Security fixes, Stock Photos and stronger watermarks

This release is mostly about keeping your site safe, so please update soon. It also brings a couple of things worth trying, starting with free stock photos right inside your image fields.

Update now, then check your users

3.6.5 fixes a serious security issue that affects every version from 3.5.0 through 3.6.4, along with a number of smaller ones. We recommend updating as soon as you can.

After you update, open your auth collection and look for admin accounts you don't recognize. If you find one, delete it and change your own password.

One change to know about: members of a login collection other than your admin's no longer get the default group. If your members read collections through the API, give them a Registration Group in that collection's settings.

Better protection from bots

Failed logins are now counted on the server, and an address that keeps guessing is locked out for a while, longer each time. Your own account is never locked, so nobody can lock you out by typing your email. Download passwords, password resets, email verification and sign-ups have limits too.

Image requests are protected as well. Requests with bad values are refused straight away, and only a few new images are rendered at a time, so your pages stay fast even when a bot comes knocking.

Your site checks itself

The Server Checker and the dashboard now look for risky settings on your live site. They check for files that can be read from the web, missing HTTPS, debug mode on a public site, sign-up forms that hand out admin rights, unused API keys and more. Each finding says how to fix it.

Stock photos, free in every edition

The new Stock Photos extension adds a button to every image and gallery field. Search Pixabay, pick a photo and drop it in. It arrives with alt text and a full photo credit. You can show your own galleries as tabs too, so it doubles as a media library, and it works without Pixabay if you'd rather keep to your own photos. You'll also find it in the Insert Image window in styled text and Markdown fields.

Images have a new Credit section for the author, source and license, so you can give photographers their due.

Watermarks learn new tricks

• Tiled text repeats your watermark across the whole image, so there's no clean corner to crop out.
• Outlines and shadows keep the text readable on both light and dark photos.
• Text watermarks now size themselves to the image, so they look the same on a thumbnail as on the full photo.

A friendlier dashboard

Pick and order your own Quick Actions, including a New button for any collection. Alerts that aren't urgent move to a Needs Attention card instead of piling up at the top, and Recent Activity shows what's changed on your site lately.

Also fixed

• Two people saving at the same moment can no longer damage a collection or overwrite each other's changes.
• Stacks 6 admin logins no longer loop back to the login page.
• Optional dates now have a clear button, so a date can be removed once it's set.
• On Stacks pages with forms, the template cache no longer grows without limit. One site's cache had reached 18 GB.
• Visitors who download a lot of files no longer get locked out of downloads.

---

Upgrading: update as usual from Admin → Updates or composer update. Afterwards, check your auth collection for admin accounts you don't recognize.

The full changelog is on GitHub: https://github.com/totalcms/cms/releases/tag/3.6.5