We've just released v3.83 beta (our biggest single release to date!), and we're already running it on our site.

Here are some highlights from this release: 

• Field Editor
  • Show If: New option allows you to dynamically show/hide fields based on the values of other fields
  • Show for: Replaces old "Admin only" setting with options for everyone, editor, admin only, or new: Nobody (completely hidden)
  • Placeholder: New option for text and textbox fields to set hint text inside the field when empty
  • Field List UI: Lock and eye icons now mark restricted and conditional fields in your field list
  • Reorganized and simplified the field editor UI
• Admin → Advanced → MCP Server
  • AI coding assistants like Claude Code can now read and update your CMS directly
  • Read and write records, upload files, run queries, and view your database schema
  • Built-in /fix-cms command: AI reviews your recent PHP errors and offers fixes
• Admin → Backup & Restore → Website → Restore from Zip
  • Added restore button to restore from previous website backup zips (for uploading a local or dev site)
• Fields → List → pillbox (multi value)
  • Selected values can now be drag sorted to change the order
  • Dropdown options show checkboxes to select multiple values (easier for end-users)
• Admin → Advanced
  • Admin Favicon: Pick a colored favicon (green/yellow/red) to tell CMS installs apart in your browser tabs (e.g. dev, staging, live)
  • Server Links: Add dev, staging, and live server URLs for quick-switching between environments
• Developer Console
  • Automatically decrypts and displays contents from encrypted fields
• General code modernization and cleanup

Note: We still have a queue of pending user feature requests.  We're releasing what we have now so you can start using it.  Feel free to remind us what you'd like to see next. 

The full changelog for this release is as follows:

*** April 14, 2026 - Version 3.83 (Show/Hide Fields & MCP Server)

SERVER REQUIREMENTS (Since Jun 2025): PHP 8.1+ and MySQL 5.7+ (or MariaDB 10.2+)

FIELD EDITOR
    - Show/Hide Fields: Fields now show/hide automatically based on what users select
        - Example: Show "Speaker Name" only when Event Type is "Webinar"
        - Example: Show "Shipping Address" only when Delivery Method is "Mail"
        - Works with all field types: text, checkboxes, tabs, upload fields, related records
        - Custom expressions allow for multi-field AND rules (e.g. type=article AND status!=draft|hidden)
        - Configure in: Database > Edit Field > Visibility > Show If
    - Field Access: "Admin Only" replaced with clearer "Show for" dropdown
        - Options: Everyone, Editor and above, Admin only, or new: Nobody (completely hidden)
    - Placeholder: New option for text and textbox fields to set hint text inside the field when empty
    - Lock and eye icons now mark restricted and conditional fields in your field list
    - Simplified field editor interface with cleaner organization
    - Textbox Fields: "Auto Format" renamed to "Line Breaks" (nl2br) and deprecated. Off for new fields, can be turned off but not back on

MCP SERVER
    - AI coding assistants like Claude Code can now read and update your CMS directly
    - Read and write records, upload files, run queries, and view your database schema
    - Configure in: Admin > Advanced > MCP Server (IP allowlist, API keys, permissions)
    - Built-in /fix-cms command: AI reviews your recent PHP errors and offers fixes
    - Security: IP allowlist required, Bearer token auth, read-only enforced at MySQL session level
    - Write operations logged to the audit log

ADMIN > BACKUP & RESTORE
    - Website: Added restore button to restore from previous website backup zips
    - Website: Previous Backups dropdown now shows relative dates (e.g., "5 min ago", "yesterday")
    - Website: Removed "Only include code files" option (use .cms-no-backup marker files to exclude folders instead)
    - Database: Backup dropdown now offers option to include log tables in backup ("include skipped")

PILLBOX & FOREIGN KEY FIELDS
    - Replaced form dropdown component Select2 with Tom Select
    - Pillbox: drag pills to reorder selected values
    - Pillbox: dropdown options show checkboxes so you can see all options and their selection state at a glance
    - Type-ahead search to filter options instantly

ADMIN > ADVANCED (New Page)
    - Reorganized admin settings into "Admin Interface" and "Advanced Settings" sections
    - Admin Favicon: Pick a colored favicon (green/yellow/red) to tell CMS installs apart in your browser tabs
    - Server Links: Add dev, staging, and live server URLs for quick-switching between environments
    - Admin Shortcuts, Debug Footer, and WYSIWYG/Menu/Cookie settings moved here from General Settings

MINOR CHANGES
    - Email Settings: Developer Email now accepts multiple comma-separated addresses
    - File Uploads: Files are saved with dashes instead of underscores for better SEO, and .jpeg is normalized to .jpg
    - Audit Log: Expanded logging coverage for fields, tables, uploads, backups, and database operations
    - Security: Added additional .htaccess hardening for data directories (Apache 2.4+ compatibility)
    - Improved text contrast for input fields, selects, and placeholders
    - Admin menus updated and reorganized for better usability
    - Upgraded Dependencies: PHPMailer v6 to v7, Firebase/JWT v6 to v7, and other library updates

BUG FIXES
    - SmartArray: Fixed TypeError when calling load() on SmartArrayHtml (changed type hint to SmartArrayBase)
    - Language: Fixed "No such file or directory" error when developer mode was enabled without a language selected
    - Upload Fields: Fixed "Create Thumbnail" checkbox re-enabling itself after saving when unchecked
    - Edit Page: Fixed false "unsaved changes" warning appearing after clicking in fields without editing them
    - Misc code and other minor improvements

**FOR PROGRAMMERS**
    - Modern PHP features enabled:
        - Native types: Database queries now return native PHP types (int/float) instead of strings
        - mysqli::execute_query() for one-line parameterized queries (available natively in PHP 8.2+, backported for PHP 8.1):
            $rows = DB::$mysqli->execute_query("SELECT * FROM users WHERE id = ?", [$id])->fetch_all(MYSQLI_ASSOC);
            DB::$mysqli->execute_query("UPDATE users SET name = ? WHERE id = ?", [$name, $id]);
    - Database Encryption: Key now cached as MySQL session variable @ek
        - Faster: Computed once per-connection, not per-query
        - Simpler: AES_ENCRYPT(val, @ek) instead of AES_ENCRYPT(val, UNHEX(SHA2('key',512)))
        - Cleaner: Key hidden from SHOW PROCESSLIST and error messages
        - On-demand: Only initialized when encrypted fields are used
    - MySQL Console: Record edit page database icon now opens console with that record in column mode
    - MySQL Console: New {{column}} shortcut auto-expands to AES_DECRYPT(`column`, @ek) for encrypted columns
    - Moved /api.php to /api/ to better organize future API endpoints

**FOR PROGRAMMERS (BREAKING CHANGES)**
    - Note: These changes only impact developers who have written custom PHP code
    - Database queries now return native PHP types (int/float) instead of strings
        - If your code expects strings, cast them: (string)$row['id']
    - MySQL queries now throw exceptions instead of returning false (following PHP 8.1+ standard behavior).
        - Before: $result = mysqli()->query($sql) or die("MySQL Error: " . mysqli()->error);
        - After:  try { $result = mysqli()->query($sql); } catch (mysqli_sql_exception $e) { die("MySQL Error: " . $e->getMessage()); }
    - Library Updates: ZenDB has been moved to composer with several renamed and deprecated methods
        - DB::get() renamed to DB::selectOne() (DB::get() still works but is deprecated)
        - See ZenDB docs for full list of changes: https://github.com/interactivetools-com/ZenDB/

You can download the latest beta here: https://www.interactivetools.com/download/

Please post (or email) any feedback, questions, concerns, or bugs you find.   Your help with beta testing allows us to release new features even faster.

Thanks. We look forward to your feedback! :)

Okay, perfect. Since you've done the CMS upgrade before, the CMSB side should be straightforward.

For any custom PHP code or plugins, the most common issue is type handling. PHP 7 was more forgiving - it would silently accept `null` where a string was expected. PHP 8 throws deprecation warnings (and PHP 9 will make them errors).

An example might be @$_REQUEST['city']; if that form field wasn't submitted, it would return null.

So if you see warnings like `trim(): Passing null to parameter #1` or `strlen(): Passing null to parameter #1 ($string) of type string is deprecated`, the fix is usually one of:

// Option A: null coalesce to set a default for null values
$value = trim($record['middle_name'] ?? '');

// Option B: cast to string
$value = strlen((string) $record['notes']);

What I recommend is upgrading, then clicking through all the pages and checking the CMS Developer for any errors.

Let me know if you run into anything specific, and we can help you sort it out.

First, make sure your database is supported by the latest version - you'll want MySQL 5.7+ or MariaDB 10.2+.

But in general, it's pretty straightforward. Backup everything (files and MySQL), upload the new CMSB files over top of the old ones, then upgrade any plugins that need upgrading.

If you run into any PHP 7 to 8 coding errors in your custom code, any of the AI coding agents (Claude, ChatGPT, etc.) can help you come up with a fix pretty quickly.

That said, feel free to fill out a 2nd-level support request if you'd like me to take a look either before or after: https://interactivetools.com/support/request/

Also, feel free to email me at dave@interactivetools.com if you run into any issues. I'll be around this weekend and can help make sure you're back up and running by Monday if needed.

Hope that helps, let me know any questions!

Unfortunately, there's no built-in functionality for that, or quick fixes.

Can you let me know what you want to use it for and how you'd want it to work? 

For example, what problem are you trying to solve?

Thanks!

We're currently working on a big update for the next release, but I can keep this in the queue for a future release.

We actually wanted to redo the date component already for better multi-lingual support.

The browser date fields are generally considered not to have the best user experience compared to some of the custom ones.   

The benefit of the multi-field is that it's quick to select, but it depends on your use case, though.  You'll see most of the big sites (airbnb, google flights, etc) use custom date controls.  We were looking into some of the more popular date field components a while back.

We've already got some requests for Date field modifications already.  Can you let me know how you'd like it to work differently so we can consider that as well?

Thanks!

This took us a bit to track down.  Can you try this fix: 

In /cmsb/lib/menus/default\wysiwygMedia.php

Replace this: 

uploadIframe.contentDocument.location.reload();

With this: 

uploadIframe?.contentDocument?.location.reload();

Let me know if that works for you.  If not, feel free to submit a 2nd level support request, and we'd be happy to help you track it down and resolve it.

Thanks!

Can you submit a 2nd-level support request?  We'll take a look and resolve this for you: 

https://interactivetools.com/support/request/

Thanks!

Thanks, we'll look into this and get back to you shortly.

This will be easier for us to confirm and debug on your server directly.  Can you send in a 2nd level support request, and we'll take a look?

https://interactivetools.com/support/request/

Thanks!

Thanks for the suggestion.  That makes sense. We'll take a look at that for a future release to see how we can improve the UX.

We're busy working on the next release, which is probably 1-2 weeks out before the beta, but can revisit repeater fields in the future.

Can you give me an example use case?  How you'd actually be using it.  e.g., What's a real-world example of some fields you'd be repeating? 

We're busy working on the next release, which is probably 1-2 weeks out before the beta, but can revisit repeater fields in the future.

Can you give me an example use case?  How you'd actually be using it.  e.g., What's a real-world example of some fields you'd be repeating? 

Auto Backup backs up your MySQL database, so it shouldn't include PDFs. But yes, once your backup files become very large or the server times out, the next step is to check for other backup options available through your hosting provider.

If you're thinking of the "Website Backup" feature under Admin > Backup & Restore > Website Backup, it can also experience similar timeout issues with large sites. What you can do is create an empty file named .cms-no-backup in any folder to exclude it from backups.  That way, you can skip those large PDFs. Just make sure you back up those PDFs somewhere else.

And yes, once your backup files become very large or the server times out, it's worth checking with your hosting provider for other backup options.

Hope that helps!

You might have an old schema file or mysql column definitions from an old backup.  

The upload section is hidden in the database editor but you can direct link to it like this: 
/cmsb/admin.php?menu=database&action=editTable&tableName=uploads&tab=mysql

Check what filePath is, it should be: 

`filePath` varchar(255) DEFAULT NULL,

For any fields that don't have "DEFAULT NULL", just click modify and save on the field and it will ensure it has the right type.

Hope that helps!

Will all language content be exactly mirrored, or might some languages have more or different content than others?

There's lots of ways to set it up.  I'd start at the end and thing about how's you'd like it to be and work in reverse.  

Think about how you'd most like it to be structured on the back end (single record, multiple records, multiple sections) and on the front end (language pulldown, /en/ language subfolders, subdomains, etc.).

So in .htaccess we have something like this that checks to the see if the URL or permalink exists as a file or directory.  If it doesn't it passes the request to the dispatcher: 

### Pass URL to permalinks dispatcher (do this last after any other redirects)
RewriteRule ^permalinks_dispatcher\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /cmsb/plugins/permalinks/permalinks_dispatcher.php [L]

But if you're password protecting your admin folder with .htaccess and .htpasswd, that can interfere with the directory detection and redirect.

You can try adding a condition to skip your admin folder when processing permalinks.  Something like this: 

### Pass URL to permalinks dispatcher (do this last after any other redirects)
RewriteRule ^permalinks_dispatcher\.php$ - [L]
RewriteCond %{REQUEST_URI} !^/cmsb/
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /cmsb/plugins/permalinks/permalinks_dispatcher.php [L]

Let me know if that works for you!

Thanks for the feedback!

@Kenny, excellent, glad to hear the .env files are working well for you!

@JeffC, thanks for the report.  We can't recreate this locally.  Can you send me an email or support ticket and we can take a look.

@JeffS, thanks, I posted a fix for this in the other thread and we'll have it updated for the next release.

We've got some really exciting features coming in the next beta.  Appreciate all your support and feedback!

Great find, thanks for reporting that. 

We'll have that patched in the next beta and here's some updated code if you want to try it now: 

// Validate field exists (upload or wysiwyg with allowUploads) and user has access
$fieldName   = request('fieldName');
$fieldSchema = Schema::fields($GLOBALS['tableName'])[$fieldName] ?? null;
$canUpload   = $fieldSchema && ($fieldSchema['type'] === 'upload' || ($fieldSchema['type'] === 'wysiwyg' && !empty($fieldSchema['allowUploads'])));
match (true) {
    empty($fieldSchema)               => die("Invalid field: $fieldName"),
    !$canUpload                       => die("Field doesn't allow uploads: $fieldName"),
    !userHasFieldAccess($fieldSchema) => die("No access to field: $fieldName"),
    default                           => null,
};

Let me know if you run into any other issues.  Thanks!

This is a tricky one, but an interesting idea.

The MySQL Console gives you raw access to the MySQL, and the data IS encoded there.  So we want both honest data and a way to access it for usability.

Currently, you'd need to type a lot of MySQL in the query to decode those values (or we'd need to generate and replace your query or do it behind the scenes as a secondary query).

I've made some updates to the upcoming beta so you'll be able to type a lot less:

AES_DECRYPT(name, @ek) // @ek is the encryption key

So, for example: 

SELECT num, AES_DECRYPT(name, @ek), AES_DECRYPT(name, @ek) FROM cms_users

Note, this doesn't work yet, but will in the upcoming beta.

We could probably come up with a checkbox or something that lets you auto-decode.  So * gets replaced with the decode expressions.

I'll think on it some more.  Are you mostly using this on SELECT * FROM queries (getting all columns)?  And is it mostly single-table queries, or are there joins as well?

Great suggestion.  We'll put that on the list and look into how to implement it.

There are a few different approaches. A good starting point is to think about the end-user experience you wantΓÇöwhat should the URLs look like, how should the CMS edit screen be organized, etc.

Here are the main options:

Separate records per language: Each article has multiple records (one per language), and you toggle or filter by language. The site uses a default language unless another is specified.

Single record with multiple languages: If you don't have too many languages, you can duplicate the fields within the same record. You'd use the tab interface (one tab per language) or organize them into sections.

Will all language content be exactly mirrored, or might some languages have more or different content than others?

For the front end, you could use a language selector dropdown (stored in a cookie), filter articles by language, or use different directories/subdomains for each language.

Sorry for the delay in responding. If you're still working on this, let me know how you'd like it to work or how far you've gotten so far.

These look great, I'm looking forward to trying them out.  Nice work!

Just a heads up for anyone else with this issue.  We tracked it down to a bug that happens when these two settings are enabled together: 

• Program Language = "default"
• Developer Mode [X] Automatically add new language strings to language files (disable in production)

We'll have a fix for it in the next release, and the short-term fix is to just uncheck the language "Developer Mode".

Thanks!

Thanks for the report and sorry for the delayed response; we're working through a queue of site launches.

That RFC is about things like "Hello ${name}" which should now be written as "Hello {$name}" (dollar sign on the inside).

The self::${$key} syntax in Config.php is actually the standard way to access class properties when the property name is in a variable, which is a different feature entirely and isn't affected by that deprecation. 

Here's what it does - the Config class has properties like $hostname, $database, $tablePrefix, $logFile, etc. When you call:

DB::config('logFile')  // $key = 'logFile'
$key = 'logFile';      // set by config
self::${$key}          // resolves to Config::$logFile

The ${} tells PHP "evaluate what's inside first, then use that as the property name." So it returns whichever property matches the string you passed in.

Easy to mix up since they look similar! I had to double-check myself when I saw your post.

If you do see any actual deprecation warnings in your error logs, definitely let us know, and we'll get them sorted out.

PS: You can copy-and-paste this post to Claude and ask them to fact-check it.

Also, I really appreciate that you're taking such a deep dive into the code.  Let me know any other questions or feedback.  Thanks!

Thanks for the report!  I can't recreate that locally, can you send over server details?  I can debug it live and get you a fix.

Thanks!