Backward Compatibility: Unlike the v8.6 release which included breaking changes for TalkAbout Comments users, v8.7 is fully backward-compatible with v8.6. No breaking changes are included in this release.

Deprecation Notice

Bootstrap4 Views Projects

• Deprecation: All Bootstrap4 Views projects across the cloudscribe platform are now deprecated
• Removal Timeline: Bootstrap4 Views will be completely removed from the codebase in the next major release
• Migration Path: Sites currently using Bootstrap4 Views should plan to migrate to Bootstrap5 Views
• Recommendation: Begin migration planning now to ensure a smooth transition before the next release

Security Improvements

Display Name XSS Vulnerability

• Fixed: Script injection vulnerability in the DisplayName field on /useradmin/useredit page
• Impact: Users could inject malicious scripts through their Display Name on /manage/userinfo which would execute when administrators viewed or saved the user on the admin user edit page
• Solution: Added HTML encoding and sanitisation to prevent XSS attacks through user-editable fields
• Issue: #1269

Return URL Recursion Prevention

• Fixed: Issue where web crawlers (particularly Facebook's meta-externalagent) could create deeply nested returnurl parameters causing extremely long URLs with multiple levels of URL encoding
• Solution: Added detection and prevention logic to stop returnurl recursion, particularly on Login and Register pages
• Benefit: Prevents log pollution and potential performance issues from recursive URL parameters
• Issue: #1255

New Features

Require 2FA for Specified Roles

• Feature: Added ability to enforce two-factor authentication for specific roles rather than all-or-nothing
• Previous Limitation: 2FA was either enforced for all users (except administrators) or not enforced at all
• Configuration: New role-based selector allows administrators to require 2FA for specific user roles
• Behaviour: Setting only applies when site-wide 2FA enforcement is disabled, preserving authority of the existing global checkbox
• Benefit: Provides granular security control - require 2FA for sensitive roles while allowing flexibility for other users
• Issue: #1026

Policy Search by Role

• Feature: Added ability to search authorisation policies by role name on the policy management page
• Previous Limitation: Only policy name search was available using wildcard '%LIKE%' syntax
• Functionality: Administrators can now search for roles to identify all policies where that role is referenced
• Benefit: Useful for understanding role dependencies and preventing accidental role deletion when roles are in use by policies
• Issue: cloudscribe.dynamic-authorization-policy #2546

Enhancements

Login Page Performance & Navigation Suppression

• Enhancement: Improved performance of /account/login and related authentication pages by adding configurable navigation suppression
• Implementation: Added Navigation Suppressor concept to cloudscribe.Web.Navigation that reads flags from HttpContext.Items
• Configuration Options: UI allows choice between:
  • Suppressing navigation on Login page only
  • Suppressing navigation on Login, Register, and Forgot Password pages
• Benefit: Reduces page load time and database queries for unauthenticated users by skipping unnecessary navigation tree processing
• Compatibility: No breaking changes - works without requiring modifications to _Layout files in existing sites
• Issue: #1200

OIDC Display Name on Manage Logins

• Enhancement: Improved user experience on /manage/managelogins page by displaying configured friendly Display Name for OpenID Connect (OIDC) providers
• Previous Behaviour: Displayed generic "OpenIdConnect" label for all OIDC providers
• New Behaviour: Shows the custom Display Name configured in social authentication settings for better clarity when users manage their external login connections
• Issue: #1136

Automatic User Approval Notification

• Enhancement: Improved user approval workflow by automatically sending email notification to users when their account is approved
• Previous Limitation: Administrators had to manually check a box for each approval, which was easy to miss and caused confusion when users didn't receive the promised notification
• New Behaviour: Approval emails now send automatically when SMTP is configured and "Require approval before login" is enabled
• Benefit: Ensures consistent user experience and reduces administrative overhead
• Issue: #704

Bug Fixes

CsvHelper Compatibility

• Fixed: Missing method exception on /formsadmin/downloadcsvresults caused by CsvHelper upgrade
• Root Cause: CsvHelper 27+ introduced breaking changes requiring CultureInfo parameter in constructor
• Solution: Updated Forms & Surveys CSV export functionality to be compatible with CsvHelper 33.1.0 which is required by cloudscribe.Core.Web 8.7.0
• Issue: cloudscribe.Commerce #87

Cookie Consent Footer Link

• Fixed: Issue where footer link to reset cookie consent preferences was displayed even when site is configured to not require cookie consent
• Solution: Link now only appears when cookie consent feature is enabled
• Implementation: Added SiteContext check to partial view to respect the RequireCookieConsent configuration setting
• Issue: #1260

Admin Display Name Uniqueness

• Fixed: Missing uniqueness validation when administrators edit user display names on /useradmin/useredit
• Previous Behaviour: Only users editing their own display names on /manage/userinfo had uniqueness enforcement
• Solution: Added uniqueness validation to administrator user edit page
• Benefit: Ensures consistency across both user self-service and administrator-managed display name changes, preventing duplicate display names per tenant
• Issue: #1268

Site Settings Cache Invalidation

• Fixed: Cache invalidation issue for ISiteSettings when administrators change the recipient email string for new user notifications
• Previous Behaviour: Changes to site settings did not properly invalidate the cache, requiring application restart for updated configuration values to take effect
• Solution: Site settings changes now properly invalidate the cache immediately
• Issue: #1249

UI/UX Improvements

Role Management User Access

• Feature: Added ability to click through to view member details directly from role management pages
• Previous Limitation: When viewing users within a role, the only available action was "remove from role"
• New Behaviour: Now includes clickable links to access full user details for improved navigation and user management workflow
• Issue: #692

Upgrading to v8.7

To upgrade your existing cloudscribe installation to version 8.7:

1. Update all cloudscribe package references in your .csproj files to version 8.7.*
2. If using Forms & Surveys: The CsvHelper compatibility fix (#87) ensures CSV export functionality works correctly with the updated CsvHelper dependency. No manual changes required.
3. Optional Configuration:
   • To enable role-based 2FA enforcement, navigate to Site Settings and configure which roles require two-factor authentication
   • To improve login page performance, enable navigation suppression on authentication pages in Site Settings
4. Run your application and verify all features are working as expected, paying special attention to:
   • Two-factor authentication behaviour for configured roles
   • Cookie consent footer link visibility
   • Site settings changes taking effect immediately without restart
   • Forms & Surveys CSV export functionality

Backward Compatibility: Version 8.7 is fully backward-compatible with v8.6. Unlike v8.6, which included breaking changes for TalkAbout Comments users, this release does not introduce any breaking changes. Sites upgrading from v8.6 can do so without modifications to existing code or view overrides.

Important: If you are still using Bootstrap4 Views, please note the deprecation notice above and plan for migration to Bootstrap5 Views before the next release.

Community and Support

We appreciate the continued support and feedback from the cloudscribe community. For questions or issues related to this release, please visit our GitHub repository or join the discussion in our community forums.

Thank you for using cloudscribe!

Breaking Changes

TalkAbout Comments System - Summernote Editor Migration

• Change: Replaced Markdown editor with Summernote HTML editor in commenting system
• Impact: Requires manual updates to local partial view overrides (CommentWrapperPartial.cshtml, CommentScriptsPartial.cshtml, CommentStylePartial.cshtml) and appsettings.json configuration
• Data Migration: Legacy Markdown comments are preserved and automatically converted to HTML on first edit (one-way migration)
• Architecture Change: CommentThread table now central to comment organization
• Deprecation: Bootstrap4 views deprecated
• Fixed: PostgreSQL/MySQL/SQLite migration issues
• Upgrade Effort: Expect approximately half-day manual work for sites with custom comment view overrides
• Documentation: See the 'Upgrading to v8.6' section below for partial view changes required
• Issues: TalkAbout #85 & #90

Security Improvements

Server-Side Posting Protection

• Enhancement: Added server-side enforcement of configuration parameters to prevent unauthorized comment and forum posting
• Protection: Ensures anonymous users cannot bypass client-side restrictions to post when anonymous posting is disabled
• Testing: Includes unit tests for validation logic
• Security Review: Reviewed EF Core usage to ensure protection against SQL injection in posted comment data
• Issue: TalkAbout #98

New Features

Forms & Surveys reCAPTCHA Support

• Feature: Added reCAPTCHA validation to Forms & Surveys system
• Configuration: Each form can be configured to require reCAPTCHA for unauthenticated users
• Integration: Respects site-wide cloudscribe Core reCAPTCHA settings for both visible and invisible modes
• Benefit: Addresses spam prevention in public-facing forms
• Issue: Commerce #82

Comment Administration Dashboard

• Feature: Added comprehensive administrative page for viewing and managing all comments across the site
• Location: New dashboard available at /talkadmin/administercomments
• Functionality:
  • View all comments with sorting and filtering options
  • Search capabilities to find specific comments
  • Direct links to the page/post where each comment was made
  • Default sorting by date (most recent first)
• Authorization: Protected by CommentModerationPolicy authorization policy
• Workflow: Edit and delete operations are performed on the original page where the comment was posted, maintaining context
• Issue: TalkAbout #53

Email Comment Authors

• Feature: Added ability for moderators to email users directly from the comment administration page
• Functionality: New "Email user" button in /talkadmin/administercomments allows moderators to compose and send plain-text emails to comment authors
• Context: Includes contextual link back to the original comment page (when approved)
• Authorization: Respects per-project moderator authorization policies
• Localization: Fully localized with new ResX strings
• Issue: TalkAbout #95

Role Copying with Authorization Policies

• Feature: Added ability to copy roles in role management
• Policy Integration: When copying a role, any dynamic authorization policies referencing the original role are automatically updated to also reference the new role
• Configuration: User specifies new role name during copy operation
• Behavior: New role starts empty (no users)
• Restrictions: Excludes system "Administrators" role from copying
• Compatibility: Works seamlessly with or without dynamic authorization policies installed
• Issue: #921

Enhancements

Visible reCAPTCHA Support - Commenting System

• Enhancement: Added support for visible/checkbox reCAPTCHA in the TalkAbout commenting system
• Previous Limitation: Only invisible reCAPTCHA was supported with hardcoded implementation
• New Behavior: Now respects cloudscribe Core reCAPTCHA settings and supports both visible and invisible modes
• Consistency: Matches the behavior of the core login system
• Issue: TalkAbout #75

Visible reCAPTCHA Support - Forums System

• Enhancement: Added support for visible/checkbox reCAPTCHA in the TalkAbout forums system
• Previous Limitation: Forums hard-coded invisible reCAPTCHA implementation
• New Behavior: Now respects cloudscribe Core reCAPTCHA settings for both visible and invisible modes
• Issue: TalkAbout #79

IP Address Restrictions Authorization

• Enhancement: Added dedicated IPAddressRestrictionPolicy to protect IP address restriction management endpoints
• Configuration Update: Updated navigation configuration to use AdminMenuPolicy instead of AdminPolicy for IP restriction admin menu items
• Compatibility: Tested compatibility with template systems without dynamic authorization policies installed
• Issue: #1243

IP Address Restrictions Configuration

• Feature: Added ability to enable or disable IP address restriction feature via configuration
• Configuration: New SiteConfigOptions.EnableIpAddressRestrictions setting in appsettings.json
• Benefit: Allows administrators to disable the feature when not needed
• Default: Defaults to enabled (true) for backward compatibility
• Issue: #1241

Bug Fixes

reCAPTCHA Validation - Commenting System

• Fixed: Missing server-side reCAPTCHA verification when anonymous users submit comments
• Impact: Ensures proper validation to prevent spam attempts
• Additional Fix: Resolved race condition issues in reCAPTCHA initialization
• Issue: TalkAbout #74

reCAPTCHA Validation - Forums System

• Fixed: Missing server-side reCAPTCHA verification for anonymous forum posts
• Impact: Analogous fix to comment system to ensure proper spam prevention
• Issue: TalkAbout #80

Duplicate CommentSystemSettings Records

• Fixed: Issue where duplicate rows were incorrectly created in csta_CommentSystemSettings table
• Root Cause: Confusion between Id, ProjectId, and TenantId fields
• Solution: Lookups now consistently use TenantId
• Impact: Prevents creation of hundreds/thousands of duplicate configuration rows while preserving existing comment data
• Issue: TalkAbout #67

Newsletter Sign-up Widget reCAPTCHA

• Fixed: Hard-coded invisible reCAPTCHA in newsletter sign-up widget
• Solution: Widget now respects cloudscribe Core settings for both visible and invisible reCAPTCHA modes
• Issue: Messaging #81

Role Removal from Policies

• Fixed: UI bug where roles could not be reliably removed from authorization policies
• Root Cause: Indexing issue that caused sporadic failures when de-selecting roles and saving policy changes
• Issue: dynamic-authorization-policy #30

IP Address Restrictions Multi-Tenancy

• Fixed: Critical bug where first tenant's IP restrictions would incorrectly apply to all tenants
• Root Cause: Cache key missing tenant ID component
• Additional Fix: Resolved thread locking issue caused by synchronous data access in constructor
• Service Change: Service changed from Transient to Scoped registration
• Impact: IP restrictions now work independently per tenant
• Issue: #1245

IP Restriction UI Address Display

• Fixed: Incorrect IP address display in IP restriction admin UI
• Previous Behavior: Used historical login data from cs_user_location table which could be outdated or wrong when users switch devices, VPNs, or have dynamic IP changes
• Solution: Now retrieves current IP address directly from HTTPContext for accurate real-time display
• Issue: #1197

UI/UX Improvements

User Display Name Editing

• Feature: Added ability for users to edit their display name on the /manage/userinfo page
• Previous Limitation: Users could only edit first and last name, but display name (used throughout the system including TalkAbout comments) was only editable by administrators
• Validation: Includes uniqueness enforcement per tenant, character validation with international character support, and HTML sanitization
• Issue: #1058

Developer Tools & Features

Policy Definition Documentation

• Enhancement: Clarified the relationship between Roles and Claims in policy definitions
• Documentation: Now explicitly states that:
  • Roles use OR logic (user needs ANY role)
  • Claims use AND logic (user needs ALL claims)
  • When both are specified, users must satisfy both requirements (be in ANY role AND have ALL claims)
• Issue: dynamic-authorization-policy #46

IdentityServer Integration Tests

• Feature: Added comprehensive integration tests for IdentityServer4 authentication and authorization
• Coverage: Tests cover client credentials grant type flow, JWT token validation, and role-based authorization
• Modernization: Updated to use modern Microsoft.AspNetCore.Authentication.JwtBearer (v8.x) library instead of deprecated IdentityServer4.AccessTokenValidation (v3)
• Test Harness: Includes published test harness page for live validation testing
• Issue: #1231

Upgrading to v8.6

To upgrade your existing cloudscribe installation to version 8.6:

1. Update all cloudscribe package references in your .csproj files to version 8.6.*
2. If using TalkAbout Comments: There will be breaking changes if you have custom overrides of the partial views used in the TalkAbout commenting system. The migration from Markdown to Summernote editor requires significant changes to the following files:
   CommentWrapperPartial.cshtml in both Views/Page and Views/Blog folders
   CommentScriptsPartial.cshtml in the Views/Shared folder 
   CommentStylePartial.cshtml in the Views/Shared folder.
   The easiest way to implement these changes would be to create a new fresh installation of cloudscribe from the version 8.6 template (including the TalkAbout options), and then manually copy the new partial views created by that template, over the top of your existing versions.
3. If using IP Address Restrictions: The critical multi-tenancy bug fix (#1245) may affect how IP restrictions behave in multi-tenant environments. Test thoroughly in a staging environment before production deployment.
4. Optional Configuration: If you want to disable the IP Address Restrictions feature, add SiteConfigOptions.EnableIpAddressRestrictions: false to your appsettings.json
5. Run your application and verify all features are working as expected, paying special attention to:
   • reCAPTCHA functionality on forms, comments, and forums
   • IP address restrictions (if enabled and in multi-tenant mode)
   • TalkAbout comment submission and display

Important: This release includes breaking changes for TalkAbout Comments users with custom view overrides. We strongly recommend testing the upgrade in a development environment and reviewing the upgrade documentation before deploying to production.

Community and Support

We appreciate the continued support and feedback from the cloudscribe community. For questions or issues related to this release, please visit our GitHub repository or join the discussion in our community forums.

Thank you for using cloudscribe!

Major Licensing Change

Commercial Components Now Free

• Announcement: All cloudscribe commercial components are now available for free use
• Components Included:
  • TalkAbout Commenting System
  • TalkAbout Forums
  • Membership Paywall
  • Newsletter Management
  • Forms and Surveys
  • Stripe Payment Integration
• Impact: License key requirements have been completely removed for all commercial components
• Source Code: Components remain proprietary (subject to potential future open-sourcing)
• Benefit: Full cloudscribe ecosystem now accessible without licensing barriers

New Features

Admin Application Restart

• Feature: Added capability for administrators to restart the application directly from the cloudscribe admin interface
• Benefit: Eliminates need for direct server access when application restart is required
• Configuration: Controlled via appsettings.json configuration boolean for security
• Issue: #1102

Enhanced Summernote Editor - Element Path Display

• Feature: New element path breadcrumb display showing current cursor position in DOM hierarchy (similar to CKEditor)
• Functionality: Real-time updates with clickable breadcrumbs for easy navigation
• Implementation: Custom Summernote plugin with comprehensive HTML5 tag support
• Issue: #1208

Enhanced Summernote Editor - Improved Link Behavior

• Change: Hyperlinks no longer open in new windows by default
• Configuration: Controlled via linkTargetBlank: false in summernote-config.json
• Issue: #1209

RSS Feed Styling Support

• Feature: Added ability to style RSS feeds with custom CSS stylesheets
• Implementation: Support for XML stylesheet meta tags in RSS feeds
• Functionality: Automatic XSL and CSS file deployment with user override protection
• Benefit: RSS feeds can now match site branding and provide better user experience
• Documentation: New documentation available at https://www.cloudscribe.com/cloudscribesyndication
• Issue: cloudscribe.Syndication #7

Enhancements

Enhanced Auto-Logout System

• Improvement: Resolved session timeout issues for users actively using JavaScript API endpoints
• Features:
  • Server-side middleware for intelligent session activity tracking
  • Client-side JavaScript for cross-tab session management
  • Configurable timeout thresholds
• Benefit: Prevents unexpected logouts during active user workflows while maintaining security
• Issue: #1204

System Information Improvements

• Enhancement: Updated System Information page to include previously missing packages
• Added: Compiled views, static files, integration packages, and Bootstrap components
• Fixed: Removed duplicate "cloudscribe.Email.Templating.Web" entry
• Benefit: Improved visibility for troubleshooting and support scenarios
• Issue: #698

Bug Fixes

IdentityServer4 Support Resolution

• Fixed: Resolved token creation issues caused by dependency version conflicts
• Root Cause: System.IdentityModel.Tokens.Jwt version 8.2.* breaking changes
• Solution: Updated dependency chain management and explicit package references
• Impact: Restored proper JWT signature validation and metadata endpoint functionality
• Issue: #1205

Email Queue Background Task Exception Handling

• Fixed: Resolved cancellation exception thrown during app pool recycling
• Error: "A task was canceled" in EmailQueueBackgroundTask.ExecuteAsync
• Solution: Improved cancellation token handling in background services
• Impact: Eliminates log noise during normal application lifecycle events
• Issue: cloudscribe.Messaging #13

Upgrading to v8.5

To upgrade your cloudscribe installation to version 8.5:

1. Update all cloudscribe package references in your .csproj files to version 8.5.*
2. If you want to include the new Application Restart button in your administration interface, you need to add a new flag to your appsettings.json configuration file as documented
3. If you want to include links in your Administration menu to cloudscribe's recently added tools for blocking access by IP address (see v8.3 release notes) - then you can add these to your navigation.xml file as documented.
4. Run your application and verify all features are working as expected

Note: As always, we recommend testing the upgrade in a development environment before deploying to production.

Community and Support

We appreciate the continued support and feedback from the cloudscribe community. For questions or issues related to this release, please visit our GitHub repository or join the discussion in our community forums.

Thank you for using cloudscribe!

This release focuses on strengthening security, improving the developer experience, and enhancing the overall stability of the platform.

Principal Changes

• Enhanced Cookie Consent System - Implemented a sophisticated three-state cookie consent system (undecided/accepted/declined) allowing users to dismiss cookie banners without fully accepting cookies
• CSP-Compliant JavaScript in Developer Tools - Added ability to incorporate JavaScript directly into pages while maintaining Content Security Policy compliance through tag helpers, enabling developers to add custom scripts without violating security policies
• Comprehensive Localization Improvements - Standardized ResX string references throughout core views using consistent snake_case resource keys
• Security Updates - Updated critical dependencies including EntityFramework and jQuery.validate to address security vulnerabilities

Release Notes

Breaking Changes

• #748: Enhanced Cookie Consent System - Breaking change for sites with local view overrides. Two key files were modified in the Bootstrap5 template. See the documentation for migration details.
• #1182: Localization Improvements - Breaking change for sites implementing two factor authentication. Management screens will require the addition of some new entries into your existing ResX resource files, listed here.

Security Improvements

• #1054: Updated Microsoft.EntityFrameworkCore dependencies to address security vulnerabilities in transitive dependencies
• #1113: Updated jQuery.validate library to address security vulnerability discovered during penetration testing
• #1125: Improved cookie security configuration by addressing SameSite cookie settings for better protection

Bug Fixes

• #1150: Fixed Summernote editor issue where HTML code entered in raw HTML view was not retained when saving unless user switched back to WYSIWYG mode first
• #1177: Fixed API authentication bug in EnforceSiteRulesMiddleware that incorrectly started HTTP responses for Terms & Conditions violations on API routes
• #1169: Re-wrote IP address blocking/permitting logic to ensure "Permitted" rules consistently take precedence over "Blocked" rules when dealing with IP address ranges
• #500: Fixed scrolling issue in SimpleContent Page Manager where selecting a page would auto-scroll to top with misplaced context menu

UI/UX Improvements

• #1157: Added CSS override to ensure Summernote editor maintains consistent black-on-white appearance across different themes
• #639: Moved page metadata below child page menu in SimpleContent for improved layout and user experience
• #501: Improved unauthorized access handling in SimpleContent with proper redirects to login/access denied pages instead of generic 404 errors
• #1134: Modified user interface to clarify the purpose of a confusing checkbox on "/siteadmin/registerpageinfo" page

Developer Tools & Features

• #482: Added mechanism in Developer Tools to allow adding JavaScript directly to pages with Content Security Policy compliance through tag helpers
• #1194 & #45: Added event handler for post-user deletion to clean up remaining Key-Value Pair (KVP) data from deleted users
• #55: Added conditional UserExportPartial to KVP views to ensure compatibility with different versions of cloudscribe.Core.CompiledViews.Bootstrap5

Code Cleanup

• #1138 & #1160: Removed outdated Bootstrap3 and deprecated .pgsql libraries across cloudscribe solutions to improve maintainability
• #1163: Fixed and reorganized unit test infrastructure with new working tests

Upgrading to v8.4

To upgrade your cloudscribe installation to version 8.4:

1. Update all cloudscribe package references in your .csproj files to version 8.4.*
2. If you have local view overrides for the cookie consent system, review the cookie consent documentation for required changes
3. If your site uses two-factor authentication, add the required ResX entries to your localization files
4. Review and test IP blocking/permitting rules if you use this feature, as the logic has been updated
5. Run your application and verify all features are working as expected

Note: As always, we recommend testing the upgrade in a development environment before deploying to production.

Looking Ahead

With the removal of Bootstrap3 views and deprecated PostgreSQL libraries in this release, we continue to modernize the cloudscribe platform. Future releases will focus on further performance improvements, enhanced security features, and improved developer experience.

Community and Support

We appreciate the continued support and feedback from the cloudscribe community. For questions or issues related to this release, please visit our GitHub repository or join the discussion in our community forums.

Thank you for using cloudscribe!

The principal change in this minor version release is to move away from the use of ckEditor for embedded HTML editing, replacing it now with Summernote.

However, any cloudscribe simplecontent users who have built their own custom page/post templates making use of the old support for ckEditor should find that these templates continue to work.

The release also brings a new administrative feature: the ability to block access to cloudscribe sites to specific IP addresses/ranges, and conversely the ability to allow access only to specific IP addresses/ranges - see details.

The release also addresses some minor bugs (see notes below).

See also the known issues and deprecation warnings (below), for future releases.

We've released a new version of the cloudscribe Visual Studio template. Reviews are always appreciated!

We recommend that the VSIX template should be installed into Visual Studio 2022 (version 17.8 onwards).

Alternatively, you can use the 'dotnet new' command as documented.

Older versions of the VSIX template remain available here: https://github.com/cloudscribe/cloudscribe.templates/tree/master/Archive.

As always, feedback is welcome in the forums or on GitHub.

Release Notes

version 8.3.0 - July 2025

@cloudscribe/cloudscribe

• #1099: Summernote Editor Integration - added support for the Summernote editor as a replacement for CKEditor, while retaining the option to use CKEditor if desired.

• #1063: Fixed several issues in the "browse server" modal when invoked from the Summernote toolbar:

  • Restored the missing 'Select' button for image selection.
  • Reinstated the 'Crop' tab in the UI.
  • Corrected the modal title.
  • Addressed regressions caused by previous file manager and Summernote integration changes.

• #1111: Fixed newsletter sign-up widget compatibility with invisible reCAPTCHA:

  • Resolved an issue where the newsletter sign-up widget would not submit when invisible reCAPTCHA was enabled.
  • Improved JavaScript handling in EmailListSignUpPartial to support async validation and proper script loading.
  • Ensured compatibility for both authenticated and unauthenticated users.

• #918: IP Address Blocking

  • Added ability to block specific IP addresses via the admin UI.
  • Supports both individual IPs and IP ranges.

• #1011: IP Allowlist (Single IPs & Ranges)

  • Added support to restrict site access to only permitted IP addresses.
  • Supports both individual IPs and IP ranges.

• #1097: API Client Secret Expiry Fix (PGSQL)

  • Fixed saving API client secret expiry dates in PostgreSQL when using UTC.
  • Prevented accidental deletion of client and related data due to date handling.

Upgrading an existing cloudscribe site

We recommend manually editing the .csproj file of your solution (or each of them, if you have multiple projects), to upgrade the package references:

<PackageReference Include="cloudscribe.Core.SimpleContent" Version="8.3.*" />
<PackageReference Include="cloudscribe.SimpleContent.Web" Version="8.3.*" />
<PackageReference Include="cloudscribe.Core.SimpleContent.CompiledViews.Bootstrap5" Version="8.3.*" />

(and so on for all cloudscribe packages).

Known issues

In the new Summernote editor, any changes made to your content in its raw HTML editing mode will not be saved until/unless you toggle back out of HTML mode and into the regular visual editor. This is a known issue in Summernote, and we hope to address that in a future release.

The Summernote editor requires a recent version of JQuery (we would recommend v3.7.0 or later) - so if the editor fails to render correctly, check that version in the /wwwroot/js folder of your theme.

In some of the shared themes that are supplied with the template, the colour scheme of the Summernote editor toolbar changes so that there is insufficient colour contrast between the toolbar buttons and the background colour.

Deprecation warnings

We intend to discontinue the following legacy cloudscribe libraries and remove their projects from the main source code branches, in forthcoming releases:

• All 'Views.Bootstrap3' and 'CompiledViews.Bootstrap3' projects (only Bootstrap5 is now actively maintained, but the Bootstrap4 views projects will be kept in place for reference for the time being).
• All of the original legacy 'EFCore.pgsql' libraries: these have long ago been superseded by their 'EFCore.PostgreSql' counterparts, which enforce the use of snake case convention on PostgreSql database schema.

This has resulted in the 'Select' button not always appearing in the File Manager in some circumstances when you select an image to insert into content.

We have a fix for this which will be released soon, in the meantime you are able to override the setting yourself in order to see the 'Select' button.

How to:

1. Add this file to your project as a view override in \Views\FileManager https://github.com/cloudscribe/cloudscribe/blob/develop/src/cloudscribe.FileManager.Web/Views/FileManager/BrowsePartial.cshtml
2. On line 192, change 'data-can-select="false"' to be 'data-can-select="true"'
3. Save and release to your site in the usual way

We've released a new version of the cloudscribe Visual Studio template. Reviews are always appreciated!

We recommend that the VSIX template should be installed into Visual Studio 2022 (version 17.8 onwards).

Older versions of the VSIX template remain available here: https://github.com/cloudscribe/cloudscribe.templates/tree/master/Archive.

As always, feedback is welcome in the forums or on GitHub.

Release Notes

version 8.1 - 6 May 2025

@cloudscribe/cloudscribe.Web.Navigation

• #135: Fixed an issue causing incorrect child page sub-menus when the URL ends with a trailing slash. This ensures consistent navigation tree behavior across routes with or without trailing slashes.

@cloudscribe/cloudscribe

• #1073: Introduced a reserved word list for tenant site names to prevent conflicts. For example, "development" is now restricted to avoid issues with accessing developer sections.
• #1063: Added a feature to export user data from the User Manager, including basic attributes such as First Name, Surname, Display Name, Email Address, and Created Date.
• #798: Enhanced the file manager with the ability to move files between folders, eliminating the need to delete and re-upload files.
• #762: Updated the main heading on /privacy and other cloudscribe core pages to use <h1> tags or allow configurability, replacing the previous <h2> implementation.
• #942: Extended reCAPTCHA protection to the "Forgot Your Password?" page to mitigate risks associated with automated email spam and enhance security.
• #935: Resolved an issue where the returnurl parameter was ignored on the login page if the user was already logged in. Now, the intended return behavior is consistently applied.
• #929: Improved the user experience for sites with social sign-in by hiding password management options (/manage/setpassword and /manage/changepassword) when database authentication is disabled.
• #924: Fixed a UI issue in the Page Manager tree where togglers were inheriting an underline style and made them larger and easier to click.
• #959: Fixed a crash when saving user details with a date of birth in PostgreSQL. Ensured compatibility with timestamp with time zone by enforcing UTC for DateTime values.
• #1056: Corrected the behavior of the "Clear Image" button to ensure it functions as expected after dragging and dropping an image.
• #1034: Added a "View Activity" link on the Manage User page to improve navigation to the User Activity page.

@cloudscribe/cloudscribe.SimpleContent

• #487: Added options in CMS settings to display created and last edited information (author and timestamps) below content. These settings include configurable defaults.
• #549: Updated the LinksRenderPartial to align with Bootstrap 5 standards. Replaced <h2> and float-based styling with semantic markup and modern flex layouts.

Upgrading an existing cloudscribe site

We recommend manually editing the .csproj file of your solution (or each of them, if you have multiple projects). to upgrade the package references:

<PackageReference Include="cloudscribe.Core.SimpleContent" Version="8.1.*" />
<PackageReference Include="cloudscribe.SimpleContent.Web" Version="8.1.*" />
<PackageReference Include="cloudscribe.Core.SimpleContent.CompiledViews.Bootstrap5" Version="8.1.*" />

(and so on for all cloudscribe packages)

There should be no breaking changes from our previous v8.0 release.

HTTP Error 500.31 - Failed to load ASP.NET Core runtime

even though the correct ASP.NET Core Runtime 6.0.35 was installed (and reinstalled!).

We fixed this by upgrading the site to .NET 8, which was anyway in testing. If you spot anything not working, please do contact us!

We've released a new version of the cloudscribe Visual Studio template. Please do leave a review!

We recommend that the VSIX template should be installed into Visual Studio 2022 (targeting .NET 8.0 is officially supported in Visual Studio 17.8+ only - this is a version of Visual Studio 2022 that was released in November 2023).

Older versions of the VSIX template remain available here: https://github.com/cloudscribe/cloudscribe.templates/tree/master/Archive.

Upgrading an existing cloudscribe site

We recommend manually editing the .csproj file of your solution (or each of them, if you have multiple projects). to upgrade the target framework:

<TargetFramework>net8.0</TargetFramework>

All package references to cloudscribe libraries should be updated, e.g. (just a small selection for example):

    <PackageReference Include="cloudscribe.Core.SimpleContent" Version="8.0.*" />
    <PackageReference Include="cloudscribe.SimpleContent.Web" Version="8.0.*" />
    <PackageReference Include="cloudscribe.Core.SimpleContent.CompiledViews.Bootstrap5" Version="8.0.*" />

If you have any direct references to Microsoft libraries then bring them up to the latest appropriate .net 8 versions too:

    <PackageReference Include="Microsoft.EntityFrameworkCore" Version="8.0.0" />
    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="8.0.0" />
    <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="8.0.0" />
    <PackageReference Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="8.0.0" />

You can follow your own policies and strategies about whether you wish to use wild-carded version numbers such as 8.0.*, or fixed 8.0.0 versions as above.
However we do not recommend a random mixture of the two.

You may well also have to upgrade any other third-party libraries that you reference in your solution, and diagnose version incompatibilities among them.

Build and run your solution, and check for any runtime errors and breaking changes...

Important breaking changes

Because of recent changes in EF Core 8 we can no longer reliably support versions of MS SQL Server earlier than 2016 (13.x). 
If you are using a more recent of MS SQL Server, you still need to check that your databases are not set to compatibility levels for older versions (< 130).
See the details and mitigations here: 
https://learn.microsoft.com/en-us/ef/core/what-is-new/ef-core-8.0/breaking-changes#sqlserver-contains-compatibility

Also with SQL Server, you may need to modify your connection strings to specify whether or not to trust the SQL Server's self-signed certificate:
https://stackoverflow.com/questions/3674160/using-encrypt-yes-in-a-sql-server-connection-string-provider-ssl-provider
Failure to do this typically produces a "white-screen"  runtime error on start-up.

As always, feedback welcome in the forums or on GitHub.

We've written documentation for developers and website administrators and we'd love your feedback!

If you have an existing cloudscribe site (at version 6), simply build and publish your site - the updated cloudscribe code will come into your solution automatically so long as you have a reference like this:

<PackageReference Include="cloudscribe.Core.Web" Version="6.0.*" />

Then, in your running website, visit Administration > Site Settings ( /siteadmin/siteinfo ) and add the GA4 Measurement Id into the Google Analytics Tracking Id setting. You should find that GA4 starts receiving information immediately.

Find out more about the integration here https://www.cloudscribe.com/google-analytics-ga4-integration

We've released a new version of the Visual Studio template. Please do leave a review!

We recommend that the VSIX template should be installed into Visual Studio 2022. Although it will also install and create a template site in VS2019, you may encounter difficulties building and working with a .NET 6.0 application in VS2019.

See https://docs.microsoft.com/en-us/dotnet/core/whats-new/dotnet-6 for information about what's new in .NET 6.

There is one key potential breaking change to be aware of: if you are targeting PostgreSql database, please note that changes to the Npgsql Entity Framework Core Provider at version 6.0 now mean that the recommended way of handling Timestamp values is to migrate any "timestamp without time zone" columns to "timestamp with time zone", and always use either DateTime with Kind=Utc or DateTimeOffset with offset 0. See details here: https://www.npgsql.org/efcore/release-notes/6.0.html?tabs=annotations

This release of cloudscribe will implement the above migration on some key columns in the database (e.g. the cs_user table, and SimpleContent cs_page and cs_post) but you should be aware of the potential for timezone offset bugs in any similar columns of your own. We would recommend that you take a backup of your existing application database before applying this major version upgrade.

Older versions of the VSIX template remain available here: https://github.com/cloudscribe/cloudscribe.templates/tree/master/Archive.

As always, feedback welcome in the forums or on GitHub.

See our previous post for some more information and useful links.

And one of the first things we did was upgrade this site to run in .NET 5 - really easy and everything works beautifully so far. We've also upgrade some client projects without problems.

Next we'll work on Bootstrap 5 views, and after that, .NET 6! As always, feedback welcome in the forums or on GitHub.

Find out more about .NET 5 here, and the list of breaking changes we will have to look out for!

Side by side with this work, for release shortly afterwards if everything goes to plan, we'll be working on a new Bootstrap 5 presentation layer, that will then become the default for a new cloudscribe project built using our Visual Studio project template. 

We should probably also mention some of the improvements we've made to cloudscribe:-

• SimpleContent now has more sophisticated handling of versions and drafts, especially when using Content Templates.
• We gave the TalkAbout Forums product a bit of a makeover, fixed lots of bugs, and added a configurable file upload capability.
• When using multi-tenancy we added a new mode to help administrators, called "RootUserCanSignInToTenants Mode"  - see the documentation for more details.
• We've fixed NoDB bugs that prevented using markdown.
• We improved the registration page experience and fixed a bug that could cause hangs.
• And we've fixed a load of other niggles and made lots of small improvements thanks to the feedback from cloudscribe users. Please do post in our Forums, comment on any of our documentation pages, or post issues in the various cloudscribe component GitHub repositories!

And of course we've been using cloudscribe components to build some great new applications for clients, such as the York Historic Environment Record. They love that their projects are built on a fully open source stack, and using cloudscribe means we can focus our effort on what's unique about their requirements and deliver best value. If you'd like help building an application on cloudscribe, please feel free to contact us.

Open Source Improvements

Dynamic Authorization Policies is a new open source project from cloudscribe that started life as an add on product but was recently made open source on github. It allows you to manage ASP.NET Core authorization policy requirements from the UI. cloudscribe Core always provided management of user role membership and custom claims, but typically authorization policies are coded up in startup code which means that in order to change them you have to change the code, build, and redeploy your application. So you could create new roles from the cloudscribe core UI but you could not use the new role in a policy without going through build and deploy steps. Dynamic Authorization Policies lets you manage policies from the UI and therefore provides the final piece of the puzzle for managing access to your site content and features.

cloudscribe Core has some new improvements, including support for LDAP authentication, this work was sponsored by Exegesis Spatial Data Management. We also added an option to force only one web browser session per user, and an option to require 2 factor authentication.

PwaKit is a new open source project that facilitates building progressive web apps that work offline and support push notification. This work was sponsored by our friends at Exegesis Spatial Data Management.

A whole new way of doing localized content has been implemented in SimpleContent but needs documentation and a sample project. There is a github issue about it here and it was sponsored by Domain Integrators.

Commercial Products

In addition to our open source progress, we've also shipped several commercial add on features.

cloudscribe Forms and Surveys Solution provides a super user friendly drag and drop form designer, and provides a content template for SimpleContent that allows you to put a form/survey on content pages. This youtube video gives a tour of the product.

cloudscribe "TalkAbout" Comment System provides a self hosted GDPR friendly alternative to 3rd party comment systems such as Disqus. If you use a free service chances are that you and your web visitors are the product. Such services add numerous 3rd party tracking cookies and collect data about you and your users for their own purposes. All these extra tracking cookies complicate your ability to meet GDPR requirements. By using a self hosted comment system instead you can avoid all those 3rd party tracking cookies and more easily achieve GDPR compliance.

cloudscribe "TalkAbout" Forums provides a self hosted, GDPR friendly question and answer style forum to help you build a community. We just launched our Community Support Forum recently using this.

cloudscribe Membership Paywall provides the tools you need to monetize your premium content. You protect your premium content with roles, and users who purchase membership get automatically granted the needed roles to access your content and automatically removed from the roles if their membership expires. It provides automatic membership renewal using stripe for payment processing.

All of our add on products are free to try, and are included in our latest project template for Visual Studio, so you can easily create web apps with the nuget packages for these features all wired up for you. They do have some nag alerts that are shown every few web requests, by purchasing a license file you can remove the nag alerts.

The latest version of cloudscribe SimpleContent has a great new set of features powered by the new content template system. Content templates make it easy to edit content and have advanced layouts without much risk that the user can mess up the intended layout. Content templates work with both pages and blog posts. You can easily develop your own custom content templates as well, see the developer documentation for content templates to learn more.

A Nice Set of Content Templates in the Box

We've included a set of nice content templates that add new features including:

• An Image Gallery with easy drag, drop, and crop. You get an optional content section above and below the gallery. There are 6 gallery layouts to choose from, cards, grid, and compact layouts use a nice lightbox to show the full size image when the thumbnail is clicked. The other 3 layouts use boostrap carousel, either full width, or floated left or right so content wraps around the carousel.
• 1 to 4 section template with an image for each section and several layouts to choose from. It can be equal width responsive columns or sections with images floated to alternate sides.
• 2 column layout template with either the right or left column wider.
• A Bing map centered on an address you provide, with optional content above and below the map. Users can also get driving directions to the address.
• A list of links with title, and optional image and description per link
• Image floated left or right with content wrapping the image

Gallery Editor

Easily drag, drop, and crop images

Gallery Thumbs

Clicking the thumbs opens a lightbox showing the full size images

2 Column Layout with one wider column

1 - 4 Responsive equal size column layout

one of several layouts for article sections

Bing Map with content above and below

Centered on the address you provide and users can get driving directions

List of Links

with optional image and description per link

I would like to thank everyone in the community for providing feedback, bug reports, and for helping to spread the word to other developers. It has been a pretty good year especially considering that we don't have any marketing budget at all so people have found cloudscribe mainly from github, by word of mouth, from this website, and from a few occasional tweets and blog posts. With your help in spreading the word I think 2018 will be a even better! 

Previously, copying a project from the cloudscribe Starter Kits was the best way to get started with a new cloudscribe project, but now with the new project templates you can create projects with configurations that correspond to the different starter kit project configurations simply by using the available project template parameters. See the document "Introduction to cloudscribe" for more details.

Starting New Projects in Visual Studio

You can download the Visual Studio 2017 extension for free from the Visual Studio Marketplace, or from directly within Visual Studio, under Tools > Extensions and Updates > Online

If you download it from the marketplace you need to double click the .vsix file to install it. In both cases you have to restart Visual Studio for it to become available, then you will see a new cloudscribe project template under C# > Web in the new project dialog.

When you create a new cloudscribe project, another small dialog window will appear to let you choose which data storage platform and which cloudscribe features you want.

Starting New Projects with the .NET CLI (Command Line Interface)

The .NET CLI can be used on Windows, Linux, or macOS. You can install the cloudscribe project template NuGet package with this command:

dotnet new -i "cloudscribe.templates::*"

If you later wish to uninstall it, you can use this command:

dotnet new -u cloudscribe

Once you have the cloudscribe project template installed you should enter the following command to see the available parameters that you can pass to the template in order to choose which data storage platform to use and which features to install:

PS C:\_c\scratch> dotnet new cloudscribe --help
Usage: new [options]

Options:
  -h, --help          Displays help for this command.
  -l, --list          Lists templates containing the specified name. If no name is specified, lists all templates.
  -n, --name          The name for the output being created. If no name is specified, the name of the current directory is used.
  -o, --output        Location to place the generated output.
  -i, --install       Installs a source or a template pack.
  -u, --uninstall     Uninstalls a source or a template pack.
  --type              Filters templates based on available types. Predefined values are "project", "item" or "other".
  --force             Forces content to be generated even if it would change existing files.
  -lang, --language   Specifies the language of the template to create.


cloudscribe web project template (C#)
Author: Joe Audette
Options:
  -T|--Title                  The name of the project which determines the assembly product name.
                              string - Optional
                              Default: Project Title

  -S|--SimpleContent          Include cloudscribe SimpleContent blog and content engine.
                              bool - Optional
                              Default: true

  -C|--ContactForm            Include cloudscribe SimpleContactForm.
                              bool - Optional
                              Default: false

  -K|--KvpCustomRegistration  Include cloudscribe key/value pair custom registration.
                              bool - Optional
                              Default: false

  -I|--IdentityServer         Include IdentityServer4 (fork) integration.
                              bool - Optional
                              Default: false

  -L|--Logging                Include cloudscribe logging and log viewer UI.
                              bool - Optional
                              Default: true

  -D|--DataStorage            The data storage platform you wish to use.
                                  NoDb     - A no-database file system storage
                                  MSSQL    - Microsoft SqlServer storage using Entity Framework Core
                                  pgsql    - PostgreSql storage using Entity Framework Core
                                  MySql    - MySql storage using Entity Framework Core
                              Default: MSSQL

  -H|--HttpsPort              Port number to use to configure SSL in launchSettings.json.
                              integer - Optional

  -Ke|--KestrelPort           Port number to use to configure Kestrel in launchSettings.json.
                              integer - Optional

  -II|--IISExpressPort        Port number to use to configure IIS Express in launchSettings.json.
                              integer - Optional


PS C:\_c\scratch>

As you can see this is much easier than cloning the starter kits repo and copying an existing project. You have full control over the project name and even more configurable options than what the starter kits provide.

I hope you will give the new project templates a try and provide feedback. It would be great if you could provide a review or rating of the Visual Studio extension on the marketplace site.

One thing cool that I have noticed is that the marketplace shows the number of installs, not the number of downloads, so the number goes down if people uninstall it. That gives us a real honest metric for how the extension is doing in terms of popularity over time.  The NuGet package for dotnet new shows download statistics. Note that the Visual Studio extension has the template embedded inside the vsix file so it doesn't affect the downloads from nuget, only installations from the CLI affect the nuget download numbers.

UPDATE 2017-09-26

Feedback on the project templates has been great and I have continued to improve it. Yesterday I released a new version (1.8) with even more configurable options for SimpleContent and also added an option to set the multi-tenant mode to either use folders, host names or just use a single tenant.

I am even bringing along some cloudscribe swag to give away! Hope to see you there!

I had the good fortune to collaborate as a sub contractor with Exegesis Spatial Data Management on this delightful project, for their client, Royal Commission on the Ancient and Historical Monuments of Wales (RCAHMW).

Main Project Goals

The main goal of the project was to provide an accessible and responsive web interface onto a new database of historic place names in Wales, including Google-like searching and interactive maps. At the time of this writing the main features are complete but the dataset of around 400,000 place-names is still being improved and added to, working towards a public launch on May 8, 2017. As a project for the Welsh Government, another high priority was that all public facing features and content in the site should be available in both English and Welsh languages. Actually, while it is conceptually one site there are 2 domains that correspond to the English version, and the Welsh version, with a language switcher at the top of each site designed to link to the corresponding page in the other site. This was implemented as a single web application with 2 tenant sites using the multi-tenancy feature of cloudscribe Core. This was ideal since both sites have the exact same features and use the same codebase, while each tenant is configured with the corresponding language and localization.

Secondary Project Goals

As with most website projects, there are some standard features that most projects need such as a few marketing and informative pages, a contact form, a blog, social sharing, etc. Most of these needs were met with free open source cloudscribe components, for social sharing we used AddThis, and for comments we used Disqus. I should note that as the primary developer of the cloudscribe components, I was able to use the lessons learned and feedback from the team on the Place Names of Wales project to make these components even better.

Specific cloudscribe Components used in this project

• cloudscribe.Core - for user accounts and role management
• cloudscribe.SimpleContent - for pages and blog posts that are easy to edit right in the web browser
• cloudscribe.SimpleContactForm - for you guessed it, a contact form
• cloudscribe.Web.Localization - for easier localization and customization of labels, buttons, instructions, etc
• cloudscribe.Web.Navigation - for menus and breadcrumbs
• cloudscribe.Web.Pagination - for generating links for paged data
• cloudscribe.Logging - for capturing and browsing log events
• cloudscribe.DbHelpers - was used for easier data access against our back end stored procedures for the search and mapping data

That is a lot of ready to use functionality that you would not want to have to build from scratch for every project, and you don't have to.

The project team at Exegesis found that working with the cloudscribe components was straightforward and logical and helped them learn the new ASP.NET Core technology along the way, while the site administrators at RCAHMW found the creation and editing of content simple and intuitive. 

We started the project using one of the cloudscribe StarterKits, which are basically reference applications that provide examples of how to wire up the cloudscribe components in various configurations.  Then we developed custom code for the primary features and language switching, and the visual design to meet the needs of the client.

The language switching was an interesting challenge since there are 2 separate sites even though they are running from the same installation. Our first implementation automated it for blog posts by using the date and sequence of the post to match the corresponding post in the other site, so as long as posts were added on the same date and sequence in both sites, we could find the corresponding post in the other site to link to. We had some mapping for the pages from configuration which was ok given that the project only envisioned a small number of pages. Then after further consideration and thinking that the language switching might be a common challenge also in future projects, we pondered how to make it better and I pondered how to better support it in cloudscribe SimpleContent. As a result of that process, I added a new "correlation key" field for pages and blog posts. The idea is that though pages and posts in each site will have different titles and urls corresponding to the given language, a correlation key could be used to relate the content from each site and the corresponding page or post could be looked up using the correlation key. The new solution does require that the correlation key is populated in order to be able to find the content in the other site, but is a more reliable way to tie the content together.

In summary, by using the cloudscribe components we were able to focus most of the effort towards the primary custom features required by the client. The end result is a high quality web application running on a modern technology stack, delivered on a modest budget. The client is happy and the team enjoyed the project.