MyWapCMS changelog

1.2.0 — 23.10.2026

Site search, RSS feed and CSV export of users.

Site search: header search box and /search (title, excerpt and text of pages and posts; drafts are never found)
RSS feed /feed.xml (latest 20 posts) announced automatically in the page head
Admin → Users: CSV export (honours the current filter; protected against Excel formula injection, no password hashes)
No database changes — upgrading from 1.1.0 is just replacing the files
Documentation topic "Search, RSS and CSV" added

Member registration, user profile and user management in the admin panel.

Member registration: /register, /login, /logout, /profile (log in with username or e-mail)
User profile: display name, e-mail, website, "About", password change, account deletion
New "Users" section in the admin panel: list, search, status filter, approve / block / activate, edit, role (administrator/member), set password, delete
Site settings: allow / close registration, administrator approval for new accounts
Sign-up protection: CSRF, hidden trap field, 5 sign-ups per hour per IP, login attempt limit
Safeguards: you cannot delete/block your own account, the last active administrator cannot be deleted; a blocked user's session ends immediately
The admin panel is for the "administrator" role only; members cannot log in to it
New migration 002_members.sql (the existing administrator automatically gets the "administrator" role); upgrading from 1.0.0: replace the files and press "Update database"
User count and pending approvals on the dashboard; interface in three languages (az/ru/en)

Reserved slugs for the new site URLs: login, register, profile, logout (a page with such a slug can no longer be created).

First stable release: a minimal, secure CMS on plain PHP and MySQL.

Browser-based installer (requirements check, database, admin account, site details, language, lock file)
Admin panel: pages, news/posts, categories, media, menu, site settings, languages, SEO, administrator account
Draft/published status and publish date (scheduling for a future date), slug, SEO title and description
Safe simple text format (HTML is not accepted), safe image upload (MIME and real-image verification)
sitemap.xml, canonical URLs, 404 page, SEO-friendly URLs
Azerbaijani, Russian and English interface (admin, installer, error messages, public site)
PDO + prepared statements, CSRF tokens, password_hash, login throttling, session ID regeneration, security headers (CSP)
Simple migration mechanism (Site settings → Database update)