates in new tables. They are created
automatically on first use, so there is nothing to run by hand. If your database
user is not allowed to create tables, the rest of the release works normally and
only those two features stay unavailable.

**If you deploy by FTP rather than through the panel,** clear
`cp-core/var/cache/prod/` after uploading — leave the folder, empty its
contents. Symfony does not rebuild its container by itself in production, so new
screens, settings and scheduled tasks stay invisible until you do. Upload
`public/assets/` as well; the forum editor's new toolbar is served from there.

**Nothing in this release changes an existing setting.** Maintenance mode stays
off unless you turn it on, the postbit keeps its current arrangement, and the
blog related-posts block keeps showing the post's own category as it did before.

## Known limits

**The postbit designer has no JavaScript field, deliberately.** Script entered
in an admin panel runs in every visitor's browser, which would turn "can arrange
the postbit" into "can run code on the whole site". Styling needs no such power;
behaviour belongs in your theme, where it gets reviewed.

**Font colours are a palette, not a colour picker.** This is a consequence of
how post content is sanitized: inline styles are stripped when a post is saved,
so a freely chosen colour would be discarded on submit. The palette is written
as classes, which survive — and they keep your forum readable.