# CPalius CMF 2.1.0

**Released:** 2026-09-18 · **Channel:** stable · **Critical:** no

Turkish: [2.1.0-tr.md](2.1.0-tr.md)

This release is mostly about who gets in and how long they stay in: a second
factor people will actually use, an extra question in front of the panel, and
sessions that close themselves. The forum side gets the tools a busy board needs
when one subject floods it.

## What's new

**A second factor by e-mail, for people who will not carry an app.** Two-step
verification previously meant an authenticator app or nothing, and "or nothing"
is what most members chose. Each member can now pick: the app as before, or a
six-digit code e-mailed at sign-in. The code lives for ten minutes, works once,
and is rate-limited on both sending and checking. E-mail is not offered at all
when the site has no working mail configuration — an account enrolled on a
channel the site cannot use is an account locked out at the next sign-in.
Recovery codes work with either method, so switching never strands a printed
list.

**An extra question in front of the panel.** Settings → Security now has a gate:
you write a question and an answer, and anyone opening AACP is asked it once per
session before the panel appears. It is deliberately not a second factor — a
question everybody with panel access answers the same way cannot be one. What it
buys is that a stolen session cookie, or an unlocked browser on a logged-in
account, hands over the site but not the console. Wrong answers are counted and
lock out for a while. A gate that is switched on but has no question or no
answer stays inert, so ticking the box and forgetting the rest cannot shut you
out, and the Security Center reports that state as a finding.

**Idle sessions now close on the clock.** The idle limit has existed for a while
but only took effect when the visitor came back — which is exactly the window
somebody holding a stolen cookie is working in. A scheduled task now revokes
sessions past their limit whether or not anybody returns to them. Accounts with
panel access get their own, shorter limit: an open AACP tab in an unattended
office is worth more to an attacker than an open profile page.

**Members can see their own sessions.** A new Security page under the account
area lists every device signed in as you, with its address and when it was last
seen, and lets you close any of them or all the others at once. It is also where
two-step verification is set up, changed or turned off, and where recovery codes
are regenerated.

**A word filter each member sets for themselves.** When one subject takes over a
board for a month, the people who do not want to read about it currently have no
answer except leaving. Each member can now list terms in their account
preferences; topics whose title contains one of them stop appearing in the lists
they browse — boards, search, unread, the activity panel and the homepage
blocks. Nothing is deleted, nothing is hidden from anybody else, a direct link
still opens, and a member's own topics are never filtered out from under them.

**Signatures are the member's own again.** The signature under each post could
only be edited by an administrator. It is now a field on the member's own
account screen, with a length limit you set. It stays plain text on purpose: the
space under every post somebody makes is not a place to let markup in.

**Anti-bump.** Replying to your own topic when nobody else has replied since no
longer creates a new post. The reply is appended to your previous one under a
dated divider, and the topic does not move: the last-post time, the post count
and the reply notification are all left alone. Moderators are exempt, and a
post held for moderation is never folded away. You can apply it to everyone
rather than only topic authors, and set a window after which a genuine follow-up
is allowed to bump again.

**A longer edit window for the opening post.** The edit limit used to be one
number for every post. The opening post now has its own, longer allowance — two
hours by default against fifteen minutes for replies. It carries the title and
the question everybody else is answering, so a typo in it costs the whole
thread, while a typo in reply forty costs one line. The edit screen now says how
much time is left instead of warning that the window "may be limited".

**The who-is-online counter is one number again.** The footer broke its count
into members, guests, search engines and bots, which was four labelled counters
on the bottom of every page. It now shows the total, and the breakdown lives on
the online list behind the link next to it — where somebody asking "who is that"
was going anyway. Hovering the number still shows the split.

## Fixes

**My Topics, Unread and Drafts were crushed against the left edge.** Those three
lists were drawing their rows with the board's five-column grid but filling only
one of its columns, so every title ended up inside the 40-pixel icon slot. They
now have their own single-column row, with reply and view counts on the right.

**The forum editor's theme colours were never being applied.** A comment in the
forum stylesheet contained a character sequence that closes a CSS comment, so
the comment ended early, the rest of its text was parsed as CSS, and the
CKEditor theme block immediately below it was discarded by the browser.

**Mobile layout across the whole front end.** The type and spacing scale was
fixed pixels — a 72-pixel hero and 178-pixel section gaps do not fit a phone
however many rules a component carries, and every page reaching for those values
inherited the problem. The scale is now fluid: identical at desktop width, and
scaling down from there with a floor under it. Alongside that, long unbroken
links, wide tables, code blocks and embeds inside written content can no longer
decide the width of the page, and the account screen's two-column layout stacks
on a narrow screen instead of leaving the form about a hundred pixels wide.

**The footer printed its own address twice.** The credit line said the name and
the URL side by side; the name was already the link.

## Upgrade notes

**Idle sign-out becomes active on sites that never configured it.** This is the
one change that alters behaviour without being asked for. The idle limit
defaults to 60 minutes and the limit for accounts with panel access to 20, where
previously both were off. Installations that have saved the Security tab at
least once keep whatever they saved. If you do not want it, set both to 0 in
Settings → Security; if you want it stricter, that is the same screen.

**Anti-bump is on by default, with no time limit.** A member replying to their
own topic will find their reply folded into the post above it however old that
post is, and the topic will not rise. If you would rather allow a genuine bump
after a while, set the window in Studio → Forum → Anti-Bump to, say, 1440
minutes; only replies inside that window are folded then.

**The idle sweep needs your scheduler to be running.** It is registered to run
every five minutes. If nothing is calling the cron endpoint, sessions still
close when the visitor returns — the old behaviour — but not before. Automation
→ Cron shows the address to use.

**The Showcase module joins the default active list.** Installations that had
already enabled it are unaffected.

**Nothing in this release changes your database schema.** The new settings and
the per-member preferences are stored in tables that already exist, so there is
nothing to run by hand and nothing that can fail on a database user without
schema rights.

**If you deploy by FTP rather than through the panel,** clear
`cp-core/var/cache/prod/` after uploading — leave the folder, empty its
contents. Symfony does not rebuild its container by itself in production, so the
new screens, settings and scheduled task stay invisible until you do. Upload
`public/assets/` as well.

## Known limits

**An e-mailed code is worth what the mailbox is worth.** It is weaker than an
authenticator app and always will be. The honest comparison is not against the
app, though — it is against the accounts that would otherwise have no second
factor at all. Where that trade is not acceptable, Settings → Security can
restrict everyone to the app.

**The gate question is one shared secret, not a per-person one.** Everybody with
panel access answers the same question. Treat it as a second lock on the same
door, not as an identity check.

**The anti-bump divider is written in the poster's language.** The date and the
"Added" label become part of the stored post, so a reader in another language
sees the label in the language of whoever wrote it. This is the same trade the
quote and merge tools already make.

**The word filter matches topic titles, not post bodies.** A filtered subject
can still reach a member through a reply inside a topic whose title says nothing
about it.

**The mobile work fixed causes, not every screen.** The systemic problems and
the layouts confirmed broken are dealt with; the front end has not been walked
page by page on a device. If a particular screen still reads badly on a phone,
it is worth reporting rather than assuming it is known.