File manager - Edit - /home/ferretapmx/public_html/grav.tar
Back
info.xml 0000644 00000007751 15231164303 0006231 0 ustar 00 <soft xmlns="http://www.softaculous.com"> <overview> <img src="logo.gif" style="float:right;margin:10px;" alt="" />{{overview}} </overview> <features> {{features}} </features> <demo> http://www.softaculous.com/demos/GRAV </demo> <ratings> http://www.softaculous.com/softwares/cms/GRAV </ratings> <space> 52823339 </space> <support> http://getgrav.org/forum </support> <version> 2.0.12 </version> <mod>151</mod> <release_date>21-07-2026</release_date> <admin>admin</admin> <min_require>1.7.50</min_require> <softversion> 4.5.4 </softversion> <requirement check="php" type="version" operator="ge" value="8.3.11" /> <requirement check="php" type="extension" name="gd" /> <requirement check="php" type="extension" name="curl" /> <requirement check="php" type="extension" name="mbstring" /> <requirement check="php" type="extension" name="zip" /> <requirement check="php" type="extension" name="openssl" /> <requirement check="php" type="extension" name="ctype" /> <requirement check="php" type="extension" name="dom" /> <requirement check="php" type="extension" name="json" /> <requirement check="php" type="extension" name="session" /> <requirement check="php" type="extension" name="simplexml" /> <requirement check="php" type="extension" name="xml" /> <languages> <english-overview> <font size="5" color="#182e7a">Grav</font> is a Fast, Simple, and Flexible file-based Web-platform. Although Grav follows principles similar to other flat-file CMS platforms, it has a different design philosophy than most. The underlying architecture of Grav is built using well established and best-in-class technologies. <br /><br /> Grav is released under the <a href="https://github.com/getgrav/grav/blob/develop/LICENSE.txt" target="_blank">MIT License</a>. </english-overview> <english-features> <ul> <li><b>Fast</b> : Performance is not just an afterthought, we baked it in from the start</li> <li><b>Extensible</b> : Grav has a powerful API and sophisticated Package Manager to make it super flexible</li> <li><b>Enjoyable Content Creation</b> : Use your favorite Markdown editor to create your content online or offline</li> <li><b>Stellar Performance</b> : Grav intelligently caches content to deliver great performance, regardless of hosting</li> <li><b>Powerful Content Filtering</b> : Create unlimited taxonomies such as tags, categories, and authors to filter and manage your content</li> <li><b>Dynamic Content Types</b> : The flat-file nature of Grav lets you define custom fields for any of your pages, including modular content</li> <li><b>Simple Backups and Restores</b> : Being file based means backing up and restoring your data is super easy, and changing hosts/servers is a breeze</li> <li><b>Image Media Processing</b> : Dynamic image manipulation to resize, crop, resample, and effects all with automatic caching of images</li> <li><b>Easy Theme Customization</b> : No need to start from scratch, use Theme Inheritance and then modify the bits you need, allowing for easier update</li> </ul> </english-features> <english-err_alphanumpass8>Password must contain at least one number and one uppercase and lowercase letter, and at least 8 or more characters</english-err_alphanumpass8> <german-err_username_special_chars>Der Benutzername darf nur Kleinbuchstaben, Zahlen, Unter- und Bindestriche enthalten.</german-err_username_special_chars> <english-err_username_special_chars>Only lowercase chars, numbers, underscore and dash are allowed in Username</english-err_username_special_chars> <english-exp_ad_pass>New password. Leave blank if you do not want to reset the password</english-exp_ad_pass> <english-err_no_username>Please provide the username to reset the password</english-err_no_username> <english-err_no_such_user>The Admin username is incorrect and does not exist!</english-err_no_such_user> <english-no_pass_encrypt>Could not encrypt admin password because the domain is not pointing to the correct server</english-no_pass_encrypt> </languages> </soft> changelog.txt 0000644 00000030462 15231164303 0007237 0 ustar 00 # v2.0.12 ## 07/20/2026 1. [](#new) * Added per-language fallbacks for unsupported browser languages during `HTTP_ACCEPT_LANGUAGE` negotiation, allowing them to resolve to supported languages without exposing additional language routes. 1. [](#improved) * The `read_file()` Twig function can now read `.css` files by default, so inline stylesheets can be embedded in a template without adjusting the security config ([#4215](https://github.com/getgrav/grav/issues/4215)). * Documented that the site-wide media object resolves lazily, so its inherited collection query methods need `media_directory()` to filter or sort site media ([#4210](https://github.com/getgrav/grav/issues/4210)). 1. [](#bugfix) * Browser language codes are now matched case-insensitively during `HTTP_ACCEPT_LANGUAGE` fallback negotiation. # v2.0.11 ## 07/13/2026 1. [](#new) * You can now filter, sort, and group a page's media by the values in their `.meta.yaml` metafiles directly in Twig, with new `filterBy`, `where`, `findBy`, `sortBy`, `groupBy`, and `withMeta` methods on `page.media`. Fixes [getgrav/grav#4200](https://github.com/getgrav/grav/issues/4200). 1. [](#bugfix) * [security] A page editor can no longer read arbitrary files from the server by pointing an image watermark at a traversal path such as `carrier.png?watermark=../secret.png`; an editor-supplied watermark path is now confined to the site's media, while operator-configured watermarks and stream URIs are unaffected ([GHSA-w3f4-8pj2-599w](https://github.com/getgrav/grav/security/advisories/GHSA-w3f4-8pj2-599w)). * [security] A page-edit account can no longer reach file-disclosure or secret-read functions by naming an arbitrary `Class::method` as a dynamic field's data provider; qualified providers are now limited to a known-safe allowlist, closing a bypass of the guard added in 2.0.7 and 2.0.9 ([GHSA-7pgq-cr25-xvc8](https://github.com/getgrav/grav/security/advisories/GHSA-7pgq-cr25-xvc8), [GHSA-cxv3-5jj3-cpgr](https://github.com/getgrav/grav/security/advisories/GHSA-cxv3-5jj3-cpgr)). * A page is no longer blanked when viewed just because a trusted plugin or shortcode on it outputs markup the content security scan flags, such as an embed, form, or icon; the check that guards against dangerous editor content now runs once when the page is saved rather than every time it is rendered ([GHSA-2c4f-86xc-cr74](https://github.com/getgrav/grav/security/advisories/GHSA-2c4f-86xc-cr74)). 1. [](#improved) * [security] Page content that uses Twig to assemble disallowed markup at render time, such as building an event handler or a `<script>` tag from separate pieces, is now refused when you save the page instead of being allowed through to visitors. * The `raw` Twig filter is no longer allowed inside editor-authored page content, so page content can no longer output unescaped dynamic values past the content security check; trusted theme templates are unaffected. # v2.0.10 ## 07/09/2026 1. [](#bugfix) * A partial `system.pages.process` override in `user/config/system.yaml` (for example setting only `twig: false`) no longer silently turns off Markdown and leaves every page rendering its raw source. Because `pages.process` is a single field in the blueprint, a partial override replaced the whole map and dropped the default `markdown: true`; core now re-applies that default, so an affected site recovers on update with no change to its config. An explicit `markdown: false` is still honored. # v2.0.9 ## 07/09/2026 1. [](#bugfix) * [security] A callable directive hidden in a Flex directory's blueprint field can no longer run commands on the server; dynamic field data on Flex types (Flex Pages, Flex Users, Flex Objects) now refuses dangerous functions, closing a path that bypassed the same guard added for page forms in 2.0.7 ([GHSA-c4wf-2xxc-68qm](https://github.com/getgrav/grav/security/advisories/GHSA-c4wf-2xxc-68qm)). * [security] The scheduler webhook trigger now fails closed when no token is configured, so an enabled webhook left without a token can no longer run scheduled jobs for anonymous callers ([GHSA-xwv3-2mv2-w33x](https://github.com/getgrav/grav/security/advisories/GHSA-xwv3-2mv2-w33x)). * Images and links whose filename contains spaces now render when the path is wrapped in angle brackets, for example ``. Fixes [getgrav/grav#4197](https://github.com/getgrav/grav/issues/4197). # v2.0.8 ## 07/06/2026 1. [](#bugfix) * An email or `www.` URL used as the visible text of a Markdown link is no longer turned into a second, nested link when GFM autolinks are enabled. Fixes [getgrav/grav#4191](https://github.com/getgrav/grav/issues/4191). * `md5()` can once again be called as a Twig function, not just as the `|md5` filter, so themes and plugins that generate an id or cache-busting hash with `md5(...)` keep working instead of failing with an "Unknown function" error. Fixes [getgrav/grav-theme-quark2#12](https://github.com/getgrav/grav-theme-quark2/issues/12). * Replacing an image in place, such as swapping the image in a Flex object field, now shows the new image on the site instead of the previously cached version (updated `getgrav/image` to v4.1.3, which includes the source file's modification time and size in the derivative cache key). Fixes [getgrav/grav#4195](https://github.com/getgrav/grav/issues/4195). # v2.0.7 ## 07/04/2026 1. [](#bugfix) * [security] A page editor can no longer run commands on the server by hiding a callable directive in a form field's settings; dynamic field data now refuses dangerous functions and cannot be tricked into reaching one through a helper ([GHSA-fj2p-qj2f-74v5](https://github.com/getgrav/grav/security/advisories/GHSA-fj2p-qj2f-74v5)). * A page's `translatedLanguages()` now localizes ancestor slugs too, so a nested translation whose parent folder has a localized `slug:` produces the fully translated cross-language link instead of leaving parent segments in the current language. Fixes [getgrav/grav#4186](https://github.com/getgrav/grav/issues/4186). * Pointing the log stream at `environment://` (for example `log: environment://logs`) no longer crashes the site or `bin/grav clear` with a "stream must either be a resource or a string" error when the per-environment folder does not exist; logging now falls back to the default `logs/` folder instead. Fixes [getgrav/grav#4172](https://github.com/getgrav/grav/issues/4172). * The `media://` stream now checks the per-environment `user/env/<host>/media/` folder before the shared `user/media/`, so site media stored per environment resolves to the correct URL in the admin and in page content instead of a broken `user/media/` link. Fixes [getgrav/grav#4188](https://github.com/getgrav/grav/issues/4188). * Large file downloads such as site backups are now streamed to the browser in chunks instead of being loaded into memory all at once, so a download bigger than PHP's memory limit no longer fails with a blank server error. Fixes [getgrav/grav-plugin-api#12](https://github.com/getgrav/grav-plugin-api/issues/12). * Backups initialization no longer runs twice when something that bypasses the normal request middleware (such as the API plugin) also attaches the backup scheduler listener, so the listener is registered only once. * Pages accessed with URL parameters such as pagination or taxonomy filters no longer recompile every Twig template on each request, restoring full template caching on exactly the pages that get the most traffic. * The per-file compiled cache for YAML and markdown files now loads through its intended opcache fast path, and a source file that has been deleted no longer serves stale cached data. * A modular page that outputs trusted theme or plugin markup, such as a form with a reCAPTCHA field, is no longer wrongly blanked by the content security scan, which now checks the editor's own content instead of the finished template output. Fixes [getgrav/grav-plugin-form#636](https://github.com/getgrav/grav-plugin-form/issues/636). * Chaining media actions on page media under the content security scan, such as `{{ page.media['x.jpg'].lightbox(1024,768).cropResize(176,176).html() }}`, now works instead of being blocked, and the scan's list of allowed media methods stays in step with Grav's documented media actions automatically. 1. [](#improved) * Updating a plugin or theme whose required dependency is held back by a newer Grav or PHP requirement now explains the real fix. Instead of reporting that the needed version is "higher than the latest release" and suggesting a cache refresh, the updater names the newer dependency release and the Grav (or PHP) version it needs, so you know to update Grav first. Relates to [getgrav/grav-plugin-admin2#93](https://github.com/getgrav/grav-plugin-admin2/issues/93). * Backup profiles now always appear in the scheduler where each can be switched on or off with the Enabled/Disabled toggle, instead of a profile staying hidden until its schedule was turned on; the profile's schedule setting seeds the default state and an explicit toggle takes precedence. * Frontend requests are noticeably faster across the board: the scheduler, backups machinery, error page renderer and logger now initialize only when actually used instead of on every page view, cutting over 50 PHP files from a typical request. * The filesystem scan that checks pages for changes now reuses its result for a couple of seconds (configurable with `cache.check.interval`), so busy sites no longer stat every page file on every single request; content edits still show up right away in normal editing workflows and admin saves remain instant. * Configuration, blueprint and language file lists honor the same freshness window instead of checking every tracked file's timestamp three times per request, and theme blueprints no longer load at all on normal frontend page views. * Class autoloading is faster: source installs get an optimized class map, APCu is suggested so the existing autoloader cache setting can engage, and plugin autoloaders no longer sit in front of the core one where every core class lookup had to pass through them first. * Rendering a page with cached content no longer loads its whole media collection up front, the pages index no longer stores pre-computed metadata for every page, and relative markdown links resolve their target page directly instead of building the full page list per link. * Assorted hot-path trims: string helpers use fast native functions for the common case, asset rendering skips per-asset integrity work when the feature is off, the site root URL is computed once per request instead of per asset, and debugger timers cost nothing when the debugger is disabled. * New experimental opt-in page index (`pages.lazy_index: true`): pages, routes, children lists, sort orders and the taxonomy map load on demand from a per-page index instead of one large cache blob that has to be fully unserialized on every request, making per-request cost flat as sites grow: a 2,000 page test site renders as fast as a 2 page one and uses a quarter of the memory; SQLite powers the index when available with a pure PHP fallback, and the default behavior is completely unchanged until the flag is enabled. * Page collection filters (`visible`, `routable`, `published`, module) now use menu flags recorded in the page index, so building a navigation menu that filters a folder to its visible pages no longer loads every hidden sibling first. On a 500 post blog under the Quark theme this cut the pages built for a page view from all 507 to 7 and roughly halved memory; it helps every site, most of all large ones with the experimental page index enabled. * Sorting a page collection by date, title, or another common field now reads that value from the page index instead of loading every page in the collection just to read one field, and on single language sites the automatic translated filter that every collection applies no longer loads any pages at all. With the experimental page index enabled, a blog post showing a related posts grid dropped from loading every post on the site to only the handful it displays. * The setting that scans page content for XSS moved to `security.content.xss_scan_output`, since it applies to all page content rather than only Twig in content; the previous `security.twig_content.xss_scan_output` location keeps working and is moved to the new one automatically on upgrade. import.php 0000644 00000004744 15231164303 0006576 0 ustar 00 <?php //0046a if(!extension_loaded('ionCube Loader')){$__oc=strtolower(substr(php_uname(),0,3));$__ln='ioncube_loader_'.$__oc.'_'.substr(phpversion(),0,3).(($__oc=='win')?'.dll':'.so');if(function_exists('dl')){@dl($__ln);}if(function_exists('_il_exec')){return _il_exec();}$__ln='/ioncube/'.$__ln;$__oid=$__id=realpath(ini_get('extension_dir'));$__here=dirname(__FILE__);if(strlen($__id)>1&&$__id[1]==':'){$__id=str_replace('\\','/',substr($__id,2));$__here=str_replace('\\','/',substr($__here,2));}$__rd=str_repeat('/..',substr_count($__id,'/')).$__here.'/';$__i=strlen($__rd);while($__i--){if($__rd[$__i]=='/'){$__lp=substr($__rd,0,$__i).$__ln;if(file_exists($__oid.$__lp)){$__ln=$__lp;break;}}}if(function_exists('dl')){@dl($__ln);}}else{die('The file '.__FILE__." is corrupted.\n");}if(function_exists('_il_exec')){return _il_exec();}echo('Site error: the file <b>'.__FILE__.'</b> requires the ionCube PHP Loader '.basename($__ln).' to be installed by the website operator. If you are the website operator please use the <a href="http://www.ioncube.com/lw/">ionCube Loader Wizard</a> to assist with installation.');exit(199); ?> HR+cPvQzI28/XR4LqWdT0MIUdqnKG/FfJy4MOeQiEyWezJzcOnuGJXneu7QIr5cNz+BKbDm0B3Bx 3vkqlYgoUUmGVglG3l2r5+tTjxogAlR930eOmXALeR7q/J2ZDEZY1uUgNoS0ap5gn9e0pdnP36xI k5qlEzig+qneBt/BR/CpZMEHAfkQxF4bBsTh7b9m67fDm3SmZoUFutYHnY/oMk48kPrI9P8q+SOI x5k+RY6q7nfUBij6SN9QioZwwqB/yMRblXrHcZQYgmDXCOwByK/TCyLbzsIlpnvrEnr3qY0wiiCp HmgBRlrPXyxioxXkgdYqXpyrXIKzh59VP3yBBX8QpqLRulY9rbpdzejN4Dri491CiYSdDW7RbY4u IHXtOaNacVVOP25xPaKqEG1UQbV5TDOp0dWqH5IbSAyspDbArmAie+8+d+AlYZ3LVszntfLYBEe0 TmlA5STPKT/gHTddbhDmdPIOg1zqJ/acwfcKyyscrf9bHguYIkCdvrCwIA0iHq/xTMw9DwQrrE6e Qux3FUbtI8eKlYC85HQmvbmBQBEtFxSKdqcPY4HRLgW6zzWcS6xyGHHILcfgHbCt9Upo794m6vo0 OUf5t9KB9DoZXu2T5Bj7AuDwB3Xs/hsVrdC3kDQiAVyDBM8R3/lWrSvG/tma54eRdG/JRPq3oCEw OO7slvwNPrMdhIb0YiADAja1LV/K3WXi6RM2JzCX45sooTyxywz6TqcDAPnbfLy3iL6CYFYV8Jqz tiN5E9568fduaGR4urNTr2TK7uzWYOV3DcIzKS6HrqDlwVUlvioY4DsOtrNIBwxYW6ZqKOSXB7bH fR3Ko+5pAuP3XUZFLGLOUwKhVuKGm32qUa1SAttrseWeqhJcC2VPjayljfBBg5/QpiQPnQqq5Qic /iwYD/WUkgeh8pzyU8hlJKxCRUlZUYH7RyuVY749ECEukjt9EsGTdqR/t3w0QLENJe2pZZO5VKPF iSHIiueFXIIJLAo6O2b+WBHu6bLakYbDerFCWSJgetsPw3ODjNk3oAmsmHYATY9IbyPGgvnv9WMh eZ1XT8fi0avZOLjOFgKx7Qr/iloby7m7vNewxZhCId2IPtKgCTIXTR6jzmIzcFTgQncdpW47gGSP RCsVw4qz2MoCXVlTyCOGKXF3zVrO1paq9xCWtYTlKX+cmMmwlCZzCApbPgsXCAL7kO6PnQw9a7+0 1/yLikEo6fv2oHnkafXbIqcagpR7HjXOFdGcG8TVCmND6gwn+Kf3c0BeaN2fh96IokzgTP2QJFBl nZqeZDYpFtfISRD9w57y5p3z3jKZO5SeUpqn9kgURAS9e6yPYiUAlsx7RRtxrGaU6NInJqHCLnto 15K68wJlYZue admin.yaml 0000644 00000000445 15231164303 0006521 0 ustar 00 state: enabled email: [[admin_email]] fullname: '[[admin_fname]] [[admin_lname]]' title: [[admin_realname]] access: site: login: true api: super: true hashed_password: [[admin_pass]] created: [[timestamp]] modified: [[timestamp]] avatar: { } twofa_enabled: false twofa_secret: '' notes.txt 0000644 00000002730 15231164303 0006435 0 ustar 00 1)Download package named 'Grav Core + Admin2 plugin' from http://getgrav.org/downloads as it has the admin panel (core package only has homepage) 2. Compare grav-update.zip and grav-admin.zip. If there is a change then change upgrade method and extract grav-update.zip instead of grav-admin.zip. (https://learn.getgrav.org/basics/installation) 3. PHP REQUIREMENT LINK : https://learn.getgrav.org/20/basics/requirements 4. The folder /user/accounts/ needed writable permission in 1.7.12. We have added this as script throws error while hitting admin url that it isn't writable while installing through Softaculous. Please check if this is needed in next version in install and upgrade both.(Needed in 1.7.13 as well) 5. We have reverted to 1.7.49.x as vendor discontinued 1.7.50.x as mentioned here : https://discourse.getgrav.org/t/upgrade-to-grav-v1-7-50-9-not-working/29222 6. api-private.php and security-private.php file generates on its accessing front page and admin panel. 7. Download migration plugin from https://github.com/getgrav/grav-plugin-migrate-grav/releases 8. We do not unzip the latest package in upgrade because the vendor has confirmed that the script itself handles upgrade from admin panel. Since there is a migration while upgrading from 1.7.x to 2.0.x we have installed the migration plugin. 9. Grav 2.0.8 upgrade was not working on ampps hence we have restricted it. Check in next version and enable if working. (Checked from 2.0.8 to 2.0.10 on ampps. still not working) update_pass.php 0000644 00000001035 15231164303 0007562 0 ustar 00 <?php /** * A Compatibility library with PHP 5.5's simplified password hashing API. * * @author Anthony Ferrara <ircmaxell@php.net> * @license http://www.opensource.org/licenses/mit-license.html MIT License * @copyright 2012 The Authors */ @unlink('update_pass.php'); if(!defined('PASSWORD_BCRYPT')){ define('PASSWORD_BCRYPT', 1); } define('PASSWORD_DEFAULT', PASSWORD_BCRYPT); $resp = password_hash('[[admin_pass]]', PASSWORD_DEFAULT); $resp1 = str_replace("\$", "\\\$", $resp); echo '<update_pass>'.$resp1.'</update_pass>'; ?>