Sulu releases 2.6.27 and 3.0.10: guided two-factor setup, cache invalidation, and Symfony 8 bundles

Sulu can require two-factor authentication for all users that match a pattern. Until now, users affected by this requirement were automatically assigned the email method. With the new setup option, they can choose from the available two-factor methods instead. A matching user without a working method gets an overlay right after the login. It cannot be closed, lists the enabled methods and guides the user through the setup of the chosen one. The option is off by default. Projects with the email method installed see no change, and without it the guided setup turns itself on when forcing is enabled.

While a user has not finished the setup, the admin API refuses all other requests, including those of technical API users. Both releases describe this in UPGRADE-2.x.md and UPGRADE-3.x.md.

Publishing a page or article cleans up the references it held before, and that lookup had no database index. On installations with many references, for example after a content migration, every publish scanned the whole table. Both releases add the missing index. Update your database schema, or create the index by hand as described in the upgrade notes.

Page and teaser selections in Sulu 2.6, and teaser selections in Sulu 3.0, did not record which pages they point to. Anything that relies on those references, such as republishing a page that teases another page, therefore never noticed a change. Both releases now record them. Content gets its references when it is saved or published again, so run sulu:reference:refresh once after upgrading to fill them for existing content.

When an editor changed a tag, a category, a contact or an account, the pages showing it stayed in the HTTP cache until their cache lifetime expired. The tags added to a page and the tags used to invalidate it did not match. They match now, and more things are tagged, such as teasers, links to media, Smart Content items, image maps and snippet areas. Collections refresh their pages when they change as well.

Clear the HTTP cache once after the upgrade, because pages cached before do not have the new tags. Projects that add their own cache tags, or extend the teaser providers and a few related services, need to adjust their code. The details are in UPGRADE-3.x.md.

A page whose only teaser points at a deleted page no longer fails with an error. Commands and background workers that read a page in one language and save it in another no longer fail with a duplicate route. The SEO values of a page that has none saved yet are now available in templates, contributed by hual7, and teasers fall back to the page title when the excerpt title is empty, contributed by Roshan931.

Amoifr contributed two more fixes. The homepage of a portal with a language prefix redirects /de/ to /de, as all other pages already did. And reloading the preview keeps what the editor changed instead of showing the last saved version.

Sulu 3.0.9 added Symfony 8 to the core. Since then, the bundles for Sulu 3.0 have followed. These releases allow Symfony 8:

• Form 3.0.1
• Community 3.0.1
• Comment 3.0.1
• Headless 3.0.2
• Automation 3.0.1
• Redirect 3.0.1
• Theme 3.2.1

The Symfony 8 changes of the Community, Comment, Headless and Theme bundles were contributed by Amoifr, those of the Automation and Redirect bundles by benr77 and those of the Form bundle by mamazu.

Editors can now mark the language of a text part. A new dropdown in the rich text editor tags the selected text with a language, so screen readers pronounce foreign-language passages correctly. This helps projects meet the WCAG 2.2 AA requirement for identifying the language of parts. The dropdown offers the languages of your webspaces, and you can replace that list in the configuration.

A mandatory field such as a text editor or a color now rejects an empty value. Existing content that has such a field empty cannot be saved until it is filled in.

Both releases also fix several smaller issues. Select filters keep their checked options after a reload, contributed by TheCadien, and the collection selection shows all collections instead of the first ten, contributed by MarkusHolstein. Amoifr contributed three more: changing the template of a form that has not been saved yet no longer crashes it, a media title of 0 is kept, and a link to a page of the external link type returns the external URL.

Check your roles. In Sulu 3.0.10, creating a page and copying require the add permission, and publishing, unpublishing and removing a draft require the live permission. In Sulu 2.6.27, copying a page or snippet requires the add permission. Without it, the request is refused.

For the full changelog, see the release notes for Sulu 2.6.27 and Sulu 3.0.10.