YeCha
Language
中文（简） English
Account
Log in Sign up
← Pages

Download

Last updated 2026-10-18

Download the Latest YeCha

Current version: 1.0 Beta b2 Build20260928 (built 2026-09-28) · security-fix release · A lightweight blog system that runs on a single PHP process. Unpack, point it at your database, and write your first post.

This release fixes two defects in the published package itself — all sites should update: ① Security: the shipped rewrite template was missing core, which left the kernel source directory downloadable (e.g. /core/Db.php) — now blocked by a deny rule; ② Installation: the same template also denied the installer directory, so a freshly deployed site got a 403 on /install/ with no hint as to why — the installer now has its own rule. It also fixes a case where concurrent settings writes could lose configuration (option writes are now an atomic upsert). ③ Source disclosure: that same rule was briefly written as location ^~ /install/ — on a real server this made GET /install/index.php return 200 with the raw PHP source (source disclosure) and POST return 405 (installer could not run). The ^~ prefix was the root cause; removing it fixes both (reordering locations or adding a try_files sentinel did NOT work). Corrected and measured in this build: GET/POST both return 302.

📦 Download

① Main package (installer)

② Demo themes & assets package (separate, optional)

  • ⬇ yecha-demo-themes-20260928.zip (≈ 66.7 MB)
  • SHA-256: 146B0D9163C74E978D0A1A5118CE6D9D04112A68DB91A43003AD2FF73BEDB2A0
  • Contains 26 demo themes (themes/<id>/) plus INSTALL.txt, theme-list.json and a per-file checksum list SHA256SUMS.txt; unpack and merge the themes/ directories into your site's themes/ folder — they appear automatically under Admin → Themes.
  • Verify after download: Windows certutil -hashfile FILE SHA256; Linux/macOS sha256sum FILE
### ⚠️ Read first: older packages are missing one protection Only yecha-blog-1.0-beta-b2-build20260928.zip is the current version — only it ships a corrected deploy/nginx-rewrite.conf. Earlier packages (Build20260926 / Build20260911 / Build20260910 / the 1.0.x-beta series) carry a template without the core deny rule, so deploying with it leaves kernel source files such as /core/Db.php downloadable over HTTP (200) (measured A/B: 200 before the fix, 403 after). Use the latest package for new installs. Already deployed from an older package? You do not need to reinstall: paste the deploy/nginx-rewrite.conf from the latest package into your rewrite rules, save, and reload nginx. (The older packages stay online purely for historical traceability; they are not recommended. They do not contain the more serious "installer directory written as ^~, serving raw source" defect — that existed only in the day's first package, which has been withdrawn.)

What's inside (clean build, no private config or content)

  • Core: admin / core / install / lang / tools + deploy/nginx-rewrite.conf rewrite suggestions + config.inc.php.example
  • Official plugins (10): Poly (multilingual), Forum, Links (blogroll), Market, Autosave, Subscribe, Site (corporate website: 12 industry style packs, /site/themes gallery, three-layer i18n), Ai (chat / translation / RAG knowledge base / support; keys encrypted at rest), GuardWeb (access protection), Home Static
  • Official themes (6): yecha (default for this site), octern, teadoc, forest, tales-hue, tales-ink
  • Includes CHANGELOG.md and THIRD-PARTY-NOTICES.md (asset sources and licences)

Highlights

  • Light: PHP 8.1+ / MySQL 5.7+; no Composer, no Node, no Redis
  • Multilingual: Chinese + English (translation groups, AI translation, /en/ URLs with hreflang); document language <html lang|dir> can be overridden (Arabic renders RTL)
  • Theme & plugin system, app market, forum, corporate website, RSS / Sitemap / search / archives
  • All data stays on your own server; no ads on the front end

Requirements

  • PHP 8.1+ (pdo_mysql / mbstring / simplexml / curl); 8.3/8.4 recommended
  • MySQL 5.7+ (8.0 recommended); create your own database and account
  • Nginx or Apache; Redis / Composer / Node are not required

Install in 3 Steps

  1. Unpack into your site directory; copy config.inc.php.example to config.inc.php and fill in the database (or open the site root to run the one-time installer);
  2. Open the site in a browser → the installer creates tables and an admin account;
  3. Log in to the admin, set up your site, pick a theme, and start writing.
Installer returns 403? If /install/ answers with 403 Forbidden, that is your rewrite rules blocking it — not a broken installer. Make sure you are using the deploy/nginx-rewrite.conf from this package (earlier versions put the installer directory in the same deny rule as the sensitive directories). After installing, delete the whole install/ directory — that is how the wizard is closed and re-installs prevented.

Upgrading & Backups

  • Official update source: https://atsvg.com/updates/manifest.json (fill it into Admin → System Upgrade for one-click upgrades; a full database backup is taken first)
  • Before upgrading: full database backup (one-click backup in Admin → System Upgrade, or mysqldump);
  • Replace files with the new version (keep config.inc.php and uploads), then run Admin → System Upgrade to apply migrations;
  • Migrations are idempotent and recorded in ye_migrations.
  • Fixed in this release: the shipped rewrite template missed core, leaving kernel source downloadable (security — deny rule added); the same template denied the installer directory too, so new installs hit a 403 (now a separate allow rule, plus "delete install/ to close the wizard"); concurrent option writes could lose configuration (now an atomic upsert, removing primary-key conflicts and lost rows); plus the previously shipped fixes such as the fresh-install /archives 500 and migration output polluting response headers.

Multilingual & Security

  • Enable languages and add translations (AI-assisted) in Admin → Multilingual; UI strings live in lang/*.php;
  • Change the admin password right after setup; apply deploy/nginx-rewrite.conf for rewrites and blocking sensitive paths;
  • This release brings the kernel source directory core/ under the deny rules; if you deployed with the older template, update your rewrite rules once.

Related