Evolution CMS 3.5.8: Manager Security, Better Diagnostics, and Broader Runtime Coverage

Evolution CMS 3.5.8 is a security and stability release for the 3.5 branch. It tightens Manager request validation, closes several unsafe legacy paths, improves operational diagnostics, and gives package authors clearer behavior around templates, dependencies, mail, and scheduled work.

The compatibility change that deserves attention is CSRF validation. Most sites can update normally, but older Manager modules may need a small code change before every action works again.

Manager requests now require the current CSRF token

Evolution CMS now applies stricter CSRF checks to Manager actions, including legacy routes that change data through a GET request. A package can therefore return a CSRF token mismatch error if its form, link, or AJAX request does not send the active token.

Forms

Add the standard hidden field to every Manager form that changes data:

<form method="post">
    <?= csrf_field() ?>
    ...
</form>

AJAX requests

Send the same token in the request header. Render the value on the server with csrf_token():

fetch(url, {
    method: 'POST',
    headers: {
        'X-Requested-With': 'XMLHttpRequest',
        'X-CSRF-TOKEN': csrfToken
    },
    body: formData
});

Legacy action links

If an existing Manager link still performs a write action, include _token in its URL or, preferably, move the action to a protected POST request. Do not leave CSRF rejection disabled as a permanent compatibility fix. Updating the affected package keeps the protection that 3.5.8 was released to enforce.

Security work beyond CSRF

• Unsafe object creation through serialized input was restricted.
• Legacy PHx and browser evaluation paths were hardened.
• File upload handling now protects against @FILE-style request behavior.
• Stored and reflected XSS paths received additional validation and escaping.
• Login handling rejects empty password hashes more safely.
• The upgrade transport is stricter about secure downloads and certificate validation.

Manager, templates, and package workflows

• Manager tabs restore more reliably after login and CSRF token rotation.
• Template processing can work with database-backed and file-backed sources through a clearer source contract.
• Parser passes can be enabled deliberately instead of being an implicit part of every template source.
• Vendor publishing records a manifest, which makes package-owned files easier to track.
• Package diagnostics now report transitive dependencies, not only direct requirements.
• The CLI installer writes Manager theme and site identity settings consistently.

Mail, timezones, and background work

• The Manager includes better test-mail tools, sender diagnostics, and SMTP certificate controls.
• Sites can use an IANA timezone, while event logs show time and actor information more consistently.
• System task handling was reorganized, including fixes for Windows execution and Docker scheduler startup.
• Resource dates keep stable values when they move between storage and a configured site timezone.

Runtime and upgrade coverage

The project expanded automated checks across PHP 8.3, 8.4, and 8.5, MySQL and PostgreSQL, and several web-server setups. Installer, Docker, and upgrade smoke tests also received more coverage. These checks reduce upgrade risk, but they do not replace testing a site's own packages and Manager customizations.

Upgrade checklist

1. Back up the database and site files.
2. Update custom Manager forms, links, and AJAX calls so they send the current CSRF token.
3. Test login, restored tabs, package configuration forms, uploads, and scheduled tasks on staging.
4. Send a test message if the project uses custom SMTP settings or a private certificate chain.
5. Confirm the configured timezone and inspect recent event-log entries.
6. Run the normal installer or upgrade flow, then clear the site cache.

Read the Evolution CMS 3.5.8 release notes or review the complete 3.5.7 to 3.5.8 change set.