What's new

Version 9.4.2 is a security and maintenance release, and we recommend all users update. Sites that connect to Redis through a Unix socket should update immediately: since 9.4.0, those connections failed and JCH Optimize fell back to filesystem storage.

Security: this release stops CSS and JavaScript files outside the site root from being read through encoded slashes in their URLs when files are combined, and stops combining files from fetching files from private network addresses. It also fixes cross-site scripting in the Critical JavaScript Configure Helper, keeps the Download ID out of settings exports, lets the request that starts a Recache be used only once, and waits for an administrator before applying the .htaccess changes and plugin ordering after an update.

Page Cache: tag pages no longer show an error page after their content for guests, and are cached again. Pages left unoptimized for a single request are no longer cached and served to every visitor. Page Cache's cookies now follow the Cookie Path, Cookie Domain and Force HTTPS settings in Global Configuration, and cover the whole site, so logged-in users are no longer served captured guest pages.

Optimize Fonts: with Optimize CSS Delivery on, the @font-face rules used above the fold stay in the critical CSS, so fonts are no longer delayed. Stylesheets listed in "Optimize these files" are no longer removed from the page while Optimize Fonts is off.

Installation and updates: new installs now run the post-install tasks, upgrading from the free version to Pro enables the plugins Pro adds, sites keep a single update site with the Download ID, and uninstalling leaves no files behind.

Recache: Recache works again on servers that can't run PHP from the command line, where it cached no pages, and errors there are now logged. Its default Concurrency is lowered from 10 to 5, so a recache leaves PHP workers free for visitors.

Several bugs were fixed, including Save Changes in the Critical JavaScript Configure Helper, Recache on servers that can't reach the cache storage from the command line, the dashboard's bulk settings buttons, browsers autofilling the Redis password, and duplicated @imports. See the CHANGELOG for details.

Developed and tested on up to PHP 8.5.11 and Joomla! 6.1.4

Changelog

Bug fixes

• [LOW] Fix Add Image Attributes showing an error page on pages with an image button ().
• [LOW] Fix Load responsive images (Pro) leaving a broken style attribute on an element above the fold with several background images in its style attribute. All of them are moved to the style element now.
• [LOW] Fix PHP warnings and notices being shown in the responses to the component's admin requests on sites that display PHP errors, which could stop the admin pages working.
• [LOW] Fix the Exclude images from sprite and Include additional images in sprite settings failing to list the sprite's images.
• [LOW] Optimize Images (Pro) adds each image to its list of optimized images once. An image optimized again was added again, so the list kept growing.
• [MEDIUM] Fix Cloudflare's whole cache being cleared each time JCH Optimize removed expired files from its cache, with Enable Cloudflare Purge (Pro) on. Only the pages removed from the Page Cache, including pages that used an expired combined file, are cleared at Cloudflare now, sent in batches Cloudflare accepts. Deleting pages on the Page Cache page with none that are still cached no longer clears Cloudflare's whole cache either.
• [MEDIUM] Fix pages showing an error page when the Sprite Generator is on and the combined CSS has background images for a sprite.
• [MEDIUM] Fix visitors who logged in on the site with Exclude form users on being kept out of the Page Cache after logging out, until the end of the Page Cache's lifetime. The login form is a posted form, and the cookie it set stayed after logout. The User - JCH Optimize User State plugin now removes it when the user logs out, and is included in the free version too.