Security & Bugfix Release
Oriel Pro 1.9.x improves performance on modern systems by utilizing Imagick as well as the GD Library as a fallback for thumbnail generation. Furthermore, in the wake of recent “AI-driven” attacks on Joomla extensions, the module has been further hardened and strengthened in terms of security.
Changelog
### Version 1.9.2
#### August 2026
- Security: Thumbnail generation no longer trusts client supplied paths — the source is confined to the site root and must be an existing image, the destination is always derived server-side inside the module cache (prevents arbitrary file read/write)
- Security: Image path listing is confined to the `/images` directory (prevents directory traversal / path disclosure)
- Security: `moduleId` is strictly cast to an integer before it is used to build cache paths (prevents path traversal on cache deletion)
- Changed: Thumbnail cache folders are now created with `0755` instead of `0777` permissions
- Changed: Internal exception details are no longer echoed to the AJAX response (logged instead)
### Version 1.9.1
#### August 2026
- Added: GD fallback for thumbnail creation when the Imagick extension is not available (Imagick is still preferred)
- Changed: Installation no longer aborts without Imagick as long as GD is available (installer now shows a fallback notice)
- Fixed: Thumbnails were generated at the original image size instead of the target size when a PHP memory limit was set
### Version 1.9.0
#### August 2026
- Added: Joomla 6 compatibility (module now runs with the Backward Compatibility plugin disabled)
- Changed: Replaced all legacy `J`-prefixed classes with their namespaced equivalents (`Factory`, `Uri`, `HTMLHelper`, `Text`)
- Changed: Migrated from the removed `Joomla\CMS\Filesystem` package to the framework `Joomla\Filesystem` package
- Changed: Dynamic article source now uses the MVCFactory instead of the removed `JModelLegacy`
- Changed: Custom form fields now extend the namespaced `FormField` / `ListField` base classes
- Changed: Application input is now accessed via `getInput()`; database access uses `DatabaseInterface`
- Changed: Upgraded to default UIkit Version 3.25.19
- Changed: Upgraded to jQuery Version 4.0.0
- Fixed: Invalid `/g` flag in the "remove all numbers" custom rule regular expression
- Fixed: WebP images were ignored in the frontend gallery scan (added `webp` and `cover.webp` support)
- Others: Verified against PHP 8.3
Outlook
Exciting things are on the horizon! While this service update brings meaningful improvements, work on Oriel Pro 2.x is already in full swing. This upcoming release is not just an update — it’s a complete reimagination, developed from scratch with a brand-new core. Built entirely around the latest Joomla! coding standards, Oriel Pro 2.x is designed to be faster, cleaner and ready for the future.
----------------------
More Information about Oriel Pro can be found here: https://nx-designs.ch/ext/oriel-the-uikit3-gallery
Checkout the Manual here: https://manuals.nx-designs.com/docs/category/oriel
