The webCOMAND Sign In and Users Framework now support fully custom Multi-Factor Authentication to improve security for your webCOMAND instance, website and/or apps.

Multi-Factor Authentication (MFA)

Features include:

• Email and/or SMS (Text Message) - Users can chose email and/or SMS MFA each time they login.
• Custom Requirements - Each Login Policy may require for:
  • All users
  • Only select users
  • All except select users
  • No users
• Custom Thresholds - Adjust the number of allowed attempts by time period, IP address and/or User Agent.
• Custom SMS Service - Supports custom Twilio account, and extensible to other SMS services.
• Custom Templates - Customize the MFA email and text message.
• Custom Codes - Specify the code length and number of minutes they are valid.

Additional Updates

• New requires_store(), requires_save() and requires_approve() cObject methods allow developers to customize when objects and their embedded children are approved, even if they have not been modified.
• Fixed when a user pastes a copied object, their user information is associated with the update in the version history, instead of the admin user.

Subsequent Minor Updates

webCOMAND 3.11.1 (Oct 14, 2025)

• Web Socket Server - Several improvements to the Web Socket Server driving dynamic Content Manager functionality. Performance improvements were made to speed up connections listening to running tasks by non-super users, and a dedicated task listener was introduced which replaces less efficient cPaths for certain operations. The Web Socket Server was also updated to respond to changes to the underlying type caches and to users and user roles/privileges. In addition, configurable logging functionality was introduced with periodic status reports to aid in troubleshooting and performance improvements in the future.
• Map View - Improve the default zoom level to be more appropriate when there is only one visible coordinate, or when several coordinates are located very close together.
• Web Launcher - Add configurable PHP file extensions to determine which file extensions the web_launcher will process as PHP code.
• Publication Framework - Add tracking of all published files to the Publication object at publish runtime.  Also add Publication content type method stubs: PublishedObject(), PublishedProcedure(), Published().
• Sites Framework - Fix missing "$HTML +=" before insert() in Navigation template, and fix where ParentPageOID was incorrectly referenced instead of ParentPageDOID.
• Backup / Restore - Fix CMS backup filename issue that prevented restore of very large data tables.
• Email API - Fix IMAP email processor catch an exception when converting a message to UTF-8, and instead fallback to the detected encoding if the declared encoding in the email is not supported by PHP.
• Grid View - Update the grid view to handle presenting decimals
• Navigation Bar - Fix potential null exception when rendering certain types of cpath view title bars when the cpath is empty.

webCOMAND 3.11.2 (Nov 12, 2025)

• cQL STRCMP() - Add string comparison function to cQL.
• Publication Settings
  • Add All Publication Procedures and All Publications check boxes to explicitly specify when all procedures and/or publications should publish.  Previously this was configured by not selecting a procedure or publication, but that could easily be configured by mistake when a previously configured procedure or publication were deleted.  This update prevents that mistake from happening.
  • Add Folder Context Only check box to only apply settings when the user opens the target object(s) in the context of the selected Folders.  This also applies to Search Settings, View Settings and Rich Text Settings.
  • Fix issue in publishing content with multiple settings tied to the same publication.
  • Fix issue in the publishing sidebar when viewing an embedded object.
• System Tasks - Fix issue that prevented events from logging to a System Task after it was cancelled.

webCOMAND 3.11.3 (Nov 24, 2025)

• Panel - Add option for developers to disable Search Settings.
• PHP API Web Client - Add PATCH request support.
• Diagnose - Separate slow query thresholds into separate settings for clean, repair, and optimize.
• UI Methods - New feature to add custom buttons to the Form View toolbar per content type.

webCOMAND 3.11.4 (Nov 25, 2025)

• Fix content cache to clear cached fields by DOID as well as by OID when content is approved.

webCOMAND 3.11.5 (Dec 1, 2025)

• #META() - Add cTemplate directive to access repository object metadata.
• #CLONE - Add cTemplate directive to return a shallow-clone of objects and arrays.

webCOMAND 3.11.6 (Dec 8, 2025)

• cScript Custom Functions can now be redefined during a publish process.

webCOMAND 3.11.7 (Dec 16, 2025)

• Add Cleanup Publication Records Scheduled Task to identify and delete Publication Records associated with deleted Publications, Procedures and Objects, as well as those added incidentally during a publish.

webCOMAND 3.11.8 (Jan 8, 2026)

• Add PHP File Validation to prevent writing and publishing PHP files with invalid syntax.
• Retired the class loader Safe Include feature in lieu of PHP File Validation.

webCOMAND 3.11.9 (Feb 11, 2026)

• Update Revert to Last Approved to better handle variants.  Avoid inadvertently deleting variants when there are unapproved variants to be deleted.  Better handle embedded records with variants by matching revert actions to the most relevant variants.
• Add Archive File Extractor Content Type to make it easier to extract, write and publish archives based on rules.
• Improve Grid Editor formatting support for plain text fields.
• Improve load_config() to discover and merge the config at all package paths in reverse order, instead of just using the first encountered.
• Fix CSS Minify issue that removed critical whitespace from before a colon (e.g. :first-child) in some cases.
• Add cMVC Router base_dirs option to configure the router to look in multiple cascading folders for views and public files. Also no longer add the namespace_path or base_dir as a namespace path if the namespace_path router option is set to FALSE to find controllers in all package folders.
• Improve Import to add content logs when content is updated from import data.
• Fix Restore to correctly write BinaryValue values in field tables.
• Fix e-commerce promotions to ensure they are accurate on shopping cart update.

webCOMAND 3.11.10 (Mar 13, 2026)

• Fix User Authorizations issue that prevented authorized users from deleting a single object variant.
• Improve Grid Editor to disable drag mode while editing a cell.
• Update csv util methods to make options optional.
• Fix Sites Framework List Component HTML cTemplate to consider each list item's Status.

webCOMAND 3.11.11 (Mar 31, 2026)

• Update Forms Framework to support for multiple challenges and a new Authorize.net challenge type.
• Improve Archive File Extractor Content Type with new Write Archive, Extract Archive, Log Extraction Details and Destination Link options.
• Improve Import/Export to support multi-variant content, which also enables multi-variant support for Pull Settings.
• Improve #LINK() error reporting when deleted or disabled content is referenced.
• Add cQL MD5() function.
• Improve Object Cache memory management to invoke memory checks at more points in field loading and writing.
• Fix Repository to regenerate types cache correctly if an issue is found.

webCOMAND 3.11.12 (May 7, 2026)

• 4804b214e Update the Files model write functionality to respect the hierarchy of subfolders within a package in the repository.
• 5b69ee936 Update Decimal and Currency Data Type Validations to allow leading .s (like .2, meaning 0.2)
• 1be638541 Add validation checks for Content Types to ensure they set an Extends value.
• 91ee5c92e Add tabs and organize HelpDocs and their sub-types.
• cca67630f Update the Search Settings to allow a SELECT clause for the given cPath to take precedence if defined over any select in the settings themselves.
• ed3ae134d Update SELECT order precedence when exporting content from webCOMAND. Defined Fields in selected Export Settings will take precedence over cPath SELECT statements or selected Search Settings.
• 2d3696f87 Fix error in cScript where Imagick setFormat wasn't being properly applied (force change on current frame)
• b4eb3454f Remove dimensional querying when performing simple-form stats queries to boost performance and reduce load on the server
• 6cb1a602c Fix bug in Cancel action in the Form view that also cancels the reordering of that object within its parent folder (cancel from the form view should be isolated to the object itself).

webCOMAND 3.11.13 (May 21, 2026)

• b93335ed9 Update the email PHP error logger to log more details when PHP errors are encountered and to log at levels according to the type of PHP error received.
• ca64ae99e Update RichTextSettings to add Publications and Procedures to the custom Link dialog. This makes the link search feature more efficient and makes the types of publications/procedures one can link to configurable per source object and field. This also reorganizes the RichTextSettings fields for better usability.
• 52ea940c4 Moved all Page logic to SitesPage.HTML cTemplate, so it can be overridden without having to modify the Page Publication Procedure and fixed logic to avoid publishing pages with Do Not Open checked.
• 43df947fb Update the MVC router to quietly ignore extra parameters in the path that don't have corresponding method parameters, rather than logging PHP warning due to referencing an undefined array index.
• 8eda75df7 Add 'Communication link failure' as a recoverable error prompting an automatic retry of the query within a connection.

webCOMAND 3.11.14 (Jun 4, 2026)

• ee0269f68 Introduce new setting for login threshold that permits throttling for actions with no failure condition. Improve security notification emails, and report usernames to login security logs during the create user workflow.
• 05dc684bc Update EmailObject Attachments to allow multiple attachments with the same Filename, which is allowed by the email spec.

webCOMAND 3.11.15 (Sep 2, 2026)

• Added fix for certain types of images with corrupted or unexpected metadata. Added object/field context to ImageData when loaded from the repository so that unrecoverable image errors can be troubleshot.
• Add #TEXT EscapePHPStringSingle and EscapePHPStringDouble for specific escaped versions. Leave EscapePHPString for backward compatibility.
• Several improvements to how \io_comand_web\sessions and session profiles are managed:
  • addresses bugs that resulted in creating empty session files, and closed the gap to unset session keys in the written session file when they are unset programmatically in the in-memory session data.
  • sessions avoid creating server-side session files on read if they don't already exist
  • sessions now destroy old server-side session files when regenerating session IDs
  • sessions now handle opening and writing to multiple sessions within the same PHP process
  • session profile garbage collection is streamlined and more memory efficient when there are very large numbers of session files to review
  • session profiles now permit custom garbage collection rules that enable different maxlifetimes based on key/value pairs within stored session data
  Other improvements include:
  • new generic io_comand_file "visitor" functionality that can handle large and deep folder structures more efficiently
  • the Diagnose Cleanup process now contains rules for cleaning up older webCOMAND system files that are no longer needed
• Add an option to the io_comand_web sessions class that will destroy old sessions when session IDs are regenerated. Update the Login Policy model logic to use this new option on login and logout to help mitigate the number of session files on the container.
• Update sessions to prevent empty session files from being written when session data is loaded. PHP's natural behavior is to write an empty session file whenever sessions are started, so the solution is to only start them if they're going to be required. When loading session data using the io_comand_web session class, if the session ID is not already in the cookie the session won't be started and an empty file won't get written.
• Update System Tasks to send an email by default when they time out. Previously the default was a noop. Also fix a bug where retried tasks were not configured with the same Timeout values as the original task.
• Fix bug in managing user sessions that would prevent regenerated session IDs from being written to the browser cookie.
• Fix gaps in the Email Queue automated cleanup process and update to perform batch deletes which are more efficient.
• Add an "archive_info" command line tool to the io_comand_repo package for inspecting a CMS or MySQLDump archive and returning its details to stdout.
• Detect whether field locations for forward references are relative, such that we can allow batch edting of forward reference fields in more cases.
• Add requires_write(), before_write() and after_write() callbacks for cObjects that can be invoked when the logic for all write actions is the same.
• Fix PHP warnings where floats implicitly were being converted to ints during when rendering logged events. Use consistent parameters and type hinting allowing for floating point timestamps and update namespace "use" statements and method documentation where related and inconsistent.
• Fix E_DEPRECATED warning when using memfiles as a registered stream wrapper.
• Improve diagnose warnings when certain issues cannot be repaired.
• Update form template to handle Choices cPaths properly and render as select dropdown options.
• Add #TEXT EscapeJSONString option, similar to EscapeJavaScriptString, but does not escape single quotes to comply with strict JSON rules.
• Fix issue with router::view() that could load the wrong view when multiple base_dirs were configured. Fix issue with comand::connect() that would reuse an existing connection in a different mode.
• Adjust the logic that automatically adds content to a field location folder when the field is marked as AllowCreate. This will now respect location cPaths that evaluate to multple results as long as exactly one result is a folder.
• Expanded cScript to add pow(), abs(), ceil(), exp(), sqrt(), and optional second parameter to round().

webCOMAND 3.11.16 (Sep 8, 2026)

• 44ebf4bca Fix bug in the revert process that, when lock revisions were required, left records without a queryable latest draft. This also now correctly generates a second lock revision in certain cases when reverting, and improves the process for cloning records and for assessing and correcting query ranges. Unit tests were improved with better integrity checks and new tests for these specific cases.
• 05c50f461 Fix gap in record preservation logic when deleting drafts; lock records could be incorrectly purged while lock revisions still exist.
• dbe074cd7 Update writer to recognize exising revisions earlier in the write process, so that short-circuiting logic does not inadvertently close them during longer processes like a publish.