SynaptikCMS 1.3.5 is out
This release is a big one. Not because of flashy new features, but because of what happens behind the scenes to keep your site secure.
A few days ago, @treeandcoffee reached out with a full security audit of SynaptikCMS 1.3.4.4. The findings were honest and detailed, and we took every one of them seriously. Version 1.3.5 is the direct result of that work.
What changed
The most critical fix closes a scenario where the password reset link could be exposed directly in the browser on installs where mail() isn't configured. On shared hosting, that's not uncommon. It's now gone entirely: if mail delivery fails, you get a neutral error message, nothing more.
Beyond that, several admin endpoints that were missing CSRF protection now have it. The file manager's rename and move operations now properly validate paths and extensions. The session cookie hardening that only worked under mod_php now applies under PHP-FPM as well. The public search endpoint got rate limiting so it can't be used to hammer your server. And a handful of smaller issues throughout, including an XSS vector in the Markdown parser and a race condition in the login rate limiter.
Full credit to @treeandcoffee and Dinesh Goud for their responsible disclosure.
One new thing
The release also adds /llms.txt support, following the emerging spec. It's a simple endpoint that lists your published content with URLs and summaries, making your site more readable for LLM indexers. No configuration needed, it just works.
Upgrading from 1.3.4.x is the usual process: transparent replacement of the core files. The migration script runs automatically on the first page load and takes care of everything, including populating the new canonical URL setting used by the password reset system. Your content, themes and plugins are untouched.