v5.0.0-rc2 Release Notes

Release Date: 23 October 2026

Downloading & Installing

The only official distribution site is Github. Check out the Installation page to get started.

Reporting Problems

For more information, support, or to discussion upcoming features, please visit our Support Forums.

Any and all issues discovered should be added to our our Issue Tracking System. Feature requests should be marked as such and not described as issues. Please remember to mark Feature Requests as requests and not bugs.

If you’re not familiar with submitting a bug, please read my post: How To Submit a Bug

New Features

• Files: the Folder Explorer is back as a Folders tab (#406, #407, #408)
• Files: a folder field on the Add/Edit File form, so files can be moved between folders (#405)
• Signup: self-hosted bot protection, and signup stops after the duplicate checks (#363)
• Print stylesheet: pages print cleanly from the browser, replacing the PDF export (#393)
• Calendars shade non-working days from cal_working_days and holidays; the Bootstrap theme marks them distinctly from task days
• The header search box runs SmartSearch directly, and SmartSearch is hidden from the menu (migration 071)
• Lost password works again and generates unguessable passwords

Fixes/Bugs Closed

• Security
  • Check a form token on every request that changes data (CSRF)
  • Logout, ending sessions and module admin links need the form token (#400)
  • Stop putting the session id in redirect URLs
  • Regenerate the session id when a user logs in
  • Set Secure, HttpOnly and SameSite on the session cookie
  • Only link to http(s), ftp and mailto URLs, and escape them: stored XSS through URL fields (#401)
  • Contacts: quote the e-mail address in the duplicate check: SQL injection (#402)
  • SmartSearch: quote search terms in the SQL: SQL injection
  • SmartSearch: escape the keywords echoed back into the search form: XSS
  • SmartSearch: escape record values in the results list: stored XSS
  • w2PgetParam(): drop the filter that never matched; fix callers that relied on it (#403)
• Gantt
  • Draw all text in DejaVu Sans so non-Latin-1 names render; fit header rows to the chart width and draw CJK text; draw mixed-script labels in runs and keep right-edge captions in
  • Draw the Today line in the middle of today
  • Dependency arrows on every chart; fit the task table to narrow charts
  • Qualify task_id in the task permission filter
  • Project Gantt tab and Project Designer show every task, not just the viewer’s
  • Sub-projects gantt: fix the PHP 8 fatal and show tasks again; indent milestones; show each task’s own progress
  • Project Designer: no getStyle('td_sample') error on load (#431)
• Calendars, events and dates
  • Calendars mark today again
  • Week view shows the week the tasks and events are loaded for
  • Minicals draw days of the previous/next month as plain empty days
  • Task dates: stop double-encoding the working-day names
  • Date::format(): pad %I to two digits (#426)
• Files and folders
  • No folder can be moved into itself; fix the folder edit page (#409, #410)
  • A duplicated file keeps its project and folder (#411)
  • Folder delete asks once and deletes through the Files module (#432)
• Mail, contacts, forums and system
  • Mail: send queued mail instead of queueing it again; fix Cc/Bcc (#424, #425)
  • Contacts cron: fill in missing display names without load()/store(), so queuescanner.php no longer crashes (#399)
  • Contacts list and contact view show free-text countries without a warning (#430)
  • Forum reply form: define $df/$tf and show the message being replied to (#429)
  • Forums keep the forum’s message count when a message is posted
  • New custom field form initialises its field values (#428)
  • System Lookup Keys: adding, editing and deleting keys works again
  • Permissions: no warnings when an item’s module is inactive
  • BaseObject: an object restored from the session gets a new query
  • Sub-projects list passes its classes as classes, not as the table id
• SmartSearch
  • A search for 0 is no longer dropped; empty search terms are dropped instead of matching everything
  • Search terms are escaped properly when highlighting results
  • The accent-insensitive pattern is rebuilt with real UTF-8
  • Array-valued keywords and module lists are ignored

Misc Changes/Improvements

• Require PHP 8.3 in the installer and upgrade checks
• Migration 070 brings databases upgraded from 4.x in line with fresh installs
• Table prefixes: say they are not supported instead of half-supporting them (#427)
• Remove the dead PDF code outside lib/ (#392)
• Task gantt: remove the “task names only” mode and date-range code that never took effect
• Deprecate getCriticalTasksInverted() and strUTF8Decode()
• Sub-projects gantt: replace the deprecated utf8_decode()
• Event and task add/edit: each date and its time on one line; Recurs select, count and “times” on one line
• SmartSearch results wrap; its form uses CSS instead of old show/hide scripts; the first text box is autofocused, skipping the header search
• Describe $gantt_arr as it is now in the showgtask() docblock
• Version set to 5.0.0 rc2

Open/Known Issues

• 27 issues remain open on the v5.0 milestone, including these security issues:
  • #463 Any logged-in user can run any module’s dosql handler
  • #472 Moving a task to another project skips every permission check
  • #476 Inactive tasks tab ignores task-level permissions
  • #474 Legacy MD5 password check uses a loose comparison
  • #436 Calendar feed tokens are guessable and keep working after a user loses access
  • #457 CAppUI::isActiveModule() interpolates the module name into SQL
  • #466 Files Add/Edit page still includes the HelpDesk add-on’s config.php
• #464 The add-on upgrade guide doesn’t yet mention the __nonce form token now required on dosql, AJAX and do_* requests
• #454 The new “Non-working day” calendar label has no translation outside English
• #519 / #520 w2p_Utilities_Date::format() ignores %, so getBeginWeek()/getEndWeek() always see Sunday
• #392 The PDF libraries and fonts are still in lib/
• The signup duplicate-email check strips hyphens and underscores before comparing (do_user_aed.php), so some valid addresses collide (not yet filed)
• The unit test suite runs XXX tests with XXX errors and XXX failures. (Not run yet: the suite needs a MySQL test database.)

System Metrics

There are some core metrics that may be of interest to the geekier among us. We generate these with phploc, using the phploc target in the unit_tests/build.xml file. Overall Code Metrics explains how to run it yourself.

Measured with phploc 8.0.4, excluding lib/ and vendor/.

• Lines of Code: 62602 (9883 of comments, 52719 of code)
• Cyclomatic Complexity:
  • Per Class: 19.09 (min: 1, max: 252)
  • Per Method: 2.52 (min: 1, max: 61)
  • Per Line of Code: 0.26
• Interfaces: 2
• Traits: 0
• Classes: 135 (130 Concrete, 5 Abstract)
  • Lines of Code/Class: 84
  • Class Constants: 14
  • Methods: 1644 (50 static, 1594 non-static)
    • Public: 1504
    • Protected: 114
    • Private: 26
  • Lines of Code/Method: 6
• Functions: 207 (202 named, 5 anonymous)
• Constants: 67