What's new

Version 9.4.2 is a security and maintenance release, and we recommend all users update. Sites that connect to Redis through a Unix socket should update immediately: since 9.4.0, those connections failed and JCH Optimize fell back to filesystem storage.

Security: this release stops CSS and JavaScript files outside the site root from being read through encoded slashes in their URLs when files are combined, and stops combining files from fetching files from private network addresses. It also fixes cross-site scripting in the Critical JavaScript Configure Helper, keeps the Download ID out of settings exports, lets the request that starts a Recache be used only once, and waits for an administrator before applying the .htaccess changes and plugin ordering after an update.

Page Cache: tag pages no longer show an error page after their content for guests, and are cached again. Pages left unoptimized for a single request are no longer cached and served to every visitor. Page Cache's cookies now follow the Cookie Path, Cookie Domain and Force HTTPS settings in Global Configuration, and cover the whole site, so logged-in users are no longer served captured guest pages.

Optimize Fonts: with Optimize CSS Delivery on, the @font-face rules used above the fold stay in the critical CSS, so fonts are no longer delayed. Stylesheets listed in "Optimize these files" are no longer removed from the page while Optimize Fonts is off.

Installation and updates: new installs now run the post-install tasks, upgrading from the free version to Pro enables the plugins Pro adds, sites keep a single update site with the Download ID, and uninstalling leaves no files behind.

Recache: Recache works again on servers that can't run PHP from the command line, where it cached no pages, and errors there are now logged. Its default Concurrency is lowered from 10 to 5, so a recache leaves PHP workers free for visitors.

Several bugs were fixed, including Save Changes in the Critical JavaScript Configure Helper, Recache on servers that can't reach the cache storage from the command line, the dashboard's bulk settings buttons, browsers autofilling the Redis password, and duplicated @imports. See the CHANGELOG for details.

Developed and tested on up to PHP 8.5.11 and Joomla! 6.1.4

Changelog

Changes

• Lower the default Concurrency for Recache from 10 to 5, so a recache leaves PHP workers free for visitors. Recache from a web request and the command line used 20 when the setting was never saved.

Bug fixes

• [HIGH] Fix CSS and JavaScript files outside the site root being readable through encoded slashes (..%2F) in their URLs when files are combined.
• [HIGH] Fix Redis connections through a Unix socket failing since 9.4.0, so JCH Optimize fell back to filesystem storage. Hosts written as unix:///path, or any absolute path, are now also recognized as sockets.
• [HIGH] Fix tag pages showing an error page after the content for guests when Page Cache is on, and not being cached, since 9.4.0. Tag pages pass their tags as a list, which the Page Cache hit counter didn't accept. It now counts the hit on the first tag, as Joomla does. An error while storing a page in the Page Cache now skips caching it instead of being added to the page.
• [LOW] Composer's list of installed packages no longer includes packages that aren't shipped.
• [LOW] Fix a duplicated @import being combined again when Resolve @imports is on.
• [LOW] Fix an "Undefined array key 0" notice when the JCH Optimize Mode Switcher module was installed for the first time.
• [LOW] Fix browsers autofilling the administrator login password into the Redis password field.
• [LOW] Fix links being injectable into the error message on the Optimize Images page.
• [LOW] Removing JCH Optimize's section from .htaccess leaves the rest of the file as it was. It left blank lines behind and collapsed every run of blank lines in the file.
• [LOW] The Page Cache hit counter ignores scheduled and expired items, and gives the same response whether or not a hit was recorded.
• [LOW] Uninstalling removes all of JCH Optimize's media and language files, the dashboard module's asset and menu assignment, the empty plugin folders it leaves, and its log file.
• [MEDIUM] After an update, the .htaccess changes and plugin ordering wait for an administrator who can install extensions and reorder plugins, instead of running on a visitor's request or the command line. Caches are still cleared on the next request.
• [MEDIUM] Combining files no longer fetches files from private network addresses, or follows redirects to them.
• [MEDIUM] Fix Recache caching no pages when the server can't start PHP from the command line, such as when open_basedir hides the PHP binary. Recaching within a web request logged "Recache failed: Call to a member function get() on null", or stopped with a fatal error after the response was sent that left nothing in the log. Such errors are now logged. The Console - JCH Optimize plugin's recache command and the scheduled task weren't affected.
• [MEDIUM] Fix Recache failing when the cache storage adapter is unavailable, such as APCu on the command line.
• [MEDIUM] Fix Save Changes in the Critical JavaScript Configure Helper failing with a server error since 9.4.0, so the selected files weren't saved.
• [MEDIUM] Fix cross-site scripting in the Critical JavaScript Configure Helper, which showed script URLs from the site's pages without escaping them.
• [MEDIUM] Fix new installs skipping the post-install tasks, so system plugins weren't put in the order JCH Optimize needs and the Nginx include wasn't filled in.
• [MEDIUM] Fix sites collecting several JCH Optimize update sites, including ones left by older versions, which didn't all have the Download ID. After an update, JCH Optimize keeps one update site with the Download ID and removes the rest.
• [MEDIUM] Fix stylesheets listed in Optimize Fonts' "Optimize these files" being removed from the page while Optimize Fonts is off. They are combined as usual.
• [MEDIUM] Fix the Export, Reset and Import buttons in the dashboard's bulk settings dialog not working.
• [MEDIUM] Fix upgrading from the free version to Pro leaving the Console - JCH Optimize, Task - JCH Optimize and User - JCH Optimize User State plugins disabled. An update now enables the plugins it adds, and the plugins already installed keep their state.
• [MEDIUM] Page Cache no longer stores pages left unoptimized for a single request, such as pages loaded in an iframe, requested with jchnooptimize, or where optimization failed, which served the unoptimized page to every visitor.
• [MEDIUM] Page Cache's cookies follow the Cookie Path, Cookie Domain and Force HTTPS settings in Global Configuration, and cover the whole site when Cookie Path is empty. The cookie that keeps visitors who posted a form out of the Page Cache only covered the form's folder, and logged-in users could be served captured guest pages in other folders.
• [MEDIUM] Recache from the command line no longer cleans the cache when the selected cache storage can't be reached from the command line, such as APCu, which left cached pages missing from the Page Cache list. It now shows a warning instead.
• [MEDIUM] Settings exports no longer include the Download ID, and the Optimize Images page only includes it for users who can optimize images.
• [MEDIUM] The request that starts a Recache can only be used once, and only one Recache runs at a time.
• [MEDIUM] With Optimize CSS Delivery on, Optimize Fonts keeps the @font-face rules used above the fold in the critical CSS. It moved them to a separate stylesheet that loaded after the page, which delayed the fonts.