按 ↵ 跳转搜索页，或在此查看实时结果
首页 / 版本发布/ TypeRenew v1.6.2 更新上线，安全加固，修复已知问题

TypeRenew v1.6.2 更新上线，安全加固，修复已知问题

Yangsh888 版本发布

TypeRenew v1.6.2 Release 现已正式发布，这是基于 v1.6.1 版本的维护优化版。本次升级聚焦安全边界收紧、PHP 8 兼容性补强、XML-RPC 链路加固与已知问题修复，持续夯实「轻量、稳定、安全」的核心特性。

核心更新内容

本次更新覆盖底层兼容优化、安全防护加固、后台交互体验、国际化完善、核心功能修复与代码质量优化等多个维度，累计修改 83 个文件，核心优化与修复内容如下：

底层内核兼容优化

  • 修复事务状态检测与缓存失效逻辑，写操作在事务提交后正确执行缓存失效
  • 修正 SQL 解析与查询构建中的边界问题，统一引号标识符处理
  • 后台列表分页改为基于偏移量查询，补全 XML-RPC 分类、标签、用户响应及附件、评论分页的兼容处理
  • 限制 IXR 请求体大小，新增最大请求长度校验
  • IXR 消息解析改用 DOMDocument，统一 ISO-8601 日期解析与输入类型处理
  • 修复 IXR 数组结构解析的边界问题，嵌套数组按正确结构处理
  • 数据库缓存行统一转换为 stdClass，缓存读取与直接读取的返回形态保持一致
  • 修复 PDO MySQL 适配器抛出的异常类命名，文件下载响应改为调用实例方法
  • 永久链接重写检测统一使用 PHP_SAPI 判断运行环境
  • 补全请求、路由、Widget、表单与 Markdown 解析等模块的方法参数类型声明

安全防护体系加固

  • 升级包校验补充路径检查与版本、哈希强制校验，异常升级包直接拒绝
  • 出站 HTTP 请求新增安全模式，请求前将目标主机解析为校验过的地址并固定连接
  • 收紧主机名校验，拒绝畸形、编码、localhost 与非 ASCII 主机名，IPv4/IPv6 公网地址过滤更严格
  • XML-RPC 解析拒绝畸形 XML 与未允许的消息类型，方法名统一转义
  • 出站 Pingback、Trackback 请求默认启用安全模式
  • 登录流程增加 auth Cookie 格式校验，仅接受带 Typecho 标记前缀的 Cookie
  • 时间令牌校验兼容空令牌，非字符串内容直接判定无效
  • cURL 协议限制移至选项设置末尾，避免被自定义选项覆盖
  • Redis 缓存载荷改用 JSON 编解码，替代原有的序列化方式
  • 扩展面板增加权限校验，类加载拦截路径遍历字符，PDO DSN 与 PostgreSQL 连接串按白名单校验
  • Ajax、Service 端点统一执行安全校验
  • 数据库字符集与排序规则标识符校验通过后再执行 SET NAMES
  • 备份、升级、缓存、邮件设置等后台页面限制为管理员访问
  • 备份导出检测写入字节数，写入不完整时提示磁盘空间问题
  • 安全模式下缺少 cURL 扩展时明确报错，不再静默回退到流式请求
  • 上传扩展名黑名单补充可执行与配置类文件，上传路径与文件名做规范化处理
  • 修正内容编辑权限判断，转发协议头去除逗号后的多余内容再判断 HTTPS
  • 保存进行中阻止表单重复提交

后台 UI 与交互体验优化

  • 侧边栏折叠时保持顶部强调标签可见
  • 修复手机端自定义字段布局溢出，后台列表操作按钮在窄屏下正常换行
  • 调整全屏写作与侧边栏悬停状态的布局
  • 自动保存失败时自动重试，页面卸载时清理待执行定时器
  • 预览加载失败或超时给出明确提示
  • 修复侧边栏样式问题，移除过期的恢复提示
  • 受保护内容表单 action 统一转义，主题文件扫描限定 php、js、css 扩展名
  • 通知中的 mailto、tel 链接按安全链接处理

国际化与多语言完善

  • 翻译模板与英文目录的版本号同步更新为 1.6.2
  • 补充英文目录中分类、页面、预览状态、时间标签与备份、模板错误等缺失条目
  • 补全此前为空的英文译文并重新编译 MO 文件
  • 空翻译条目按缺失处理，避免返回零长度内容

核心功能修复与体验优化

  • 修复分类、标签 Feed 中评论订阅链接错误拼接导致的 404，统一使用文章自身的 Feed 地址
  • 分页参数增加最大页码限制，避免超大页码导致偏移量溢出
  • 将主题初始化提前到归档处理之前，保证主题注册的 contentEx 钩子在内容属性访问前生效
  • 归档类型为空值时做字符串转换，避免触发类型错误
  • 修正引用反馈的同源判断，显式写出标准端口的 URL 按默认端口标准化后再比较
  • 上传路径中的目录穿越判断改为按路径分量精确匹配，Ajax 文件名解码后检查空字节
  • 附件替换失败时回滚已上传文件，数据库插入失败时清理半成品附件
  • 已发布内容保存后，自定义字段同步更新到当前内容记录
  • 修复归档与页面路由在 URL 冲突时的检测，归档模板支持自定义文件名
  • 密码重置邮件在事务提交后触发，队列邮件可按配置延迟投递
  • XML-RPC 导入时分类名称去空白、去重，复用已存在的分类 ID
  • 完善自动保存与排队保存行为，避免对旧密码执行不必要的重哈希
  • 修复 HyperDown 解析行缓冲未初始化的问题，Ping 回调改为公共方法

代码清理与质量优化

  • call_user_func_array 统一替换为展开运算符调用
  • 移除 IXR 中的动态属性注解与冗余的请求、响应序列化逻辑
  • MySQL 安装脚本数值列默认值统一为裸数字
  • 清理后台脚本中过期的浏览器兼容分支与无效判断
  • 移除扩展名匹配中永远不会命中的冗余规则

Full Changelog: https://github.com/Yangsh888/TypeRenew/compare/v1.6.1...v1.6.2

下载方式

延续 v1.6.1 版本的分发规则，本次默认仅发布最小化版本（含程序主体 + 默认模板），如需安装各类官方拓展插件，请前往 TypeRenew 插件仓库下载安装。

正式安装包

默认版：TypeRenew-v1.6.2.zip

插件仓库地址：https://github.com/Yangsh888/TypeRenew-plugins

升级包（支持从 v1.6.1 正式版直接升级）

通用升级包：TypeRenew-upgrade-v1.6.1-to-v1.6.2.zip

语言包说明

本次提供的正式安装包与升级包均不包含 usr/langs/ 目录下的语言文件。简体中文为内置语言，无需额外文件；如需使用英文或其他语言，请参照 README「多语言（i18n）」部分，从仓库 usr/langs/ 目录下载所需语言包（如英文 en_US.mo），手动放置到站点的 usr/langs/ 目录，再到后台「设置」-「基本」中切换语言。

语言包目录：https://github.com/Yangsh888/TypeRenew/tree/main/usr/langs

升级包使用方式

  1. 升级前请先 完整备份程序文件与数据库，避免因升级异常导致数据丢失或无法恢复
  2. 登录网站管理后台，在左侧导航栏进入「升级」页面
  3. 点击「选择升级包」区域，上传已下载的 zip 格式升级包（支持直接拖拽文件至该区域）
  4. 确认升级信息后点击「上传升级包」，按照页面引导完成在线升级
  5. 升级完成后刷新页面，按照页面提示完成数据库结构升级，并核对后台显示的程序版本与数据库版本均为最新
提示：如需从原版 Typecho 迁移部署，请参考 README.md 中的相关指引完成操作

反馈方式

如需反馈问题或提出建议，请提交至 GitHub Issues 页面： https://github.com/Yangsh888/TypeRenew/issues

或加入官方 QQ 交流群： 1073739854

TypeRenew v1.6.2 Release

About This Release

TypeRenew v1.6.2 is now officially available. This is a maintenance release based on v1.6.1, focused on tightening security boundaries, strengthening PHP 8 compatibility, hardening the XML-RPC pipeline and fixing known issues. It keeps TypeRenew lightweight, stable and secure.

What's New

This release covers compatibility improvements, security hardening, admin interaction, internationalization, core fixes and code quality, with 83 files changed in total. The main improvements and fixes are listed below.

Core Compatibility Improvements

  • Fixed transaction state detection and cache invalidation so write operations invalidate the cache correctly after the transaction commits
  • Fixed edge cases in SQL parsing and query building, and unified the handling of quoted identifiers
  • Admin listing pagination now uses offset-based queries; XML-RPC responses for categories, tags and users, along with attachment and comment pagination, are handled consistently
  • Limited IXR request bodies with a maximum request length check
  • IXR message parsing now uses DOMDocument, with unified ISO-8601 date parsing and input type handling
  • Fixed an edge case in IXR array parsing so nested arrays are handled with the correct structure
  • Cached database rows are now normalized to stdClass so cached reads and direct reads return the same form
  • Fixed the exception class name thrown by the PDO MySQL adapter; file download responses now call the instance method
  • Permalink rewrite checks now use PHP_SAPI to detect the runtime
  • Added parameter type declarations across the request, router, widget, form and Markdown parsing modules

Security Hardening

  • Upgrade package validation now includes path checks and enforced version and hash verification; malformed packages are rejected
  • Outbound HTTP requests offer a safe mode that resolves the target host to a vetted address and pins the connection before sending
  • Tightened hostname validation to reject malformed, encoded, localhost and non-ASCII hostnames, with stricter public-address filtering for IPv4 and IPv6
  • XML-RPC parsing rejects malformed XML and disallowed message types, and method names are consistently escaped
  • Outbound pingback and trackback requests now use safe mode by default
  • The login flow now validates the auth cookie format and only accepts cookies carrying the Typecho marker prefix
  • Time token validation handles null tokens and treats non-string content as invalid
  • Moved the cURL protocol restriction to the end of option setup so custom options cannot override it
  • Redis cache payloads now use JSON encoding and decoding instead of the previous serialization
  • Extension panels now include permission checks, class loading blocks path traversal characters, and PDO DSN and PostgreSQL connection strings are validated against allowlists
  • Ajax and Service endpoints consistently run security checks
  • Database charset and collation identifiers are validated before SET NAMES is executed
  • Admin pages such as backup, upgrade, cache and mail settings are restricted to administrators
  • Backup export checks the number of bytes written and reports a disk-space issue when the write is incomplete
  • Safe mode now reports a clear error when the cURL extension is missing instead of silently falling back to stream requests
  • The upload extension blacklist covers additional executable and config-like files, and upload paths and filenames are normalized
  • Fixed permission checks for content editing; forwarded protocol headers have extra content after commas trimmed before HTTPS detection
  • Form submissions are blocked while a save is in progress to prevent duplicate submissions

Admin UI and Interaction Improvements

  • The top accent pill remains visible when the sidebar is collapsed
  • Fixed mobile custom-field layout overflow; list action buttons wrap correctly on narrow screens
  • Adjusted the layout for fullscreen writing and sidebar hover states
  • Failed autosaves are now retried automatically, and pending timers are cleared when the page unloads
  • Preview load failures and timeouts now show clear messages
  • Fixed sidebar styling and removed the stale restore notice
  • Protected-content form actions are consistently escaped; theme file scanning is limited to php, js and css extensions
  • mailto and tel links in notices are handled as safe links

Internationalization and Localization

  • The version numbers of the translation template and the English catalog are updated to 1.6.2
  • Added missing English entries for categories, pages, preview states, time labels, and backup and template errors
  • Completed previously empty English translations and recompiled the MO file
  • Empty translation entries are treated as missing to avoid returning zero-length content

Core Fixes and Improvements

  • Fixed 404 errors caused by incorrectly built comment subscription links in category and tag feeds; the article's own feed URLs are now used
  • Added a maximum page number limit to pagination parameters to prevent offset overflow from very large page numbers
  • Moved theme initialization before archive handling so the contentEx hook registered by the theme is in place before content properties are accessed
  • Archive types are cast to a string when empty to avoid type errors
  • Fixed same-origin checks for feedback: URLs that explicitly write out the standard port are normalized to the default port before comparison
  • Directory traversal checks in upload paths now match path components precisely, and Ajax filenames are checked for null bytes after decoding
  • Uploaded files are rolled back when an attachment replacement fails, and half-created attachments are cleaned up when the database insert fails
  • After published content is saved, custom fields are synced to the current content record
  • Fixed archive and page route detection for URL conflicts; archive templates support custom filenames
  • Password reset emails are triggered after the transaction commits, and queued emails can defer delivery based on configuration
  • XML-RPC imports now trim and deduplicate category names and reuse existing category IDs
  • Improved autosave and queued-save behavior and avoid unnecessary rehashing of legacy passwords
  • Fixed an uninitialized line buffer in HyperDown parsing; the ping callback is now a public method

Code Cleanup and Quality

  • Replaced call_user_func_array with spread-operator calls throughout
  • Removed dynamic property annotations and redundant request and response serialization in IXR
  • Numeric column defaults in the MySQL install script are now bare numbers
  • Cleaned up outdated browser compatibility branches and invalid checks in admin scripts
  • Removed redundant extension matching rules that could never be hit

Full Changelog: https://github.com/Yangsh888/TypeRenew/compare/v1.6.1...v1.6.2

Downloads

Following the distribution rules of v1.6.1, this release ships only as a minimal package (the program itself plus the default template). For official extension plugins, please visit the TypeRenew plugin repository.

Full Package

Default package: TypeRenew-v1.6.2.zip

Plugin repository: https://github.com/Yangsh888/TypeRenew-plugins

Upgrade Package (supports direct upgrade from the v1.6.1 release)

General upgrade package: TypeRenew-upgrade-v1.6.1-to-v1.6.2.zip

Language Packs

Neither the full package nor the upgrade package includes the language files under usr/langs/. Simplified Chinese is built in and requires no extra files. To use English or another language, see the "Multilingual Support (i18n)" section of the README: download the language pack you need (such as the English en_US.mo) from the repository's usr/langs/ directory, place it manually into the usr/langs/ directory of your site, and then switch the language under "Settings" - "General" in the admin panel.

Language pack directory: https://github.com/Yangsh888/TypeRenew/tree/main/usr/langs

How to Use the Upgrade Package

  1. Before upgrading, back up your program files and database completely to prevent data loss or an unrecoverable state if anything goes wrong
  2. Log in to the admin panel and open the "Upgrade" page from the left navigation
  3. Click the "Select upgrade package" area and upload the downloaded zip package (you can also drag and drop the file into the area)
  4. Confirm the upgrade information, click "Upload upgrade package", and follow the on-screen instructions to complete the online upgrade
  5. After the upgrade, refresh the page, follow the prompts to complete the database schema upgrade, and verify that both the program version and the database version shown in the admin panel are up to date
Tip: If you are migrating from the original Typecho, follow the relevant instructions in README.md

Feedback

To report issues or suggest improvements, please open an issue on the GitHub Issues page: https://github.com/Yangsh888/TypeRenew/issues

Or join the official QQ group: 1073739854

暂无评论

评论已关闭