processwire / processwire

ProcessWire 3.x is a friendly and powerful open source CMS with a strong API.

Welcome to ProcessWire 3.x

This document is in Markdown. An HTML formatted version of this document can be read at: https://github.com/processwire/processwire/blob/master/README.md

Table of Contents

1. About
2. Installation
3. Upgrading
4. Troubleshooting
5. Support

About ProcessWire

ProcessWire is a friendly and powerful open source CMS with an API that is a joy to use at any scale. It is both a content management system (CMS) and framework (CMF) built to save you time and work the way you do. With all custom fields, a secure foundation, proven scalability and performance, ProcessWire connects all of your content seamlessly, making your job fast, easy and fun.

ProcessWire gives you more control over your fields, templates and markup than other platforms, while ProcessWire’s API makes working with your content easy and enjoyable. Managing and developing a site in ProcessWire is shockingly simple compared to what you may be used to.

ProcessWire is widely trusted by web professionals for its exceptional consistency, stability and security; revered by web developers for its API that saves time and makes work fun; valued by web designers for its adaptability and flexibility with modern website/application content management needs; and loved by clients for its no-nonsense interface and ease-of-use in adding, updating and maintaining content. New versions of ProcessWire are released just about every week on the development branch.

Background

ProcessWire is a timeless tool for web professionals that has always been committed to the long term. It started in 2003, gained the name ProcessWire in 2006, and has been in active development as an open source project since 2010. Now more than a decade later (2023), we’re just getting started, as ProcessWire continues to grow and develop into the next 10 years and beyond.

While ProcessWire has been around for a long time, don’t feel bad if you haven’t heard of it till today. We are fundamentally different from other projects in that we don’t make a lot of noise, we’re not into promotion, we value quality over quantity, sustainability over growth, and a friendly community over popularity. ProcessWire is designed to be a silent partner, not easily identified from the front-end of any website. We don’t aim to be big, we are instead focused on being best-in-class.

Web developers find ProcessWire when the time is right, after they’ve tried some other platforms. And once they start using ProcessWire, they tend to stay. ProcessWire is addictive, easy to maintain for the long term, and doesn’t have the security and upgrade woes of other platforms. But don’t take our word for it; unless your livelihood depends on some other platform, find out for yourself.

Community

ProcessWire is more than just software, it is also a friendly community of web professionals dedicated to building great sites and applications, and helping others do so too.

Please visit and join our friendly community in the ProcessWire forums, subscribe to our weekly newsletter for the latest ProcessWire news, check out our website showcase to see what others are building with ProcessWire, and read our blog to stay up-to-date with the latest ProcessWire versions.

Weekly ProcessWire news is posted by Teppo Koivula on his site ProcessWire Weekly. Weekly core updates and related topics are posted by Ryan Cramer in the ProcessWire support forum News and Announcements board.

Learn more

• ProcessWire website
• About ProcessWire
• Support forums
• Documentation
• API reference
• Downloads
• Modules/plugins
• Showcase

---

Installing ProcessWire

Simply extract the ProcessWire files to an http accessible location and load the URL in your web browser. This will start the installer. See our Installation Guide for more details and instructions. If you run into any trouble, please see our Troubleshooting Guide.

Upgrading ProcessWire

Upgrading is easy and usually just a matter of replacing your /wire/ directory with the one from the new version. But to be safe, before proceeding with any version upgrade, please see the Upgrading ProcessWire guide and perhaps keep it open during your upgrade in case you need to refer back to it.

When upgrading from one 3.x version to another, please use the general upgrade process. This consists primarily of making sure you've got everything backed up and then just replacing your /wire/ directory with the one from the newer version.

• If you are upgrading from a 3.x version prior to 3.0.135 then please also follow these instructions.

• If you are upgrading from any 2.x version then please see upgrading from ProcessWire 2.x.

• If you run into any trouble upgrading, please see our troubleshooting upgrades guide.

Pro module version upgrade notes (if applicable)

• FormBuilder version 0.5.3 or newer recommended.

• ListerPro version 1.1.5 or newer recommended.

• ProFields the latest versions of all ProFields (10 modules) are recommended.

• LoginRegisterPro version 7 or newer recommended.

• ProCache version 4.0.3 or newer recommended. After upgrading, go to your ProCache settings in the admin (Setup > ProCache) and see if it suggests any modifications to your .htaccess file.

• For all other Pro modules not mentioned above we recommend using the latest available versions when possible.

Debug Mode

Debug mode causes all errors to be reported to the screen. This can be helpful during development or troubleshooting. When in the admin, it also enables a “Debug” link (see footer) for reporting of extra information in a panel. Debug mode is not intended for live or production sites, as the information reported is for the developer only. Do not leave debug mode on for any live/production sites, as it could be a security concern. However, we think you'll find it very handy during development or when resolving issues.

1. Edit this file: /site/config.php
2. Find this line: $config->debug = false;
3. Change the false to true like below, and save.

$config->debug = true; 

This can be found near the bottom of the file, or you can add it if not already there. It will make PHP and ProcessWire report all errors, warnings, notices, etc. Of course, you'll want to set it back to false once you've resolved any issues.

Support and Links

• ProcessWire Support Forums
• ProcessWire Weekly News
• ProcessWire Blog
• Sites running ProcessWire
• Subscribe to ProcessWire Weekly email
• Submit your site to our directory
• Follow @processwire on X-Twitter
• Contact ProcessWire developer
• Report issue

---

Copyright 2023 by Ryan Cramer / Ryan Cramer Design, LLC

processwire's Issues

$page->setAndSave does not work with array as parameter

It seems like setAndSave shortcut method does not play well with an array of fields unput.

This code does not work:

$page->setAndSave(array(
    'next_action' => 'JustTest',
    'next_action_time' => time() + 12 * 3600,
));

This one does:

$page->setAndSave(array(
    'next_action' => 'JustTest',
));

and this one too (of course):

$of = $page->of();
$page->of(false);
$page->next_action = 'JustTest';
$page->save('next_action');
$page->next_action_time = time() + 12 * 3600;
$page->save('next_action_time');
$page->of($of);

Or I messed something up)

Cross-Site Scripting v1.3.6

Affected software : Processwire CMS

Version : v.1.3.6

Type of vulnerability : XSS (Cross-Site Scripting)

Author : Noth

Description:
Processwire CMS is susceptible to cross-site scripting attacks, allowing malicious users to inject code into web pages, and other users will be affected when viewing web pages

PoC :

Step 1 : login system

Step 2 : Go to "/processwire/page/edit/?id=1"

Step 3 : insert "XSS" test grammar in "Titile" and save it.
XSS Payload : "><script>alert(document.cookie)</script>

Step 4 : Go back to the login system page

Test Video :
https://drive.google.com/file/d/1j06Id6IHf5aUOTnU8w9wSujjGLuX3Wn9/view?usp=sharing

READ THIS BEFORE SUBMITTING ISSUE REPORTS

• Don't submit issue reports here, they will be closed automatically. Instead submit ProcessWire issue reports to the ProcessWire issues repository.
• Please do not submit feature requests to the issues repository, instead use the ProcessWire feature requests repository.
• Please do not use the issues repository for ProcessWire support, instead use the support forum at https://processwire.com/talk/.
• Always include the full ProcessWire version (i.e. 3.0.34). Also include the PHP or MySQL version when potentially applicable.
• Indicate any 3rd party modules that are installed.
• When possible please confirm the issue on a separate installation before submitting an issue report.
• When the issue is resolved, please close it.

Changing field type from TextareaLanguage to Textarea throw Notice.

PW 3.0.33
Tracy 3.0.3

While Im trying to change field type from TextareaLanguage to Textarea i get notice from 483 line

Notice

Trying to get property of non-object search► skip error►

Source file

File: ...\domains\localhost\pw-clean\wire\core\Fields.php:483

473:            /** @noinspection PhpAssignmentInConditionInspection */
474:            while($row = $query->fetch(\PDO::FETCH_ASSOC)) $schema1[] = $row['Field'];
475:    
476:            $query = $database->prepare("DESCRIBE `$table2`"); // QA
477:            $query->execute();
478:            /** @noinspection PhpAssignmentInConditionInspection */
479:            while($row = $query->fetch(\PDO::FETCH_ASSOC)) $schema2[] = $row['Field'];
480:                
481:            foreach($schema1 as $key => $value) {
482:                if(!in_array($value, $schema2)) {
>>>483:                    if($this->config->debug) $this->message("changeFieldType loses table field '$value'"); 
484:                    unset($schema1[$key]); 
485:                }
486:            }

Also it creates table in DB named like "field_name_pwtmp".
If to turn off strict mode in Tracy settings and after removing of newly created temporary table, changing of field type could be done normally.

In this messege Adrian has already suggested a fix for it.

Change 483 line of wire/core/Fields.php to:

if($this->wire('config')->debug) $this->message("changeFieldType loses table field '$value'");

Using Custom Editor JS Styles Set causes js console error

@gmclelland commented on Wed Aug 15 2018

Short description of the issue

When editing any page in the backend, I see the following error in my Google Chrome console:

ckeditor.js:253 Uncaught Error: [CKEDITOR.resourceManager.add] The resource name "mystyles" is already registered. at CKEDITOR.resourceManager.add (ckeditor.js:253) at mystyles.js?t=2015030801.160:9

Expected behavior

No errors

Actual behavior

Error is shown in the console, but everything seems to function okay. My custom styles for "Callouts" is included in the CkEditor's "Styles" dropdown.

Optional: Screenshots/Links that demonstrate the issue

Here is my mystyles.js file contents:

CKEDITOR.stylesSet.add( 'mystyles', [
 { name: 'Inline Code', element: 'code' },
 { name: 'Inline Quotation', element: 'q' },
 { name: 'Left Aligned Photo', element: 'img', attributes: { 'class': 'align_left' } },
 { name: 'Right Aligned Photo', element: 'img', attributes: { 'class': 'align_right' } },
 { name: 'Centered Photo', element: 'img', attributes: { 'class': 'align_center' } },
 { name: 'Button', element: 'a', attributes: { 'class': 'button' } },
 { name: 'Button - Tiny', element: 'a', attributes: { 'class': 'button tiny' } },
 { name: 'Button - Small', element: 'a', attributes: { 'class': 'button small' } },
 { name: 'Button - Large', element: 'a', attributes: { 'class': 'button large' } },
 { name: 'Callout - Success', element: 'p', attributes: { 'class': 'callout success' } },
 { name: 'Callout - Warning', element: 'p', attributes: { 'class': 'callout warning' } },
 { name: 'Callout - Alert', element: 'p', attributes: { 'class': 'callout alert' } },
 { name: 'Callout - Primary', element: 'p', attributes: { 'class': 'callout primary' } },
 { name: 'Callout - Secondary', element: 'p', attributes: { 'class': 'callout secondary' } },
 { name: 'Small', element: 'small' },
 { name: 'Deleted Text', element: 'del' },
 { name: 'Inserted Text', element: 'ins' },
 { name: 'Cited Work', element: 'cite' }
]);

Setup/Environment

Server Details

Software	Version
ProcessWire	3.0.110
PHP	7.1.12
Webserver	Apache/2.4.29 (Unix)
MySQL	5.7.10-log

Server Settings

Parameter	Value
allow_url_fopen	1
max_execution_time	300 (changeable)
max_input_nesting_level	64
max_input_time	60
max_input_vars	1000
memory_limit	256M
post_max_size	128M
upload_max_filesize	2M
xdebug
xdebug.max_nesting_level
mod_rewrite	1
mod_security	*confirmed off
GD	bundled (2.1.0 compatible)
GIF	1
JPG	1
PNG	1
EXIF Support	1
FreeType	1
Imagick Extension

Allow more options to override for Image field in contexts

Good day!

This is a feature suggestion.

I always look for a way to minimize the amount of fields in my PW installation, reuse them as much as I can. Template context help me a lot, but not with images.

This update made it possible to override more options in custom fields. Why not allow more options to override for core fields?

It would make image fields much more reusable, if we could override these options:

• Maximum Files Allowed,
• Formatted value,
• Min and Max Image demensions

The more the better) Is there anything preventing this?

Different url-segment handling depending on the setting of $config->pageNameCharset

Processwire Version: 3.0.89

A issue arises resulting of a problem in WireInput->setUrlSegment. My setup allows a URL Segment "logIn" (uppercase "i") which works nicely as long as I don't set pageNameCharset.

WireInput (around line 295) uses Sanitizer->name() to clean up the segment's name. As soon as I set $config->pageNameCharset='UTF8', Sanitizer->pageNameUTF8() is called.
As there are no "special" characters in the given segment, it hands over to Sanitizer->pageName() on line 473.
So different methods are used for cleaning up the string: In the regular case Sanitizer->name(), in the UTF8 case it's Sanitizer->pageName().

The results of the two functions differ: In my case the "logIn" is translated to "login" and the client is redirected to this page. As the "login" segment doesn't exist the redirect results into an error page.

I see the following possibilities:

• Let Sanitizer->pageNameUTF8() call $this->name on line 473
• remove the conversion to lower case at the end of Sanitizer->pageName()
• add another parameter to sanitizer->pageName() which allows the invoking method to decide if a lowercase conversion should be done.
• Create a single point for doing the filtering of (UTF8) characters and access this from different methods.

I don't understand why there are different functions name() and pageName() - shouldn't they do the same?
I have also seen some "punycode" handling in there: punycode is only relevant for hostnames - so why is there a punycode handling in the pageName() sanitizer?

I could submit patches but I'd like to know which way do go before I implement something, so please get in contact with me.

XXE Vulnerability

When getting an image file's information, the program does not care about XXE vulnerability, which could lead to sensitive information leakage or DoS attack.
In Pageimage class(wire\core\Pageimage.php), function getImageInfoSVG parses file without any sanitation ,whose content may contain attack vectors.

	protected function getImageInfoSVG($filename = '') {
		$width = 0;
		$height = 0;
		if(!$filename) $filename = $this->filename;
		$xml = @file_get_contents($filename);
		
		if($xml) {
			$a = @simplexml_load_string($xml)->attributes();

Error: Allowed memory size

With php 5.5 and lower I'm getting Error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 123207680 bytes) (line 8 of when i try to do

echo '<pre>';
print_r( $page );
echo '</pre>';

on a template file.

Works fine with php 5.6 and up.
Also on PW 2.7 it works with php 5.3.

I'm on windows 10 x64 using ampps.

Update Link To Reference The New Repository

Datepicker language changed and json not saved in database

http://prntscr.com/qficmu this is " wire--modules--languagesupport--languagesupport-module"
http://prntscr.com/qficw1 this is datepicker lang changer

Now lang changer is not working but first one is working. Than date picker successfully saved but

when i change first one like en_US.UTF8 , second photo and scripts are work but datepicker not saved its not send date

Impossible to suppress language in editUrl for language-enabled sites?

page-publish button does not disappear fully disappear.

Bug report:
When adding the permission "page-publish" , and logging in as a user that does not have that permission, the publish button will be removed, but only part way, and a set of links belonging to that button will still show.

System:
Clean install with pro drafts, and croppable image 3. ProcessWire 3.0.62

Browser:
Safari

Use Case:
Setting up a workflow where users can draft pages, but not publish them. (so that all content can be reviewed first)

Forum Link: https://processwire.com/talk/topic/17082-bug-when-adding-page-publish-permission/#comment-149976

$session->forceLogin does not update $user variable

After using $session->forceLogin($loginUser) the $user variable does not get updated before the page reload. But wire('user') function returns what is needed. It seems a little inconsistent. Is it supposed to be that way, or is it a bug?