FAQ v6.0.7

Release Date: March 6, 2026 Tags: CRITICAL FIXES, RACE CONDITIONS, SECURITY, ADMIN DASHBOARD, FRONTEND

Overview

Version 6.0.7 is a comprehensive stability and correctness release for the FAQ addon. It fixes critical race conditions in the admin FAQ list, hardens the backend endpoints with proper validation and transaction safety, corrects analytics calculation bugs, and resolves multiple frontend issues including runaway re-fetching, unsafe HTML rendering, and missing accessibility attributes.

Update Instructions

After updating, run the following command in terminal:

pnpm updator

Fixed

XSS Prevention in FAQ Answers

• Fixed FAQ answers containing author-supplied HTML being rendered without sanitization. All answer content is now sanitized before it reaches the browser, preventing stored cross-site scripting.

Input Validation Hardening

• Fixed the FAQ search passing a visitor's query straight into the database without escaping the characters a search treats as wildcards, so a crafted query could reach far more than it should. Search input is now escaped before the query is built.
• Fixed the search accepting empty or single-character queries. A minimum length of two characters is now enforced.

Rapid filter changes could leave stale results on screen

• Fixed an older response overwriting a newer one when filters were changed quickly in the admin FAQ list, leaving the list showing results for a filter the admin had already moved on from. Responses from superseded requests are now discarded.

The AI FAQ management page fetched without end

• Fixed the AI FAQ management page re-requesting its FAQ and page-link lists continuously for as long as it was left open, loading the server for no reason. The initial fetch now runs exactly once.

Two FAQs created at once could take the same position

• Fixed the display position of a new FAQ being worked out without a lock, so two FAQs created at the same moment on the same page could both receive the same position. Creation now reserves the position within a transaction.

Bulk delete accepted malformed identifiers

• Fixed the bulk delete passing unchecked identifiers to the database. Every identifier is now validated before the delete runs.

Data and index corrections

• Fixed search logs being retained as soft-deleted rows. They are analytics records and are now removed outright.
• Fixed slow lookups when filtering searches by user, by indexing search logs by user.
• Fixed the feedback uniqueness rule being expressed in a form MySQL does not support for unique indexes.
• Fixed the FAQ table having no index on status, despite status being the most frequent filter.

Admin lists and analytics

• Fixed the admin feedback and question lists returning every record regardless of how many there were. Both now return up to 100 at a time, with feedback newest first.
• Fixed the page links lookup scanning the site's pages synchronously, which stalled the server on large projects. The scan no longer blocks.
• Fixed the analytics month-over-month comparison in January comparing against an invalid month rather than December of the previous year.
• Fixed the search endpoint attempting to record a search for a signed-out visitor, which it has no way to store. Search logging is now limited to signed-in visitors.

Admin list behaviour

• Fixed the active/inactive toggle showing the value that was requested rather than the value the server returned, so the list could display a status the server had not accepted.
• Fixed answering a question giving no indication that anything was in progress, because the screen was never told the action had started.

Frontend corrections

• Fixed the FAQ detail page always requesting English wording rather than the language in the address, so a visitor's chosen language was ignored on that page.
• Fixed a duplicated translation lookup in the error screen.
• Fixed the troubleshooter failing when a selection was made before a step was available.
• Fixed the ask-a-question form erroring on close where the page provides no cancel action.
• Fixed images in FAQ content being rendered without optimization or lazy loading.
• Fixed an ellipsis being appended to text that had not actually been truncated, so short strings ended in "..." for no reason.

Analytics Dashboard

• Fixed the category breakdown chart recomputing its colours on every render.

Minor Fixes

• Fixed expected failures — network errors, validation errors — being written to the console on every FAQ screen, polluting production logs.
• Fixed the public FAQ stats response including creation timestamps on recent questions, exposing internal metadata to unauthenticated visitors.
• Fixed the stats preview always ending in "..." whether or not the answer had actually been truncated.
• Fixed the troubleshooter loading spinner being invisible to screen readers.