v3.2.2 Omeka Classic 3.2.2 is a bugfix update that contains several important security-related fixes and improvements. All users should upgrade. Security Password-reset and account activation tokens were generated in a predictable way The URL in password reset emails could depend on the URL used to access the site when requesting a reset Authenticated users could delete other users' API keys REST API requests did not apply HTML Purifier to HTML element texts The makePublic and makeFeatured permissions for items were not applied for REST API requests Theme and plugin names were not always correctly validated before performing actions The /redirector action could be used for external redirects The above security issues were reported by Andrew Gonzalez. Fixes The FileMarkup helper could emit a notice about using null as an array offset Spurious notices could be fired when trying to load some files on servers using PHP's open_basedir setting Accessibility fixes: Textareas could be resized horizontally in a way that did not work well with the page layout The default homepage lacked an h1 heading The example image for the tag admin page lacked alt text Icons could improperly read as text for screenreaders z-index issues between dialogs and some other elements Improved contrast on the arrows for selects on the admin Button focus was indicated by color only Theme buttons were not accessibly grouped with the theme they relate to Changes Omeka now serves its fonts locally rather than using Google Fonts Account activation and password-reset tokens are now only valid for 24 hours Calls to PHP is_ functions using obsolete type names that will be deprecated in PHP 8.6 are updated to their canonical versions The server URL used for creating absolute links is now settable as "Server URL" in General Settings. A default value for this setting will be set upon upgrading to 3.2.2. The previous behavior of auto-detecting the server URL is available by setting a blank value, but this should only be done if the server is configured to only accept requests with proper Host headers. Bundled Add-ons Exhibit Builder is updated to version 3.10.2 v3.2.1 PHP 8.5 is now supported Bugs Fixed The navigation edit form incorrectly warned about unsaved changes even if no changes were made The "for" attribute did not appear as expected on some checkbox form elements Headers in the admin interface cut off too soon, leaving unused space Action links on browse pages did not align properly on some browsers and sometimes lacked proper separation between actions The Files tab when editing items had alignment and wrapping issues at smaller screen widths The TinyMCE HTML editor did not limit the editor height as expected The Role element description for the user form linked to an old documentation location PHP deprecation fixes: improper null passing of null browse sorting parameters improper null passing using Zend_Form with some multi-level forms improper null passing for some SQL queries deprecated callback syntax in LightGallery view helper removed PHP casts that were deprecated in PHP 8.5 imagedestroy calls in the GD derivative strategy Improvements Accessibility improvements Admin browse pages reworked to avoid duplicate links, duplicate text, and improve accessibility for featured/private markers Added toolbar group labels and help text for the TinyMCE HTML editor Moved admin "skip to content" link into header to avoid unwanted initial focus Improved text content for admin sorting links Labels provided for ARIA landmarks Labels for form elements when editing item types SQL sorting is skipped completely for queries that only want to count the results, improving performance for some queries Invalid "context" queries and advanced search types both emit 404 errors instead of 500, avoiding some common unhelpful error log entries and signaling to crawlers not to recrawl External Libraries jQuery 3.7.1 / jQuery UI 1.14.1 getID3 1.9.25 For Developers New insert_option and update_option hooks fired when options are set New index_acl_resource route parameter allows API resources to check against ACL for an index permission when performing an index/list operation v3.2 Bugs Fixed a JS error that could happen on items search when using an older theme Fixed an error in the installer when proc_open is disabled and running on PHP 8+ Fixed a deprecation warning when using an LDAP plugin (#1013, fix contributed by @kloor) Fixed some "missing property" notices (#1014, fix contributed by @kloor) Fixed issues with element text alignment in the admin interface (partially contributed by @ebellempire) Fixed a bug where a theme's custom.php file could incorrectly be run multiple times in a single request Fixed a notice that could happen when using the FormInput helper (#1040, contributed by @csidirop) Fixed a notice on the admin tag interface Numerous accessibility fixes and improvements Improvements Multiple files can be selected for upload at once Files selected for upload now show a preview thumbnail when possible Files can have alt text set for them, both by setting text explicitly for a single file and by configuring an element to use as the alt text PDFs are now cropped to the "CropBox" by default (can be disabled with new pdfUseCropBox derivative setting) Password hashing is updated to use PHP's native password_hash (#977, partially contributed by @dicksonlaw583) S3 support updates and improvements New acls option to disable ACLs New storageClass option for setting a storage class to use when storing files New sigV4 option for using the newer "V4" signature method, needed for working with newer AWS regions ZendS3Cloudfront storage adapter for serving files through CloudFront lightGallery ("slider"/"lightbox" viewer used by many themes) updates and improvements TIFF and JP2 files are now supported (their fullsize derivative will be displayed) The gallery no longer displays if an item has no gallery-compatible files Changed lightgallery to use a different ID to avoid possible conflicts (#1056, contributed by @ebellempire) Alt text will no longer show as a caption in the gallery theme.useInternalAssets setting now applies to jQuery and jQuery UI Better database indexing for items, collections, element texts, and sessions Garbage collection of the database-backed sessions is now enabled even on servers that usually disable it by default (can be enabled with sessions.allowNoGc config setting) New log.path config setting for changing the log path Changes Omeka no longer ships with a default robots.txt file blocking the "files" folder Deprecation notices are now not reported by default The database connection now uses the utf8mb4 charset Localization Updated translations for many languages For Developers New display_records and get_display_records functions, simplifying theme code for things like "random/featured" displays on homepages New all_element_texts_options filter for changing the options passed to all_element_texts (#1048, contributed by @ebellempire) New light_gallery_callbacks filter for extending lightGallery support to other filetypes Deprecations are now not reported by default, set env var OMEKA_REPORT_DEPRECATED to 1 to see them External Libraries HTMLPurifier updated to version 4.18.0 getID3 updated to version 1.9.23 TinyMCE updated to version 5.10.9 lightGallery updated to version 2.8.3 Bundled Addons Exhibit Builder 3.8 Berlin 2.7.6 Seasons 2.8 Thanks, Roy 2.8.0 v3.1.2 Fixes Fixed a bug where files could appear out of order within an item, particularly if many files were added at once Fixed an error on newer PHP versions that was thrown when passing non-numeric data as the page URL parameter Fixed a PHP 8.2 deprecation warning issued from some controllers Fixed a PHP 8.1 deprecation warning issued from the shortcode handler Fixed a PHP 8.1 deprecation warning issued from the Imagick derivative image strategy Fixed an issue where the download button on the lightGallery viewer in themes could be impossible to press Fixed an error that could occur when using the es_CO locale on some pages where formatted numbers were displayed (e.g. file sizes and limits) Fixed a notice issued from theme configuration when uploading a file Fixed a notice issued from the tag mixin Fixed an error that could occur when saving custom links in the navigation Fixed an error that could cause Omeka to hang when uploading some images with embedded XMP metadata Fixed an error that could occur in the removeZeroDates migration when upgrading from a very old Omeka version when using MySQL 8 Fixed the display of error messages on the installer and login forms Fixed the admin search form to restore the "is not exactly" search type Fixed various small issues in the admin theme Changes Theme versions are now displayed in the theme selection view Added admin styling for number, email, and search type inputs Field explanations in the admin theme are no longer larger than other text like field labels Removed admin theme references to some obsolete fonts, images, and stylesheets The font style and size in the admin theme is now set more loosely, fixing some issues where more specific font settings unexpectedly were not applied The Browser mimetype detection method is removed Mimetype detection now stops once a concrete type is detected, rather than trying all options External Libraries Updated getID3 to version 1.9.22