No frontend after update 4.7.1

The CMS Questions
1

I just switch form 4.7.0. to 4.7.1 and got no frontend. It’s at the moment only in a local env on a project I just published today.

At the frontend I got after the update.

<html><head></head><body></body></html>

The panel is accessible. Are they breaking changes in the codebase of the 4.7.1?

In my case I use → GitHub - tobimori/kirby-baukasten: 🦎 Batteries-included Kirby 4 Boilerplate with Tailwind CSS, Stimulus, TypeScript, Vite & other best practices as “preset” and change some parts that it fits my needs.

My composer

{
...
	"minimum-stability": "beta",
	"require": {
		"php": ">=8.2.0",
		"getkirby/cms": "^4",
		"bnomei/kirby3-dotenv": "^2.0",
		"lukaskleinschmidt/kirby-laravel-vite": "^2.1.1",
		"tobimori/kirby-spielzeug": "^2.1.0",
		"getkirby/cli": "^1.2",
		"tobimori/kirby-tailwind-merge": "^3.0",
		"tobimori/kirby-icon-field": "^2.2",
		"sylvainjule/locator": "^2.0",
		"plain/kirby-form-block-suite": "^5.0",
		"tobimori/kirby-seo": "^1.1"
	},
	"config": {
		"optimize-autoloader": true,
		"allow-plugins": {
			"getkirby/composer-installer": true,
			"php-http/discovery": true
		}
	}
}

vite.config

import { resolve } from "node:path"
import { defineConfig, loadEnv } from "vite"
import laravel from "laravel-vite-plugin"
import tsconfigPaths from "vite-tsconfig-paths"
import svgSprite from "vite-svg-sprite-wrapper"
import tailwindcss from "@tailwindcss/vite"
import inject from "@rollup/plugin-inject"
import browserslist from "browserslist"
import { browserslistToTargets } from "lightningcss"
import { browserslist as browserslistConfig } from "./package.json"

export default defineConfig(({ mode }) => {
	const env = loadEnv(mode, process.cwd(), "")

	return {
		base: mode === "development" ? "/" : "/build/",

		build: {
			outDir: resolve(__dirname, "public/build"),
			emptyOutDir: true,
			manifest: "manifest.json",
			cssMinify: "lightningcss"
		},
		plugins: [
			// this plugin is necessary for our HTMX extensions to correctly register
			inject({
				htmx: "htmx.org"
			}),
			svgSprite({
				sprite: {
					shape: {
						transform: [
							{
								svgo: {
									plugins: [{ name: "preset-default" }, "removeXMLNS"]
								}
							}
						]
					}
				},
				icons: "assets/icons/*.svg",
				outputDir: "assets/"
			}),
			svgSprite({
				sprite: {
					shape: {
						transform: [
							{
								svgo: {
									plugins: [{ name: "preset-default" }, "removeXMLNS"]
								}
							}
						]
					}
				},
				icons: "assets/img/*.svg",
				outputDir: "assets/"
			}),
			laravel({
				input: ["src/index.ts", "src/styles/index.css", "src/styles/panel.css"],
				refresh: ["site/{layouts,snippets,templates}/**/*"]
			}),
			tsconfigPaths(),
			tailwindcss()
		],
		css: {
			transformer: "lightningcss",
			lightningcss: {
				targets: browserslistToTargets(browserslist(browserslistConfig))
			}
		},
		server: {
			origin: env.APP_URL,
			port: Number(env.VITE_DEV_PORT || 3000),
			proxy: {
				// we proxy anything except the folders our vite dev assets are in
				"^(?!/src|/node_modules|/@vite|/@react-refresh|/assets).*$": `http://${env.KIRBY_DEV_HOSTNAME}:${env.KIRBY_DEV_PORT}`
			}
		}
	}
})

config

<?php

use Kirby\Cms\Pages;
use Kirby\Http\Url;
use tobimori\Spielzeug\Menu;

require_once dirname(__DIR__) . '/plugins/kirby3-dotenv/global.php';

$baseDir = realpath(dirname(__DIR__, 2));
$host = $_SERVER['HTTP_HOST'] ?? 'localhost';

$envFile = '.env.' . $host;
if (!file_exists($baseDir . '/' . $envFile)) {
	$envFile = '.env'; // Fallback
}

loadenv([
	'dir' => $baseDir,
	'file' => $envFile,
]);

return [
	'panel' => [
		'vue' => [
			'compiler' => false
		]
	],
	'languages' => true,
	'debug' => json_decode(env('KIRBY_DEBUG')),
	'yaml.handler' => 'symfony',
	'date.handler' => 'intl',
	'url' => env("APP_URL"),
	/** Email */
	// 'email' => require __DIR__ . '/email.php',
	'auth' => [
		'methods' => ['password', 'password-reset'],
	],
	/** Caching */
	'cache' => [
		'pages' => [
			'active' => json_decode(env('KIRBY_CACHE')),
		]
	],
	/** Build Env / Vite / etc. */
	'bnomei.dotenv.dir' => fn() => realpath(kirby()->roots()->base()),
	'ready' => fn() => [
		'panel' => [
			'favicon' => option('debug') ? 'static/panel/favicon-dev.svg' : 'static/panel/favicon-live.svg',
			'css' => vite('src/styles/panel.css'),
		],
	],
	'markdown' => [
		'extra' => true
	],
	'plain.formblock' => [
		'translations' => [
			'de' => [
				'send_button' => 'Nachricht senden'
			]
		]
	],
];
2

Kirby 4.7.1 breaks uses of the snippet() helper that use path traversal like snippet('../something') deliberately. Kirby Baukasten contains such uses in template files.

Please see the note in the release notes and the effects on site code section in the advisory for more information and alternatives.

3

I’ve created a pull request for Kirby Baukasten here:

2 Likes