# CPalius CMF 2.2.25

**Released:** 2026-09-26 · **Channel:** stable · **Critical:** yes

Turkish: [2.2.25-tr.md](2.2.25-tr.md)

Marked critical because of the first item: members' e-mail addresses were publicly visible. No schema changes.

## Member e-mail addresses no longer shown on public pages

When an account had no first or last name — true for nearly every account imported from XenForo — the display name fell back to the account's e-mail address. The public forum profile (title, heading, breadcrumb), the reputation list and dialog, and the sender name in notifications all used it, so those addresses were visible to anyone. Public places now show the name, then the username, then the member number, and never the e-mail. Admin screens show the username before falling back to the e-mail.

## Forgot password / reset password

Both sign-in pages now have a "Forgot password?" link. It mails a single-use link that is valid for one hour; only a hash of the link's token is stored. The form gives the same answer whether or not the address has an account, and is rate-limited per IP and per address. Setting a new password applies the password policy, signs the account out on every device, and does not log in automatically, so two-factor sign-in still applies. The e-mail is a new "Password reset" template, editable under AACP → Mail templates.

## Sign-in screens use the CPalius logo and the site's name

/login and the new password screens show the stock CPalius logo (public/CPalius.png) and the site name from settings, instead of a placeholder letter and a fixed product name. The version number and the hard-coded example e-mail are gone from the public sign-in page, and the default favicon is the CPalius logo.

## Structured data passes Google's checks

Forum topics (DiscussionForumPosting) now include the opening post's text, the author's profile url and post count, like counts, and the replies shown on the page as comments. Search Console had reported the text as missing (an invalid item), plus missing comments and missing author url.

Blog posts now include the author's profile url, the comment count, and the approved comments, with replies nested. Posts of the "software" type are marked up as a blog post about the software rather than as a SoftwareApplication, which Google always rejects without a price and a rating; the setting that offered that type has been removed. The demo link no longer replaces the post's own url. Videos get the required thumbnail and upload date and a proper YouTube/Vimeo embed url, or are left out rather than published invalid.

## Titles and social previews

Page titles containing quotes or apostrophes were escaped twice, so search results could show """. Shared posts now carry their own title and description in social previews instead of the site-wide defaults.

## Upgrade notes

No schema changes. No manual steps.