Changelog

YeCha is a lightweight publishing system for blogs and content sites: ready to use, fast and SEO-friendly, with optional multilingual support and AI translation. This page lists the highlights of each release, newest first.

2026-10-18 · Site content completed (same 1.0.0 release)

Site-side completion within the same version: no data-model change (only the ye_contents.words column the 1.0.0 core expects), no existing URL changed; every new page lives at a new path.

English site completed

• Fixed the 500 on /en/category// and /en/tag//: the 1.0.0 list query reads ye_contents.words, which this older database lacked — the column was added and backfilled from CHAR_LENGTH(content), then page caches were flushed.
• /en/ now renders an English portal home page (themes/yecha/views/landing-en.php); its news list uses English translations instead of Chinese copy.
• The English 404 page returns to /en/; 404 titles follow the current language; the language switcher keeps the current path and query string.
• Top menu and footer are identical across languages, and every label comes from the language packs (10 new nav.* keys; Chinese and English stay in sync at 200+ keys each).

Top navigation completed

• Level one: Home · Docs · Themes · Plugins · Changelog · Resources (Download / Developer Docs / App Market / Forum / Archive / Categories / Tags / Search) · About · Contact.
• Active-state highlighting recognises both clean URLs and .html forms; mobile keeps the drawer, with the secondary items grouped inside it.

Online themes / plugins

• New list pages /theme and /plugin (34 and 20 items), generated live from themes//theme.json and plugins//plugin.php — no hand-written list.
• Detail pages /theme/<id>/ and /plugin/<id>/: version, author, license, requirements, size on disk, feature points, file list, screenshots and package download.
• Packages are tar.gz with SHA-256; thumbnails use real screenshots when available and generated placeholders otherwise, so nothing 404s.

Documentation centre

• /docs (content still stored as the docs page, reachable through a clean URL): install, upgrade, theme development, plugin development, configuration (including secrets) and FAQ, with an anchor index.
• Bilingual; version number, theme count and plugin count match the live site.

Visitor-side clean-up

• Emptied the admin "statistics snippet" slot (stats.foot): visitor-side outbound requests are now zero site-wide; the static home pages were rebuilt so the baked HTML no longer carries the old analytics script.

Small core changes (reversible)

• Router: clean URLs for /docs and /changelog, and multi-segment dispatch for plugin pages; Markdown headings accept explicit {#anchor} ids; 404 titles follow the current language.

2026-10-18 · YeCha 1.0.0 (current release)

1.0.0 is final: the theme pack (33 themes) + plugin set + changelog ship with the site. This release does not change the database schema or existing pages (page-by-page sha256 comparison before and after: byte-identical except the CSRF token on the login page).

Themes: all 33 themes selectable

• The admin "Market → Local themes" dropdown lists 34 = 33 from the 1.0 theme pack + the site's existing "Zhiku" theme.
• Each theme was switched in a shadow instance (cloned database + cloned tree + local php -S, no public exposure): 34 themes × 4 page types (/ /archives /search /login) = 136/136 returned 200, theme CSS loaded, zero PHP errors.
• After switching a theme, the page cache and the baked home page must be rebuilt; see INSTALL.md §3.

Plugins: 20 directories (10 existing + 10 newly installed)

• Ten newly installed: autosave / entry-static / lqbookmarks / lqlegacy / lqnotes / lqprobe / lqtopics / site / statx / subscribe — disabled by default because the site already has built-in equivalents (notes, highlights, anti-spam, notifications, statistics, backup) and enabling routes twice would duplicate them.
• The original ten (ai / demo / forum / guardweb / home-static / imgopt / links / mall / market / poly) are untouched and keep their original state.
• The svg plugin from the 1.0 package was not installed: this site's index.php hard-references plugins/svg/lib.php, which rewrites the login/user shell (measured /login 8252 → 5790 bytes), so it was moved out to /root/ta37/removed/.

Documentation shipped

• /var/docs/: CHANGELOG.md (1.0.0, grouped by module), INSTALL.md, ROLLBACK.md, VERSION.
• A copy at the site root (CHANGELOG.md), not served publicly (*.md returns 404).

Production posture

• HTTPS semantics enforced at the origin (fastcgi_param HTTPS on) plus Strict-Transport-Security: max-age=15552000 (no subdomains, no preload).
• Every <loc> in sitemap.xml is https (16 entries); robots.txt = Allow: / + Sitemap: https://yecha.org/sitemap.xml.
• Rollback: one command each for themes, plugins, database and vhost, see ROLLBACK.md and /root/ta37/.

2026-09-28 · 1.0 Beta b2 Build20260928 — security fixes

This release adds no features and changes no baseline themes or schema; it fixes defects in the release package itself.

Security: core source directory could be downloaded

• The shipped rewrite template deploy/nginx-rewrite.conf omitted core from its deny list, so /core/Db.php and friends could be downloaded (HTTP 200), contradicting the file's own comment. All sites deployed with the old template were affected; the fix adds core to the deny rules. A/B check: /core/Db.php went from 200 to 403. Action: update the rewrite rules if you used the old template.

Deployment: new installs were blocked by their own rewrite

• The same deny rule grouped the install directory with sensitive folders, so the documented "open /install/" step returned 403 with no useful error. The fix splits install into its own plain prefix rule (never with ^~, which would serve raw PHP source and break POST). Verified: /install/index.php and /install/ went 403 → 302 while /var, /tools, /data, /tests, /core and config.inc.php stayed 403.

Core: concurrent option writes could lose configuration

• Option writes were "delete then insert" in two statements outside a transaction; concurrent writes raised duplicate-key fatals, and a crash in between left the row deleted. The fix is a single atomic upsert. Verified with 8 processes × 5 rounds of rewriting the same option: 144 duplicate-key errors before, 0 after; 16 concurrent first writes: 15/16 failed before, 16/16 succeeded after.

Self-check (actually run)

• Fresh install on an empty database: installer returned 200, "installation succeeded", 15 tables created.
• Theme render matrix: 32 themes × 7 routes × 2 home modes = 448 requests, 447/448 ended at 200 with no template/fatal/SQL errors.
• php -l across all six packages: 793 ok / 0 bad.

2026-09-26 · 1.0 Beta Build20260926

New plugins

• Corporate site (plugins/site): home / products / cases / news (reusing blog posts) / about / jobs / contact plus a theme engine, with 12 industry style packs, three-layer multilingual support (305 UI strings × 8 languages) and a reversible switch back to blog mode.
• AI capabilities (plugins/ai): a unified AI service layer — chat, multilingual translation, knowledge-base Q&A, support endpoint and call logs. Keys are entered in the admin panel, encrypted with AES and never echoed; no key exists in the source.
• Added the official guardweb (access protection) and home-static (static home page) plugins.

Core wiring

• Multi-level route prefixes /site/…, /ai/…, /mall/… are resolved by the core router and cannot collide with content slugs.
• Root ownership is three-state: corporate site (in site mode) → otherwise mall → otherwise the blog home page.
• front.shell hook lets a plugin take over the page shell once; document language (<html lang|dir>) is overridable, so RTL layouts such as Arabic are correct; scheme detection handles reverse proxies and CDNs.

Fixes (all sites should upgrade)

• Empty-database installs returned 500 on /archives (Unknown column 'pub_y'): archive counts depend on generated columns that the schema never defined. Added to the schema plus an idempotent migration 20260926_contents_pub_y_m.php.
• A plugin migration printed debug output early in the request, preventing response headers; the output was removed and migration execution is now buffered for all plugins.
• SQL splitting could silently drop statements that followed a semicolon + comment line; comments are now stripped line by line.

2026-09-10 · 1.0 Beta Build20260910

• New version format: 1.0 Beta BuildYYYYMMDD; the comparator understands both old and new formats, including stage ordering (dev < alpha < beta < rc < final) and build dates.
• All six sites upgraded to this build with database backups and pending migrations applied.
• Admin UI: fixed a CSS-weight defect that rendered action buttons as dark grey with red text; neutral / destructive / smart actions now use semantic colours.
• Copy: removed reference product names from installer seeds, theme defaults, data tools and comments, with an idempotent migration to clean existing options and sample pages.
• Multilingual: poly became a directory plugin (plugins/poly) and ships in the package.
• Market: items support screenshots and detail pages; TeaDoc 1.0.1 repackaged to the new spec.
• Writing: new auto-save plugin (multi-version snapshots, manual restore); distraction-free editor; tag/keyword paste splitting and de-duplication.
• Content: an "AI translate" button in the post list translates and publishes in one click, skipping manually corrected translations and resuming after timeouts.
• Security: the server layer rejects direct downloads of .bak, .sql and hidden files; source backups are removed from the web root.

2026-09-09 · App store screenshots

• The store manifest supports a shots array; /store cards show the first image and /app/<id> shows 3–4 large screenshots.
• First real screenshots: TeaDoc, WarmPaper and Forest (4 each); multilingual, forum and links (3 each). The eight listed apps all have images.

2026-09-09 · App store: plugins and themes in separate sections, detail pages

• /store shows plugins and themes in two fixed sections; each card opens /app/<id> with name, type, version, description and install guidance; unknown ids return a friendly 404.

2026-09-09 · Themes: declarative settings in theme.json

• Themes declare settings (key/type/default/help) in theme.json; the admin theme page renders the form and saves whitelisted values (select, color, number, checkbox, text, textarea). Replaced hard-coded common fields and the TeaDoc special case.
• Forest and TeaDoc now declare their settings (Forest 6 items including a home notice; TeaDoc 15 items); templates read them through theme_opt() with backward compatibility.
• Official market packages repacked with settings and new SHA-256 values.

2026-09-09 · Market defaults to the official source (yecha.org)

• The default market source is https://yecha.org/market/manifest.json; if unreachable it falls back to the local manifest with a notice, so offline installs still work.
• yecha.org exposes /market/ (manifest + packages) and packages use absolute URLs.

2026-09-09 · senlincha.com core aligned to beta.2 and multilingual pluginised

• senlincha.com (Forest theme) moved from an older 1.0.0-beta core to beta.2, syncing the plugin system, uninstall semantics, upgrade and cache mechanisms; the poly plugin was installed keeping zh + en data.

2026-09-09 · Default theme footer links to YeCha

• The footer "Powered by YeCha" link in the default theme and image-gallery themes points to yecha.org; every YeCha-based site keeps that link.

2026-09-09 · Static home page plugin (market)

• New plugin bakes the home page (including /en/ prefixes) into static HTML for millisecond responses: generated on first visit, refreshed automatically after the TTL, and manageable (generate / clear / TTL) in the admin panel.

1.0.2-beta (2026-09-09) · Multilingual as an optional plugin, uninstall semantics

• Multilingual support became an optional plugin (zh / zh-TW / en / ja / ko / es / fr / ar / ru) with automatic translation, language paths and hreflang. Single-language sites stay free of multilingual overhead; new installs are single-language by default.
• Themes and plugins can be "uninstalled" (disabled, data kept) or "uninstalled and cleaned" (full removal with an automatic database backup first).
• Migrated yecha.org, ATSvg (~400k English translations), laolv.org and xuecha.org without data loss.

1.0.1-beta (2026-09-09) · Market launch, slimmer package

• Built-in app store: browse, install, update and enable plugins and themes with strong verification and safe unpacking; the admin and /store share the same catalogue.
• First items: multilingual, anti-scraping, forum, links and several themes.
• New anti-scraping plugin: blocks AI training crawlers (GPTBot, ClaudeBot, PerplexityBot, CCBot…) and scrapers while allowing search engines and real visitors; rate limiting and multiple response strategies, disabled by default.
• The package now contains only the core, the default theme and basic capabilities; plugins and themes come from the market.

1.0.0-beta enhancements (2026-09-09) · Large datasets and online upgrades

• Lists, search, tags and counters are fully indexed: 400k-level content returns in milliseconds to sub-second (learned from the ATSvg production site).
• One-click online upgrade: detect a new version → back up → download and verify → upgrade in place.
• Multilingual details: translation completeness statistics, localised dates and months, right-to-left layouts such as Arabic.

2026-09-08 · Large image site in production (ATSvg)

• A 400k-image gallery theme with list and detail pages, downloads, favourites, comments and automatic cover cropping.
• Asset tools: image to SVG, SVG to PNG, WebP/AVIF conversion, SVG minification, image joining and AI icon generation.
• Validated on the ATSvg production site (~400k SVG assets).

2026-09-06 · YeCha 1.0 Beta

• The first public beta release.