Thalassa CMS

Thalassa 0.3.75

17 Jun 2026 16:16:40 +0000

Thalassa 0.3.75 is available for downloading.

This release introduces one (minor?) new feature: macro expansion is now available for the content coming from headed text files. To enable it, add the token macro to the list within the format header field (follow the link for details).

Also this release incorporates fixes for this (sorry, the discussion took place in Russian; TL;DR: list item pages can now be correctly generated for set-based lists, although hardly this is really useful) and this (sorry guys, the macros %[lsort:] and %[lindex:] didn't work in both 0.3.70 and 0.3.71, crashing to the coredump both the generator and the CGI).

Thalassa 0.3.70

9 Jun 2026 19:40:00 +0000

UPD (June 11, 2026): Thalassa 0.3.71 is uploaded; contains a couple of minor fixes.

A lot of fixes were applied to the Thalassa source here and there since the last release in February, so I decided it is time to publish them, despite the project is still in financial troubles. Hence, Thalassa 0.3.70 is available for downloading.

Besides fixes, it now contains one completely new feature: logging for the CGI. By default (if you don't provide the [logging] section in your thalcgi.ini) the CGI doesn't log anything anywhere, just like its previous versions. Follow the links for details.

Support for the logging feature added to all existing site templates. Feel free to copy the new base/ subdirectory contents over your existing one; then, if you need/want some logging, add the file named logging.ini containing the desired [logging] section. The file from the new version of the template may be a good start. Don't worry, it won't cause any errors if you don't add the file, as the base part of templates performs the appropriate check.

Here is the list of the rest of the changes:

typo in the README file fixed;
typo in the file examples/Common/en/cgitexts.ini fixed;
the scriptpp library's version updated after some bugs got fixed in it;
as a result of a failed login attempt, the interactive session now closes; this makes it a bit harder to bruteforce those single-use passwords;
closed the possibility of sending passwds to a pending acct (yes, sorry, this possibility exists in the earlier versions, so please consider updating your version of Thalassa);
captcha md5 trick made slightly more sophisticated;
added the blockgroup named footerbottom to the Smoky template, where it didn't exist before; also and the blocks-related label named ^front to all the three templates.

Thalassa 0.3.61

16 Feb 2026 16:06:36 +0000

Thalassa 0.3.61 published; contains some minor fixes, including the base CSS for the Agenda template (in case you use Agenda, you might want to update the base/ subdir's content).

The template gallery

4 Jan 2026 04:13:20 +0000

I finally managed to compose a kind of gallery for the existing templates and the color schemes available for them. Enjoy.

Thalassa 0.3.60

3 Jan 2026 00:05:00 +0000

Thalassa 0.3.60 is available.

The most notable feature of this release is a new (third) site template, named Woodpecker. The RebuildWorld.net site may serve as a good example of the new template's look&feel, but please note the default color scheme of the template is a bit different.

In all the three existing templates (Smoky, Agenda and Woodpecker), the following changes are made:

RSS pubDate is now formed using the %rfcdate% macro with the unixtime as the source, instead of %li:date%, which breaks RSS correctness easily;
http-equiv meta tag named Content-Security-Policy is now emitted for all pages, with the content set to script-src 'none'; object-src: 'none'; form-action 'self'; which effectively prevents any scripts and objects, no matter where they come from, from working, and also forbids POST forms to send anything to other sites.

The following changes are made to Thalassa itself:

%[ifaab:] macro added (both to the generator and the CGI program);
the [menu ] ini section now supports the new parameter named separator (see the documentation page devoted to menus for the explanation);
an undesired newline char is removed from dates generated by the %[li:date] and %[cmt:date] macro functions for the case the appropriate date field is absent;
for the CGI, in the situation new passwords are requested for a non-existing user, the internal (server-side) error is replaced with the 'too early' error which probably looks better.

Thanks to all the great people who supported the project!

Thalassa 0.3.53

27 Jan 2025 09:34:53 +0000

Sorry for the inconvenience, but I had to fix another FSM-related bug: the generator in 0.2.52 sometimes places a paragraph start just before the end of a tag where paragraphs are not eligible (e.g. h2, ul, pre...), so Thalassa 0.3.53 has just been made available, in which the problem is (hopefully) fixed. This time no changes to configs are needed, just replace the version and recompile. It is also recommended to regenerate your site, just in case the bug manifestated somewhere you didn't notice.

I'm really sorry for having this many bugfix releases in a row, which means each time I was releasing immature code. This is only because the initial “major” release, 0.3.50, was an urgent fix itself.

Thalassa 0.3.52

22 Jan 2025 18:23:23 +0000

Thalassa 0.3.52 uploaded. Another FSM-related bug has been fixed (well, paragraphs starting with a permitted tag such as em or strong didn't render correctly). Besides that, support for the new filtering policy has been added to templates, both Smoky and Agenda; by default (which is specified within the “base” part of the templates, not intended for changes), tags a, img, span are no longer listed as permitted, and the only premitted attribute (listed for all tags) is title. However, within the default config.ini, these tags are permitted as well as some additional attributes. If you use any of the two templates and comments are premoderated at your site, you might want to add something like this to your config.ini:

[options site]

moretags = a img span
moreattrs = a=href img=src img=alt img=height img=width align style class

Don't do this if untrusted users are allowed to leave comments with no premoderation on your site.

Thalassa 0.3.50

20 Jan 2025 13:54:57 +0000

UPD (Jan 21, 2025): the version 0.3.50 found to be buggy. Please download the version 0.3.51 which is a quick-fix release.

Some brain-damaged webcoding addicts demonstrated me (by submitting comments with some related crap) the possibility to introduce JavaScript into user comments using tag attributes appeared in HTML5 such as onclick, onpageshow etc., and browsers happily ignore the fact the document they render has nothing to do with HTML5. I have to admit I didn't realize things like that are possible. Luckily, all my sites are premoderated, so no visible consequences occured, but it became obvious for me that tag attributes need to be filtered just like tags theyselves.

It took several days of work to significantly rewrite the filter (for those who're courious, it is implemented in the lib/stfilter/stfhtml.cpp file using an FSM) and add the appropriate support to Thalassa itself, as well as to the thalcgi.cgi program. Anyway, Thalassa 0.3.50 is now ready and has just been made available.

There are two user-visible changes:

New parameter named tag_attributes is added to the [format ] section both in the Thalassa main configuration and the thalcgi.ini file. A kinda-safe default is provided for its value, and the default value is a=href img=src img=alt, only allowing to use the href attribute within the a tag, and src and alt attributes for the img tag, if the tags are allowed. All this only affects headed text files where the tags flag is found in the format header field (typically the comments written by users using the web interface). You only need to worry about all this in case you really wish to allow users more things to do within their comments, like, e.g., allowing the style attribute for all tags (think carefully before you do).
For the thalcgi.cgi configuration, the %[cmtinfo:attrs] macro function added.

Nothing should (hopefully) break on your site if you move to this new version from the previous one; most users leaving comments simply don't remember about all these tag attributes. However, we strongly recommend to test it before deploying on running sites.

Thalassa 0.3.30

3 Dec 2024 20:37:09 +0000

Thalassa 0.3.30 released. This release is mainly devoted to the new comment displaying style, named thread. With this style, top-level comments are displayed on the page being commented, and for each top-level comment, a separate page is created to hold replies on that comment, if any. The Agenda template, from now on, allows to choose the style for comments, either “plain” (list), or tree (the default one), or the new thread style. The new comment style also affected the macroprocessor, where the %[cmt:replies] and %[cmt:threadpg] functions are added.

Besides that, this release fixes a problem related to the dirname(3) function. The problem didn't let Thalassa work on OpenBSD due to a slightly different implementation of the function.

And the last thing to mention: the %[rfcdate: ] macro now adds “UTC” to the text representation of the date.

This release doesn't (hopefully) introduce any incompatibilities with earlier releases; it should be safe to upgrade both the Thalassa version and the Agenda template. If you'd like to give a try to the support of different comment styles, then take a look at the appearance.ini file, find the [options cmt] sectioin and copy it to your appearance.ini, then edit as appropriate.

Thalassa 0.3.20

17 Nov 2024 23:45:04 +0000

Thalassa 0.3.20 released. This time Thalassa itself gets only minor changes:

the menu facility now supports text labels (texts displayed inside the menu, not being a menu item) and breaks (may be whatever you want, placed between certain menu items to group the items and separate the groups from each other; e.g., an extra whitespace, a rule or a bullet);
sections that define stand-alone page now recognize a path parameter which overrides the section name for local path (URI) of the page; the parameter is passed through the macroprocessor, so the actual name for the generated file may be set by, e.g., an option, and setting it to some “special” values disables the page.

Besides that, a segfault has been fixed, which happened on an attempt to generate an unknown (unconfigured) stand-alone page from command line.

More significant changes are related to site templates. First of all, a brand new template, named Agenda, is added. The new template mostly provides the same functions as the old good Smoky: pages, feed (either a news strip or a blog, exported to RSS), a guestbook and contact form. Unlike Smoky, Agenda uses a side panel for the main menu, and the panel may be placed at the left side, at the right side, or suppressed (in which case you'll probably have to care about basic navigation on your own). Four prepared color schemes come with Agenda, and generally a color scheme consists of less values to be set, so it made customizable by the site author. Besides that, some sizes and lengths may also be customized; the side panel's width may serve as a good example.

The next notable thing is that both templates now support translations to languages other than English. In the source tarball, translations to Russian are provided, both for koi8-r and utf-8 encodings.

The two templates have a lot

Thalassa 0.3.10

2 Jun 2024 23:42:02 +0000

Thalassa 0.3.10 released. This is mainly a bugfix release, including:

Step-by-step guide on setting up Apache

20 Apr 2024 21:25:31 +0000

Within the documentation section, a step-by-step guide to setup Apache for serving Thalassa-based sites is now available. It is strongly recommended to use suexec even if your server is only going to serve a single site, but along with that, the guide explain how to configure your server properly to make the default Apache site Thalassa-based and how to serve several virtual sites without suexec, although it is specially stressed that this approach is ugly.

Thalassa 0.3.00

14 Mar 2024 20:55:16 +0000

Despite less than a month passed, it's time to announce another “major” release, 0.3.00, which is now available for downloading. This time, the list of changes since the previous version is relatively long.

There are three visible changes in functioning of the CGI program, and each of those actually

Thalassa 0.2.00

24 Feb 2024 14:21:51 +0000

New “major” release, 0.2.00, is available. In this release, another token (nonce) is added to the CAPTCHA test procedure. For every successful test, the pair of the time and the nonce is stored on the server (for at least the time of test validity) disallowing to reuse the same CAPTCHA challenge for creating more than one session. Configuraton files of existing sites need to be slightly updated; hence the version number change. Also in this version:

Thalassa 0.1.20

6 Feb 2024 21:18:43 +0000

New release, 0.1.20, has just been uploaded to the download page. In this version:

a new macro named %[listinfo:] added to the static content generator; see the documentation for details;
the CGI program now stores technical information such as IP address/port, session id and little else within the comment's source file headers when the comment is created and modified;
a framework for custom CGIs, named dullcgi, created (mostly out of the existing modules used by the thalcgi.cgi program); see the documentation page devoted to dullcgi;
- the ytid.cgi CGI program, which has long been working at the Infoviolence site, is finally available, as one of the two dullcgi examples (see the thalassa/examples/ytid directory, and be sure to read the README file there);
in the Smoky template:
- guestbook comment links made permanent;
- custom error page added for error 403;
- comment source text is now passed through the ltgt filter (which replaces the three active HTML chars with the respective HTML entities) before placing it within the textarea tag; well, this achieved by adding the appropriate calls to the ltgt macro;
- added user-configurable files htaccess.ini (so that the user is able to decide if (s)he needs the .htaccess file to be generated at all, and what it must contain) and cgilocal.ini, intended for adding custom pages served by the CGI;
- in the list of allowed tags, incorrect (non-existent) quote replaced with blockquote;
- fixed some incorrect XHTML such as unclosed tags.