Releases

• Admin > Modules now shows Configure next to Blog. It opens Admin > Blog > Settings, which has every setting.
• Removed the reduced copy of the settings form at /admin/module/configure?id=Blog. It failed with Omeka's error page, and it could not load or save the moderation recipients.

• Users refused a blog admin page (Reviewers and Researchers on any of them, Authors on Categories, Comments, Settings or a delete) got Omeka's error page Omeka S encountered an error with status 500. They now get Omeka's Forbidden page with status 403. Who may do what is unchanged.
• Authors saw Categories, Comments and Settings under Blog in the admin menu, Comments and Categories buttons and a Delete button on each post in the Posts list, and View buttons for the comments of a post, all leading to that error page. They are now shown only to roles that may use them.

• The hint under Visible on sites on the post form said "Leave all unchecked to show on every site", but a post with no site ticked appears on no public site. It now reads "The post appears only on the sites ticked here. With none ticked it is on no public site."
• Post form: the Publish at field no longer runs past the edge of the Post Settings panel.
• Settings: the Moderation notification recipients list shows several users at once (it was about one and a half lines tall, so the second user was cut off), and the Primary color swatch shows the example colour, faded, while the field is blank instead of black.
• Excerpts written in the rich-text editor are shown as plain text on the admin post page (it printed the <p> tags) and in the post's JSON-LD description (it held the HTML). The JSON-LD article body also decodes entities such as – and & (its tags were already removed).
• Featured images chosen as an asset are shown at the asset's current address. Saving a post (in the post form or with the AI tools) stored a full copy of the asset's URL, and the blog pages, the JSON-LD and OgImages share cards used that copy first, so they kept pointing at the old host after the site moved to a new address. Only the asset is kept now, and its URL is built each time the post is shown. The upgrade clears the stored copies (those ending in the asset's file name, under any host). An image URL given through the API to a post without an asset still works, and is no longer wiped when that post is saved in the post form; choosing an asset in the form replaces it. blog_get_post reports the asset's current URL.
• Primary color in Blog Settings now does what its hint says: it colours the Read more buttons and the comment form's button, on the blog pages and in the Blog Posts page block, with white or near-black text on it, whichever reads better. Blank keeps the theme's colour. It was saved but never applied; if you had set one, those buttons change to it. Themes that style these buttons themselves (the theme-engine themes do) keep their own colours.
• PHP 8.4: the service and controller factories no longer trigger the "implicitly nullable parameter" deprecation.
• Removed docs/documentation.md, the old single-page manual for 1.2.0; the documentation pages in docs/ replace it.
• Scheduled posts appear on the blog's list pages, feeds and blocks at their publish time. The lists compared it with the database's clock in its own time zone, while posts are dated in UTC, so on a server whose MySQL is not on UTC a scheduled post showed up hours early or late there (its own page already used the right clock).

• Tools for AI assistants, offered when the MCP Server module (1.1.0 or later) is active: blog_info, blog_search_posts, blog_get_post, blog_create_post and blog_update_post. They go through the blog API, so only editors and above can write, and they follow MCP Server's publishing rules. Categories can be given by name (new names are created), sites by slug, and featured images as asset IDs. A published post keeps its publication date when it is saved again.

• The CKEditor code-snippet setup script is now added to admin pages only; it was printed on every public site page, where CKEditor never runs.
• Public templates:
  • The blog index and the tag, category and author archives no longer put a second <main> inside the theme's main landmark.
  • Pagination on tag, category and author archives stays on that archive (it linked to the blog index). The author archive had no pagination at all; it now has the same as the others.
  • The four list pages share one partial, view/common/blog/post-list.phtml, so they show the same summaries.
  • Post titles are escaped as text; excerpts are reduced to plain text and escaped everywhere (the author archive printed them as raw HTML).
  • Featured images set as an asset (featured_image_asset_id) now show on list pages, in the Blog Posts block, on the post page, in "More posts by" and in the post's JSON-LD; only featured_image_url was used before. A new view helper, $this->blogFeaturedImage($post), resolves either.
  • Thumbnail links next to a title link are hidden from screen readers and the tab order, and "Read more" links name their post for screen readers.
  • Sidebar widget headings on the blog index are <h2> (they skipped levels).
• Posts with identical publication times no longer repeat on one page and vanish from the next: post lists, and the admin comment list, sort by id after the date.
• The preview banner on unpublished posts uses dark text on amber (about 8:1; it was white on amber, about 2:1) and its styles moved into blog.css, so themes can restyle it. Its text is translatable.
• blog.css takes its colors from the theme's neutral --theme-* tokens when present, falling back to the previous light colors, so the blog follows dark color schemes. Comment form fields get borders with at least 3:1 contrast.
• Archives were checked for posts from other sites: the tag, category and author archives, the feeds, the sitemap and the Blog Posts block already filter by the current site.

Upgrading: copy the files, then run the upgrade in Admin > Modules (any change to the version in module.ini deactivates the module until then).

• The native API resources blog_posts and blog_comments now restrict reads for callers below Editor (anonymous requests, Researcher and Author keys) to what the public site shows: published, non-scheduled posts and approved comments, with the commenter's email omitted. status and exclude_future filters from such callers are ignored, and reads of hidden records answer 404. Editors and above are unaffected.
• Fixed the public comment form, which omitted the CSRF elements Omeka adds to every named form, so every visitor submission was silently rejected. The form is now rendered from the module's CommentForm, with per-field errors, and the post template shows approved comments using the view variable the controller actually sets.
• Fixed the unit tests: BlogService receives a mocked event manager, the post-delete event is asserted, and the test bootstrap locates the Composer autoloader in the module, application, or repository root.