PHP2Shell

PmWiki is temporarily offline while we arrange to upgrade our PHP installation.

Thank you for your patience and understanding. If you have any questions, please contact us at 5ko [snail] 5ko [period] fr.

In the meantime, you can find recent release notes, links to the software, and other downloads below.

You may also be able to access a recent archived copy of this page through the Internet Archive.

Petko October 23, 2026, at 10:19 AM

Core downloads, internationalization

Changes made to the subversion pre-release of PmWiki. You can get a full ZIP archive of the nightly version, or a partial export with only the files changed since pmwiki-2.7.8.

Installed and other versions of PmWiki are available for download at www.pmwiki.org/pub/pmwiki/.

Direct links to core software

Latest stable release (pmwiki-2.7.8 or more recent):

Direct links to installed release pmwiki-2.7.8:

You can download the latest development code packed as a zip archive here:

pmwiki-latest-svn.zip

International language packs

Language packs can be installed on top of the core software.

https://www.pmwiki.org/pub/pmwiki/i18n/ - For all available translations

Release notes

Version 2.7.8 (2026-10-24)

This version fixes a bug, and updates the documentation, for the (:details:) directive.

Version 2.7.7 (2026-10-23)

This version includes updates for audio and video players, the PmSyntax highlighting, the PmLib and Utilities JavaScript library, InterMap links, diagnostic tools, Sortable, downloads,

The core functions PrintFmt, PrePrintFmt, PrintSkin were refactored, to allow directives from included headers, footers, and sidebars, to insert styles and scripts in $HTMLHeaderFmt.

A fix for nested markup functions calling MarkupToHTML() with a different $pagename.

Changes to the (:details:) directive to work with simpler "open" and "summary" attributes, and without a "summary" attribute.

The documentation was updated.

Version 2.7.6 (2026-09-18)

This version includes updates for recent PHP versions and fixes a bug with the markup expression {(substr ...)}, which in some cases could return an empty string.

Page histories will now reveal the IP addresses of edits only to administrators.

Audio and video improvements, the hash fragment keyword "lazy" can now be used as an alias of "loading=lazy", and videos are responsive, scaled down if they would be larger than the screen size, keeping their aspect ratio.

The PageList variable $MatchSearched count will no longer include protected pages where the user does not have read access.

This version will prevent saving page names with invalid UTF-8 bytes. For this reason the helper function pm_recode() will now prefer mb_convert_encoding() if it exists to iconv().

A new variable $AuthorMaxLength shortens very long author names, default to 64 characters.

There were also improvements to some helper functions, and the documentation was updated.

Version 2.7.5 (2026-08-05)

This version closes a vulnerability in PmWikis on Windows servers, reported by Michael Engelke. It potentially allows a person with edit access to a page, to retrieve the full source text of another page in a read-protected group where the person should not have access. All wikis versions 2.0.0 to 2.7.4 on Windows servers may be vulnerable.

If your PmWiki installation:

runs on a Windows server, and
your wiki allows editing for untrusted users, even only WikiSandbox, and
you may have sensitive information in restricted wikigroups, such as SiteAdmin.NotifyList, and
you cannot immediately upgrade to 2.7.5,

If your wiki meets all the conditions above, to close the vulnerability before you've had the chance to upgrade, you can add this in farmconfig.php or config.php:

if(!empty($_REQUEST['template']))
  $_REQUEST['template'] = preg_replace('![./\\\\]+!', '.', $_REQUEST['template']);

Additionally, this version includes updates for recent PHP versions, and the documentation was updated.

Version 2.7.4 (2026-07-31)

This version fixes bugs with the display of page variables {$Action}, {$PasswdRead} and related, and with the undocumented pagelist variable .

The global variable $action will now be sanitized before loading config.php, keeping only Latin letters, digits, dashes, underscores, and slashes. If a local customization requires the previous definition, it can redefine the variable from $_GET and $_POST.

The documentation was updated.

Version 2.7.3 (2026-07-26)

This version fixes a bug with the markup expression {(substr ...)} when arguments are missing.

Version 2.7.2 (2026-07-26)

This version fixes a bug with the markup expression {(substr ...)} when UTF-8 is not enabled.

Version 2.7.1 (2026-07-24)

Fixed a mangled $Version variable.

Version 2.7.0 (2026-07-24)

This version includes many changes and additions.

Important if in local configuration PageVariables are defined with the $authpage variable, please see the updated configuration snippet in PageVariables#security. Please let me know if you have any questions or difficulties.

This change was caused by work in progress to reduce and remove the core reliance on the PHP eval() function. Currently all core PageVariables, Markup expressions, and most Conditions definitions, which previously used eval(), have been rewritten to use callback functions which should be more secure and stable, and faster. Existing custom locally defined page variables, conditions, and markup expressions, should still work as before, but it is now possible to update them to the new API.

New PHP variables were added, see documentation for $RevisionNum, $EnableVersionedAssets, $VersionedAssetKeys, $JsonEncodeFn, $EnableBodyDataAttrs, $VisibleAnchor, $TextSectionQualifyPatterns, $EnableReadOnlyWithoutConfig.

New Page Variables were added, {$RevisionNum}, {$VersionNum}, {$VersionShort}, {$CurrentLocalTime}, {$CurrentTime}, {$Targets}.

A "visible anchor" markup was added, with double hash like [[##anchor]] and in headings !!##visible-anchor Heading. It will show the hash character only, linking to itself, easy for a user to right-click and copy the link to the anchor. The variable $VisibleAnchor can be defined to change the character shown. Such anchors can be used to include sections of other pages with (:include Page#visible-anchor:) (single hash in the include directive).

A new page store class, TempPageStore, saves page changes in session storage, for the current visitor only. This will now be enabled if a wiki does not have a local/config.php file to prevent bots from instantly abusing new wikis. See $EnableReadOnlyWithoutConfig to change change it.

The [++big++] and [--small--] font sizes are now defined as class names in pmwiki-core.css rather than the previous unsafe-inline style.

The {(ftime %#d)} markup expression, and the PSFT() helper function, now accept "percent hash letter" formats like "%#d" and "%#m" and others, which would remove any leading spaces and zeros from the related formats "%d" and "%m".

The optional core script tools.php was refactored into separate scripts. Recipes can now include only the scripts they need.

A new optional script request.php was added with helper functions to simplify remote requests from recipes using the PHP-cURL functions.

Input forms can now include a field with the names of optional fields like checkboxes, see Forms#optkeys.

The conditional markup (:if enabled Variable.Key:) can now be used to check if a specific key of a PHP global array is enabled, in this case $GLOBALS['Variable']['Key']. This is intended mostly for recipes that don't need to define multiple global variables now.

A new warning will now appear above the edit and upload forms if PmWiki detects that the temporary directories have become read-only. This may indicate grave problems and the system operator or the technical support team should be notified.

Another warning will appear in the upload form, if upload_max_filesize or post_max_size from php.ini are smaller than $UploadMaxSize.

The "jxl" image upload extension, and embed extension, was added as browsers recently started supporting it.

The Dropzone will now show a progress bar while a file is uploaded, and the icons were removed.

Various improvements and additions to core helper functions, the PmLib JavaScript library, minor optimizations, bug fixes and updates for recent PHP versions, see Change log.

The documentation was updated.

For older notes see Archive.org copy of the Release Notes page.

Changelog

Version 2.7.8 (2026-10-24)

Fix bug with details, reported by Holger Kremb.
Update documentation.

Version 2.7.7 (2026-10-23)

InterMap update Meatball to use https:.
Media fix unsupported links if the wiki defines a relative upload URL.
Update PmFFVersion() for the new 2-week release cycle.
PmLib add observe() helper for MutationObserver. Fix error in error reporting, reported by Said Achmiz.
Sortable handle dynamic tables.
PmSyntax update redirect markup.
Utils refactor wheel-input code to be compatible with slightly older browsers.
Refactor PrintFmt, PrePrintFmt, PrintSkin, and pmwiki-responsive skin, to allow directives from included headers, footers, and sidebars, to insert styles and scripts in $HTMLHeaderFmt.
Add apache_request_headers() to ?action=diag.
Fix for nested markup function calling MarkupToHTML() with a different $pagename.
Unlock parallel downloads of large files, update response headers.
Fix (:details:) without summary (PITS:01573). Simpler open and summary definitions.
Update documentation.

Version 2.7.6 (2026-09-18)

StopWatch output add class name "pmstopwatch", hide when printing.
PmMultipartMail update for PHP8, skip already added attachments, keep original filenames if possible, random boundary.
PageList variable $MatchSearched count should not include protected pages (PITS:01566).
Add $AuthorMaxLength, default 64.
Update $PmFFVersionData.
pm_recode() prefer mb_convert_encoding to iconv.
Prevent page names with invalid UTF-8 bytes.
Updates for PHP 8.
Page history to only show editors' IP addresses to administrators (personal information per GDPR).
PmMedia add "lazy" as alias to "loading=lazy", responsive videos - scale down if larger than screen size, keep aspect ratio.
Fix markup expression substr with only start for ASCII text in UTF-8 wikis.
Update documentation.

Version 2.7.5 (2026-08-05)

Fix vulnerability on Windows, reported by Michael Engelke (PITS:01563).
Varlink add $action.
Update caches.php for PHP 8 (PITS:01564), replace .htaccess snippet to use helper mkdirpdeny().
Update documentation.

Version 2.7.4 (2026-07-31)

Fix bug with (PITS:01561).
Sanitize $action, fix page variables {$Action}, {$PasswdRead} and related (PITS:01562).
Update documentation.

Version 2.7.3 (2026-07-26)

Fix bug with {(substr ...)} when arguments are missing (PITS:01560, cont.)

Version 2.7.2 (2026-07-26)

Fix bug with {(substr ...)} when UTF-8 is not enabled (PITS:01560).

Version 2.7.1 (2026-07-24)

Fix $Version string, somehow mangled by the release script.

Version 2.7.0 (2026-07-24)

Add class TempPageStore, enabled if no config.php (PITS:01555).
Add $RevisionNum, $EnableVersionedAssets, $VersionedAssetKeys.
Make pm_recode() recursive.
Add $JsonEncodeFn, pm_json_encode() retry if json_encode() exists but fails (PITS:01556).
Add $EnableBodyDataAttrs, data-attributes to <body>, useful for styling and scripting.
PmTOC remove "?" and "Δ" characters from createlink/reupload links from TOC.
WikiWords fix bug with CamelCase WikiStyles, reported by JR.
Add [[##visible-anchor]], $VisibleAnchor, refactor MarkupAnchors().
Add $TextSectionQualifyPatterns, cb_expandkpvz().
PmSyntax slight optimization.
MarkupBigSmall() move sizes to pmwiki-core.css, remove unsafe-inline style.
Fix warning for pagelist order=- (nothing), reported by Simon.
PSFT() allow for %#d and other extensions, fix %o if Intl:NumberFormatter is unavailable, better handling of double encoded percents.
Refactor tools.php into separate files. Add request.php, helpers PmREQ($data), PmREQB($url).
Add warning for read-only temporary directories.
Fix warnings for PHP 8, reported by Simon.
Fix TraceMarkup() to correctly show closures.
PPTD() add M=month, cast to float if numeric.
PmFFVersion() add 'basedate' format.
Input forms track optional checkboxes names, allow for setting flags like +checked.
FmtTemplateVars() revert MarkupEscape calls - bug with PmForm.
$Conditions['enabled'] allow for testing of Var.SubItem for $GLOBALS['Var']['SubItem'].
Update StopWatch() for PHP 8.
Refactor FileSizeCompact() to handle even bigger numbers, add helper FileSizeFromCompact().
HandleUpload() show warning if upload_max_filesize or post_max_size from php.ini are smaller than $UploadMaxSize.
Uploads add jxl extension.
PmLib.afetch add onprogress entry, Dropzone add upload progress bars, remove icons.
Add helper PEVAL(), CallbackWithArgs(), rewrite to not use eval() for most core conditionals, page variables, and markup expressions (PITS:01558).
Add page variable {$RevisionNum} (PITS:01559), restore {$VersionNum}, add {$VersionShort}, {$CurrentLocalTime}, {$CurrentTime} (moved from pmform.php), {$Targets} (used by a few recipes).
Fix unneeded warning for customized e_textarea in browse mode, reported by Simon.
Update documentation.

For older notes see Archive.org copy of the ChangeLog page.

Cookbook and Skins downloads

Attachment list only accessible to pmwiki.org editors.