Merge branch 'release/1.5.10'

Prepare for release
Added deferred twig extension
2025-12-05 15:29:57 +01:00 · 2019-03-21 14:16:21 -06:00 · 2019-03-21 14:16:10 -06:00 · 2019-03-20 16:31:19 -06:00 · 2019-03-20 14:01:21 -06:00 · 2019-03-20 14:01:21 -06:00
433 changed files with 16456 additions and 3098 deletions
--- a/.dependencies
+++ b/.dependencies
@@ -11,9 +11,9 @@ git:
        url: https://github.com/getgrav/grav-plugin-markdown-notices
        path: user/plugins/markdown-notices
        branch: master
-    antimatter:
-        url: https://github.com/getgrav/grav-theme-antimatter
-        path: user/themes/antimatter
+    quark:
+        url: https://github.com/getgrav/grav-theme-quark
+        path: user/themes/quark
        branch: master
 links:
    problems:
@@ -28,7 +28,7 @@ links:
        src: grav-plugin-markdown-notices
        path: user/plugins/markdown-notices
        scm: github
-    antimatter:
-        src: grav-theme-antimatter
-        path: user/themes/antimatter
+    quark:
+        src: grav-theme-quark
+        path: user/themes/quark
        scm: github
--- a/.gitignore
+++ b/.gitignore
@@ -37,9 +37,9 @@ Thumbs.db

 # phpstorm
 .idea/*
-user/config/security.yaml

 tests/_output/*
 tests/_support/_generated/*
 tests/cache/*
 tests/error.log
+/system/templates/testing
--- a/.htaccess
+++ b/.htaccess
@@ -54,17 +54,17 @@ RewriteRule .* index.php [L]

 ## Begin - Security
 # Block all direct access for these folders
-RewriteRule ^(.git|cache|bin|logs|backup|webserver-configs|tests)/(.*) error [F]
+RewriteRule ^(\.git|cache|bin|logs|backup|webserver-configs|tests)/(.*) error [F]
 # Block access to specific file types for these system folders
-RewriteRule ^(system|vendor)/(.*)\.(txt|xml|md|html|yaml|php|pl|py|cgi|twig|sh|bat)$ error [F]
+RewriteRule ^(system|vendor)/(.*)\.(txt|xml|md|html|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ error [F]
 # Block access to specific file types for these user folders
-RewriteRule ^(user)/(.*)\.(txt|md|yaml|php|pl|py|cgi|twig|sh|bat)$ error [F]
+RewriteRule ^(user)/(.*)\.(txt|md|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ error [F]
 # Block all direct access to .md files:
 RewriteRule \.md$ error [F]
 # Block all direct access to files and folders beginning with a dot
 RewriteRule (^|/)\.(?!well-known) - [F]
 # Block access to specific files in the root folder
-RewriteRule ^(LICENSE.txt|composer.lock|composer.json|\.htaccess)$ error [F]
+RewriteRule ^(LICENSE\.txt|composer\.lock|composer\.json|\.htaccess)$ error [F]
 ## End - Security

 </IfModule>
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,9 +1,9 @@
 language: php
 php:
-  - '5.5'
  - '5.6'
-  - '7.0'
-  - hhvm
+  - '7.0.21'
+  - '7.1'
+  - '7.2'
 branches:
  only:
    - develop
@@ -38,7 +38,7 @@ env:
    - GOPATH="$HOME/go"
    - PATH="$GOPATH/bin:$PATH"
    # GH_TOKEN [API Key]
-    - secure: "jS+c+g2v33vypG4VtqiSDW2qQ4dGJZlrUKBRCztoy1yrOrYRPvc5Vzi/AS3fDmZ4yizukEwmUNNzyZQcgFvLPpmCCml46Dovp8R9OXhbNe8OnULmaSn2Zkr71oblMYu6ZP+RpYvNq0BIdSB3u2TiFriHMiTIkX9UwZNaUCOX1ig="
+    - secure: "NR9pV7YteY9OoPmjDTQG0fDfocVu+tCeiDH1F2GFhXCu71UOIvqWXpOxp0RHkG5GIXdCFHx59yu+ZO275lbaHkbF8+4lVSVrV4RcGn+pIncvxr6iZCVW05dbAxV3H8alK+xYJRGmbyfQl5wIM49WvmuGHZjcmIloS4t/omQ3N+I="
    # BB_TOKEN value => "user:pass@"
    - secure: "einUtSEkUWy2IrqLXyVjwUU+mwaaoiOXRRVdLBpA3Zye6bZx8cm5h/5AplkPWhM/NmCJoW/MwNZHHkFhlr3mDRov5iOxVmTTYfnXB+I5lxYTSgduOLLErS7mU8hfADpVDU8bHNU44fNGD3UEiG1PD4qQBX4DMlqIFmR20mjs81k="
    # GH_API_USER [for curl]
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,542 @@
+# v1.5.10
+## 03/21/2019
+
+1. [](#new)
+    * Added new `deferred` Twig extension
+
+# v1.5.9
+## 03/20/2019
+
+1. [](#new)
+    * Added new `onPageContent()` event for every call to `Page::content()`
+1. [](#improved)
+    * Fixed phpdoc generation
+    * Updated vendor libraries
+    * Force Toolbox v1.4.2
+1. [](#bugfix)
+    * EXIF fix for streams
+    * Fix for User avatar not working due to uppercase or spaces in email [#2403](https://github.com/getgrav/grav/pull/2403)
+
+# v1.5.8
+## 02/07/2019
+
+1. [](#improved)
+    * Improved `User` unserialize to not to break the object if serialized data is not what expected
+    * Removed unused parameter [#2357](https://github.com/getgrav/grav/pull/2357)
+
+# v1.5.7
+## 01/25/2019
+
+1. [](#new)
+    * Support for AWS Cloudfront forwarded scheme header [#2297](https://github.com/getgrav/grav/pull/2297)
+1. [](#improved)
+    * Set homepage with `https://` protocol [#2299](https://github.com/getgrav/grav/pull/2299)
+    * Preserve accents in fields containing Twig expr. using unicode [#2279](https://github.com/getgrav/grav/pull/2279)
+    * Updated vendor libraries
+1. [](#bugfix)
+    * Support spaces with filenames in responsive images [#2300](https://github.com/getgrav/grav/pull/2300)
+    
+# v1.5.6
+## 12/14/2018
+
+1. [](#improved)
+    * Updated InitializeProcessor.php to use lang-safe redirect [#2268](https://github.com/getgrav/grav/pull/2268)
+    * Improved user serialization to use less memory in the session
+
+# v1.5.5
+## 11/12/2018
+
+1. [](#new)
+    * Register theme prefixes as namespaces in Twig [#2210](https://github.com/getgrav/grav/pull/2210)
+1. [](#improved)
+    * Propogate error code between 400 and 600 for production sites [#2181](https://github.com/getgrav/grav/pull/2181)
+1. [](#bugfix)
+    * Remove hardcoded `302` when redirecting trailing slash [#2155](https://github.com/getgrav/grav/pull/2155)
+
+# v1.5.4
+## 11/05/2018
+
+1. [](#improved)
+    * Updated default page `index.md` with some consistency fixes [#2245](https://github.com/getgrav/grav/pull/2245)
+1. [](#bugfix)
+    * Fixed fatal error if calling `$session->invalidate()` when there's no active session
+    * Fixed typo in media.yaml for `webm` extension [#2220](https://github.com/getgrav/grav/pull/2220)
+    * Fixed markdown processing for telephone links [#2235](https://github.com/getgrav/grav/pull/2235)
+
+# v1.5.3
+## 10/08/2018
+
+1. [](#new)
+    * Added `Utils::getMimeByFilename()`, `Utils::getMimeByLocalFile()` and `Utils::checkFilename()` methods
+    * Added configurable dangerous upload extensions in `security.yaml`
+1. [](#improved)
+    * Updated vendor libraries to latest
+
+# v1.5.2
+## 10/01/2018
+
+1. [](#new)
+    * Added new `Security` class for Grav security functionality including XSS checks
+    * Added new `bin/grav security` command to scan for security issues
+    * Added new `xss()` Twig function to allow for XSS checks on strings and arrays
+    * Added `onHttpPostFilter` event to allow plugins to globally clean up XSS in the forms and tasks
+    * Added `Deprecated` tab to DebugBar to catch future incompatibilities with later Grav versions
+    * Added deprecation notices for features which will be removed in Grav 2.0
+1. [](#improved)
+    * Updated vendor libraries to latest
+1. [](#bugfix)
+    * Allow `$page->slug()` to be called before `$page->init()` without breaking the page
+    * Fix for `Page::translatedLanguages()` to use routes always [#2163](https://github.com/getgrav/grav/issues/2163)
+    * Fixed `nicetime()` twig function
+    * Allow twig tags `{% script %}`, `{% style %}` and `{% switch %}` to be placed outside of blocks
+    * Session expires in 30 mins independent from config settings [login#178](https://github.com/getgrav/grav-plugin-login/issues/178)
+
+# v1.5.1
+## 08/23/2018
+
+1. [](#new)
+    * Added static `Grav\Common\Yaml` class which should be used instead of `Symfony\Component\Yaml\Yaml`
+1. [](#improved)
+    * Updated deprecated Twig code so it works in both in Twig 1.34+ and Twig 2.4+
+    * Switched to new Grav Yaml class to support Native + Fallback YAML libraries
+1. [](#bugfix)
+    * Broken handling of user folder in Grav URI object [#2151](https://github.com/getgrav/grav/issues/2151)
+
+# v1.5.0
+## 08/17/2018
+
+1. [](#new)
+    * Set minimum requirements to [PHP 5.6.4](https://getgrav.org/blog/raising-php-requirements-2018)
+    * Updated Doctrine Collections to 1.4
+    * Updated Symfony Components to 3.4 (with compatibility mode to fall back to Symfony YAML 2.8)
+    * Added `Uri::method()` to get current HTTP method (GET/POST etc)
+    * `FormatterInterface`: Added `getSupportedFileExtensions()` and `getDefaultFileExtension()` methods
+    * Added option to disable `SimpleCache` key validation
+    * Added support for multiple repo locations for `bin/grav install` command
+    * Added twig filters for casting values: `|string`, `|int`, `|bool`, `|float`, `|array`
+    * Made `ObjectCollection::matching()` criteria expressions to behave more like in Twig
+    * Criteria: Added support for `LENGTH()`, `LOWER()`, `UPPER()`, `LTRIM()`, `RTRIM()` and `TRIM()`
+    * Added `Grav\Framework\File\Formatter` classes for encoding/decoding YAML, Markdown, JSON, INI and PHP serialized strings
+    * Added `Grav\Framework\Session` class to replace `RocketTheme\Toolbox\Session\Session`
+    * Added `Grav\Common\Media` interfaces and trait; use those in `Page` and `Media` classes
+    * Added `Grav\Common\Page` interface to allow custom page types in the future
+    * Added setting to disable sessions from the site [#2013](https://github.com/getgrav/grav/issues/2013)
+    * Added new `strict_mode` settings in `system.yaml` for compatibility
+1. [](#improved)
+    * Improved `Utils::url()` to support query strings
+    * Display better exception message if Grav fails to initialize
+    * Added `muted` and `playsinline` support to videos [#2124](https://github.com/getgrav/grav/pull/2124)
+    * Added `MediaTrait::clearMediaCache()` to allow cache to be cleared
+    * Added `MediaTrait::getMediaCache()` to allow custom caching
+    * Improved session handling, allow all session configuration options in `system.session.options`
+1. [](#bugfix)
+    * Fix broken form nonce logic [#2121](https://github.com/getgrav/grav/pull/2121)
+    * Fixed issue with uppercase extensions and fallback media URLs [#2133](https://github.com/getgrav/grav/issues/2133)
+    * Fixed theme inheritance issue with `camel-case` that includes numbers [#2134](https://github.com/getgrav/grav/issues/2134)
+    * Typo in demo typography page [#2136](https://github.com/getgrav/grav/pull/2136)
+    * Fix for incorrect plugin order in debugger panel
+    * Made `|markdown` filter HTML safe
+    * Fixed bug in `ContentBlock` serialization
+    * Fixed `Route::withQueryParam()` to accept array values
+    * Fixed typo in truncate function [#1943](https://github.com/getgrav/grav/issues/1943)
+    * Fixed blueprint field validation: Allow numeric inputs in text fields
+
+# v1.4.8
+## 07/31/2018
+
+1. [](#improved)
+    * Add Grav version to debug bar messages tab [#2106](https://github.com/getgrav/grav/pull/2106)
+    * Add Nginx config for ddev project to `webserver-configs` [#2117](https://github.com/getgrav/grav/pull/2117)
+    * Vendor library updates
+1. [](#bugfix)
+    * Don't allow `null` to be set as Page content
+
+# v1.4.7
+## 07/13/2018
+
+1. [](#improved)
+    * Use `getFilename` instead of `getBasename` [#2087](https://github.com/getgrav/grav/issues/2087)
+1. [](#bugfix)
+    * Fix for modular page preview [#2066](https://github.com/getgrav/grav/issues/2066)
+    * `Page::routeCanonical()` should be string not array [#2069](https://github.com/getgrav/grav/issues/2069)
+
+# v1.4.6
+## 06/20/2018
+
+1. [](#improved)
+    * Manually re-added the improved SSL off-loading that was lost with Grav v1.4.0 merge [#1888](https://github.com/getgrav/grav/pull/1888)
+    * Handle multibyte strings in `truncateLetters()` [#2007](https://github.com/getgrav/grav/pull/2007)
+    * Updated robots.txt to include `/user/images/` folder [#2043](https://github.com/getgrav/grav/pull/2043)
+    * Add getter methods for original and action to the Page object [#2005](https://github.com/getgrav/grav/pull/2005)
+    * Modular template extension follows the master page extension [#2044](https://github.com/getgrav/grav/pull/2044)
+    * Vendor library updates
+1. [](#bugfix)
+    * Handle `errors.display` system property better in admin plugin [admin#1452](https://github.com/getgrav/grav-plugin-admin/issues/1452)
+    * Fix classes on non-http based protocol links [#2034](https://github.com/getgrav/grav/issues/2034)
+    * Fixed crash on IIS (Windows) with open_basedir in effect [#2053](https://github.com/getgrav/grav/issues/2053)
+    * Fixed incorrect routing with setup.php based base [#1892](https://github.com/getgrav/grav/issues/1892)
+    * Fixed image resource memory deallocation [#2045](https://github.com/getgrav/grav/pull/2045)
+    * Fixed issue with Errors `display:` option not handling integers properly [admin#1452](https://github.com/getgrav/grav-plugin-admin/issues/1452)
+
+# v1.4.5
+## 05/15/2018
+
+1. [](#bugfix)
+    * Fixed an issue with some users getting **2FA** prompt after upgrade [admin#1442](https://github.com/getgrav/grav-plugin-admin/issues/1442)
+    * Do not crash when generating URLs with arrays as parameters [#2018](https://github.com/getgrav/grav/pull/2018)
+    * Utils::truncateHTML removes whitespace when generating summaries [#2004](https://github.com/getgrav/grav/pull/2004)
+
+# v1.4.4
+## 05/11/2018
+
+1. [](#new)
+    * Added support for `Uri::post()` and `Uri::getConentType()`
+    * Added a new `Medium:thumbnailExists()` function [#1966](https://github.com/getgrav/grav/issues/1966)
+    * Added `authorized` support for 2FA
+1. [](#improved)
+    * Added default configuration for images [#1979](https://github.com/getgrav/grav/pull/1979)
+    * Added dedicated PHPUnit assertions [#1990](https://github.com/getgrav/grav/pull/1990)
+1. [](#bugfix)
+    * Use `array_key_exists` instead of `in_array + array_keys` [#1991](https://github.com/getgrav/grav/pull/1991)
+    * Fixed an issue with `custom_base_url` always causing 404 errors
+    * Improve support for regex redirects with query and params [#1983](https://github.com/getgrav/grav/issues/1983)
+    * Changed collection-based date sorting to `SORT_REGULAR` for better server compatibility [#1910](https://github.com/getgrav/grav/issues/1910)
+    * Fix hardcoded string in modular blueprint [#1933](https://github.com/getgrav/grav/pull/1993)
+
+# v1.4.3
+## 04/12/2018
+
+1. [](#new)
+    * moved Twig `sortArrayByKey` logic into `Utils::` class
+1. [](#improved)
+    * Rolled back Parsedown library to stable `1.6.4` until a better solution for `1.8.0` compatibility can fe found
+    * Updated vendor libraries to latest versions
+1. [](#bugfix)
+    * Fix for bad reference to `ZipArchive` in `GPM::Installer`
+
+# v1.4.2
+## 03/21/2018
+
+1. [](#new)
+    * Added new `|nicefilesize` Twig filter for pretty file (auto converts to bytes, kB, MB, GB, etc)
+    * Added new `regex_filter()` Twig function to values in arrays
+1. [](#improved)
+    * Added bosnian to lang codes [#1917](https://github.com/getgrav/grav/issues/1917)
+    * Improved Zip extraction error codes [#1922](https://github.com/getgrav/grav/issues/1922)
+1. [](#bugfix)
+    * Fixed an issue with Markdown Video and Audio that broke after Parsedown 1.7.0 Security updates [#1924](https://github.com/getgrav/grav/issues/1924)
+    * Fix for case-sensitive page metadata [admin#1370](https://github.com/getgrav/grav-plugin-admin/issues/1370)
+    * Fixed missing composer requirements for the new `Grav\Framework\Uri` classes
+    * Added missing PSR-7 vendor library required for URI additions in Grav 1.4.0
+
+# v1.4.1
+## 03/11/2018
+
+1. [](#bugfix)
+    * Fixed session timing out because of session cookie was not being sent
+
+# v1.4.0
+## 03/09/2018
+
+1. [](#new)
+    * Added `Grav\Framework\Uri` classes extending PSR-7 `HTTP message UriInterface` implementation
+    * Added `Grav\Framework\Route` classes to allow route/link manipulation
+    * Added `$grav['uri]->getCurrentUri()` method to get `Grav\Framework\Uri\Uri` instance for the current URL
+    * Added `$grav['uri]->getCurrentRoute()` method to get `Grav\Framework\Route\Route` instance for the current URL
+    * Added ability to have `php` version dependencies in GPM assets
+    * Added new `{% switch %}` twig tag for more elegant if statements
+    * Added new `{% markdown %}` twig tag
+    * Added **Route Overrides** to the default page blueprint
+    * Added new `Collection::toExtendedArray()` method that's particularly useful for Json output of data
+    * Added new `|yaml_encode` and `|yaml_decode` Twig filter to convert to and from YAML
+    * Added new `read_file()` Twig function to allow you to load and display a file in Twig (Supports streams and regular paths)
+    * Added a new `Medium::exists()` method to check for file existence
+    * Moved Twig `urlFunc()` to `Utils::url()` as its so darn handy
+    * Transferred overall copyright from RocketTheme, LLC, to Trilby Media LLC
+    * Added `theme_var`, `header_var` and `body_class` Twig functions for themes
+    * Added `Grav\Framework\Cache` classes providing PSR-16 `Simple Cache` implementation
+    * Added `Grav\Framework\ContentBlock` classes for nested HTML blocks with CSS/JS assets
+    * Added `Grav\Framework\Object` classes for creating collections of objects
+    * Added `|nicenumber` Twig filter
+    * Added `{% try %} ... {% catch %} Error: {{ e.message }} {% endcatch %}` tag to allow basic exception handling inside Twig
+    * Added `{% script %}` and `{% style %}` tags for Twig templates
+    * Deprecated GravTrait
+1. [](#improved)
+    * Improved `Session` initialization
+    * Added ability to set a `theme_var()` option in page frontmatter
+    * Force clearing PHP `clearstatcache` and `opcache-reset` on `Cache::clear()`
+    * Better `Page.collection()` filtering support including ability to have non-published pages in collections
+    * Stopped Chrome from auto-completing admin user profile form [#1847](https://github.com/getgrav/grav/issues/1847)
+    * Support for empty `switch` field like a `checkbox`
+    * Made `modular` blueprint more flexible
+    * Code optimizations to `Utils` class [#1830](https://github.com/getgrav/grav/pull/1830)
+    * Objects: Add protected function `getElement()` to get serialized value for a single property
+    * `ObjectPropertyTrait`: Added protected functions `isPropertyLoaded()`, `offsetLoad()`, `offsetPrepare()` and `offsetSerialize()`
+    * `Grav\Framework\Cache`: Allow unlimited TTL
+    * Optimizations & refactoring to the test suite [#1779](https://github.com/getgrav/grav/pull/1779)
+    * Slight modification of Whoops error colors
+    * Added new configuration option `system.session.initialize` to delay session initialization if needed by a plugin
+    * Updated vendor libraries to latest versions
+    * Removed constructor from `ObjectInterface`
+    * Make it possible to include debug bar also into non-HTML responses
+    * Updated built-in JQuery to latest 3.3.1
+1. [](#bugfix)
+    * Fixed issue with image alt tag always getting empted out unless set in markdown
+    * Fixed issue with remote PHP version determination for Grav updates [#1883](https://github.com/getgrav/grav/issues/1883)
+    * Fixed issue with _illegal scheme offset_ in `Uri::convertUrl()` [page-inject#8](https://github.com/getgrav/grav-plugin-page-inject/issues/8)
+    * Properly validate YAML blueprint fields so admin can save as proper YAML now  [addresses many issues]
+    * Fixed OpenGraph metatags so only Twitter uses `name=`, and all others use `property=` [#1849](https://github.com/getgrav/grav/issues/1849)
+    * Fixed an issue with `evaluate()` and `evaluate_twig()` Twig functions that throws invalid template error
+    * Fixed issue with `|sort_by_key` twig filter if the input was null or not an array
+    * Date ordering should always be numeric [#1810](https://github.com/getgrav/grav/issues/1810)
+    * Fix for base paths containing special characters [#1799](https://github.com/getgrav/grav/issues/1799)
+    * Fix for session cookies in paths containing special characters
+    * Fix for `vundefined` error for version numbers in GPM [form#222](https://github.com/getgrav/grav-plugin-form/issues/222)
+    * Fixed `BadMethodCallException` thrown in GPM updates [#1784](https://github.com/getgrav/grav/issues/1784)
+    * NOTE: Parsedown security release now escapes `&` to `&amp;` in Markdown links
+
+# v1.3.10
+## 12/06/2017
+
+1. [](#bugfix)
+    * Reverted GPM Local pull request as it broken admin [#1742](https://github.com/getgrav/grav/issues/1742)
+
+# v1.3.9
+## 12/05/2017
+
+1. [](#new)
+    * Added new core Twig templates for `partials/metadata.html.twig` and `partials/messages.html.twig`
+    * Added ability to work with GPM locally [#1742](https://github.com/getgrav/grav/issues/1742)
+    * Added new HTML5 audio controls [#1756](https://github.com/getgrav/grav/issues/1756)
+    * Added `Medium::copy()` method to create a copy of a medium object
+    * Added new `force_lowercase_urls` functionality on routes and slugs
+    * Added new `item-list` filter type to remove empty items
+    * Added new `setFlashCookieObject()` and `getFlashCookieObject()` methods to `Session` object
+    * Added new `intl_enabled` option to disable PHP intl module collation when not needed
+1. [](#bugfix)
+    * Fixed an issue with checkbox field validation [form#216](https://github.com/getgrav/grav-plugin-form/issues/216)
+    * Fixed issue with multibyte Markdown link URLs [#1749](https://github.com/getgrav/grav/issues/1749)
+    * Fixed issue with multibyte folder names [#1751](https://github.com/getgrav/grav/issues/1751)
+    * Fixed several issues related to `system.custom_base_url` that were broken [#1736](https://github.com/getgrav/grav/issues/1736)
+    * Dynamically added pages via `Pages::addPage()` were not firing `onPageProcessed()` event causing forms not to be processed
+    * Fixed `Page::active()` and `Page::activeChild()` to work with UTF-8 characters in the URL [#1727](https://github.com/getgrav/grav/issues/1727)
+    * Fixed typo in `modular.yaml` causing media to be ignored [#1725](https://github.com/getgrav/grav/issues/1725)
+    * Reverted `case_insensitive_urls` option as it was causing issues with taxonomy [#1733](https://github.com/getgrav/grav/pull/1733)
+    * Removed an extra `/` in `CompileFile.php` [#1693](https://github.com/getgrav/grav/pull/1693)
+    * Uri::Encode user and password to prevent issues in browsers
+    * Fixed "Invalid AJAX response" When using Built-in PHP Webserver in Windows [#1258](https://github.com/getgrav/grav-plugin-admin/issues/1258)
+    * Remove support for `config.user`, it was broken and bad practise
+    * Make sure that `clean cache` uses valid path [#1745](https://github.com/getgrav/grav/pull/1745)
+    * Fixed token creation issue with `Uri` params like `/id:3`
+    * Fixed CSS Pipeline failing with Google remote fonts if the file was minified [#1261](https://github.com/getgrav/grav-plugin-admin/issues/1261)
+    * Forced `field.multiple: true` to allow use of min/max options in `checkboxes.validate`
+
+# v1.3.8
+## 10/26/2017
+
+1. [](#new)
+    * Added Page `media_order` capability to manually order page media via a page header
+1. [](#bugfix)
+    * Fixed GPM update issue with filtered slugs [#1711](https://github.com/getgrav/grav/issues/1711)
+    * Fixed issue with missing image file not throwing 404 properly [#1713](https://github.com/getgrav/grav/issues/1713)
+
+# v1.3.7
+## 10/18/2017
+
+1. [](#bugfix)
+    * Regression Uri: `base_url_absolute` always has the port number [#1690](https://github.com/getgrav/grav-plugin-admin/issues/1690)
+    * Uri: Prefer using REQUEST_SCHEME instead of HTTPS [#1698](https://github.com/getgrav/grav-plugin-admin/issues/1698)
+    * Fixed routing paths with urlencoded spaces and non-latin letters [#1688](https://github.com/getgrav/grav-plugin-admin/issues/1688)
+
+# v1.3.6
+## 10/12/2017
+
+1. [](#bugfix)
+    * Regression: Ajax error in Nginx [admin#1244](https://github.com/getgrav/grav-plugin-admin/issues/1244)
+    * Remove the `_url=$uri` portion of the the Nginx `try_files` command [admin#1244](https://github.com/getgrav/grav-plugin-admin/issues/1244)
+
+# v1.3.5
+## 10/11/2017
+
+1. [](#improved)
+    * Refactored `URI` class with numerous bug fixes, and optimizations
+    * Override `system.media.upload_limit` with PHP's `post_max_size` or `upload_max_filesize`
+    * Updated `bin/grav clean` command to remove unnecessary vendor files (save some bytes)
+    * Added a `http_status_code` Twig function to allow setting HTTP status codes from Twig directly.
+    * Deter XSS attacks via URI path/uri methods (credit:newbthenewbd)
+    * Added support for `$uri->toArray()` and `(string)$uri`
+    * Added support for `type` on `Asstes::addInlineJs()` [#1683](https://github.com/getgrav/grav/pull/1683)
+1. [](#bugfix)
+    * Fixed method signature error with `GPM\InstallCommand::processPackage()` [#1682](https://github.com/getgrav/grav/pull/1682)
+
+# v1.3.4
+## 09/29/2017
+
+1. [](#new)
+    * Added filter support for Page collections (routable/visible/type/access/etc.)
+1. [](#improved)
+    * Implemented `Composer\CaBundle` for SSL Certs [#1241](https://github.com/getgrav/grav/issues/1241)
+    * Refactored the Assets sorting logic
+    * Improved language overrides to merge only 'extra' translations [#1514](https://github.com/getgrav/grav/issues/1514)
+    * Improved support for Assets with query strings [#1451](https://github.com/getgrav/grav/issues/1451)
+    * Twig extension cleanup
+1. [](#bugfix)
+    * Fixed an issue where fallback was not supporting dynamic page generation
+    * Fixed issue with Image query string not being fully URL encoded [#1622](https://github.com/getgrav/grav/issues/1622)
+    * Fixed `Page::summary()` when using delimiter and multibyte UTF8 Characters [#1644](https://github.com/getgrav/grav/issues/1644)
+    * Fixed missing `.json` thumbnail throwing error when adding media [grav-plugin-admin#1156](https://github.com/getgrav/grav-plugin-admin/issues/1156)
+    * Fixed insecure session cookie initialization [#1656](https://github.com/getgrav/grav/pull/1656)
+
+# v1.3.3
+## 09/07/2017
+
+1. [](#new)
+    * Added support for 2-Factor Authentication in admin profile
+    * Added `gaussianBlur` media method [#1623](https://github.com/getgrav/grav/pull/1623)
+    * Added new `|chunk_split()`, `|basename`, and `|dirname` Twig filter
+    * Added new `tl` Twig filter/function to support specific translations [#1618](https://github.com/getgrav/grav/issues/1618)
+1. [](#improved)
+    * User `authorization` now requires a check for `authenticated` - REQUIRED: `Login v2.4.0`
+    * Added options to `Page::summary()` to support size without HTML tags [#1554](https://github.com/getgrav/grav/issues/1554)
+    * Forced `natsort` on plugins to ensure consistent plugin load ordering across platforms [#1614](https://github.com/getgrav/grav/issues/1614)
+    * Use new `multilevel` field to handle Asset Collections [#1201](https://github.com/getgrav/grav-plugin-admin/issues/1201)
+    * Added support for redis `password` option [#1620](https://github.com/getgrav/grav/issues/1620)
+    * Use 302 rather than 301 redirects by default [#1619](https://github.com/getgrav/grav/issues/1619)
+    * GPM Installer will try to load alphanumeric version of the class if no standard class found [#1630](https://github.com/getgrav/grav/issues/1630)
+    * Add current page position to `User` class [#1632](https://github.com/getgrav/grav/issues/1632)
+    * Added option to enable case insensitive URLs [#1638](https://github.com/getgrav/grav/issues/1638)
+    * Updated vendor libraries
+    * Updated `travis.yml` to add support for PHP 7.1 as well as 7.0.21 for test suite
+1. [](#bugfix)
+    * Fixed UTF8 multibyte UTF8 character support in `Page::summary()` [#1554](https://github.com/getgrav/grav/issues/1554)
+
+# v1.3.2
+## 08/16/2017
+
+1. [](#new)
+    * Added a new `cache_control` system and page level property [#1591](https://github.com/getgrav/grav/issues/1591)
+    * Added a new `clear_images_by_default` system property to stop cache clear events from removing processed images [#1481](https://github.com/getgrav/grav/pull/1481)
+    * Added new `onTwigLoader()` event to enable utilization of loader methods
+    * Added new `Twig::addPath()` and `Twig::prependPath()` methods to wrap loader methods and support namespacing [#1604](https://github.com/getgrav/grav/issues/1604)
+    * Added new `array_key_exists()` Twig function wrapper
+    * Added a new `Collection::intersect()` method [#1605](https://github.com/getgrav/grav/issues/1605)
+1. [](#bugfix)
+    * Allow `session.timeout` field to be set to `0` via blueprints [#1598](https://github.com/getgrav/grav/issues/1598)
+    * Fixed `Data::exists()` and `Data::raw()` functions breaking if `Data::file()` hasn't been called with non-null value
+    * Fixed parent theme auto-loading in child themes of Gantry 5
+
+# v1.3.1
+## 07/19/2017
+
+1. [](#bugfix)
+    * Fix ordering for Linux + International environments [#1574](https://github.com/getgrav/grav/issues/1574)
+    * Check if medium thumbnail exists before resetting
+    * Update Travis' auth token
+
+# v1.3.0
+## 07/16/2017
+
+1. [](#bugfix)
+    * Fixed an undefined variable `$difference` [#1563](https://github.com/getgrav/grav/pull/1563)
+    * Fix broken range slider [grav-plugin-admin#1153](https://github.com/getgrav/grav-plugin-admin/issues/1153)
+    * Fix natural sort when > 100 pages [#1564](https://github.com/getgrav/grav/pull/1564)
+
+# v1.3.0-rc.5
+## 07/05/2017
+
+1. [](#new)
+    * Setting `system.session.timeout` to 0 clears the session when the browser session ends [#1538](https://github.com/getgrav/grav/pull/1538)
+    * Created a `CODE_OF_CONDUCT.md` so everyone knows how to behave :)
+1. [](#improved)
+    * Renamed new `media()` Twig function to `media_directory()` to avoid conflict with Page's `media` object
+1. [](#bugfix)
+    * Fixed global media files disappearing after a reload [#1545](https://github.com/getgrav/grav/issues/1545)
+    * Fix for broken regex redirects/routes via `site.yaml`
+    * Sanitize the error message in the error handler page
+
+# v1.3.0-rc.4
+## 06/22/2017
+
+1. [](#new)
+    * Added `lower` and `upper` Twig filters
+    * Added `pathinfo()` Twig function
+    * Added 165 new thumbnail images for use in `media.yaml`
+1. [](#improved)
+    * Improved error message when running `bin/grav install` instead of `bin/gpm install`, and also when running on a non-skeleton site [#1027](https://github.com/getgrav/grav/issues/1027)
+    * Updated vendor libraries
+1. [](#bugfix)
+    * Don't rebuild metadata every time, only when file does not exist
+    * Restore GravTrait in ConsoleTrait [grav-plugin-login#119](https://github.com/getgrav/grav-plugin-login/issues/119)
+    * Fix Windows routing with built-in server [#1502](https://github.com/getgrav/grav/issues/1502)
+    * Fix [#1504](https://github.com/getgrav/grav/issues/1504) `process_twig` and `frontmatter.yaml`
+    * Nicetime fix: 0 seconds from now -> just now [#1509](https://github.com/getgrav/grav/issues/1509)
+
+# v1.3.0-rc.3
+## 05/22/2017
+
+1. [](#new)
+    * Added new unified `Utils::getPagePathFromToken()` method which is used by various plugins (Admin, Forms, Downloads, etc.)
+1. [](#improved)
+    * Optionally remove unpublished pages from the translated languages, move into untranslated list [#1482](https://github.com/getgrav/grav/pull/1482)
+    * Improved reliability of `hash` file-check method
+1. [](#bugfix)
+    * Updated to latest Toolbox library to fix issue with some blueprints rendering in admin plugin [#1117](https://github.com/getgrav/grav-plugin-admin/issues/1117)
+    * Fix output handling in RenderProcessor [#1483](https://github.com/getgrav/grav/pull/1483)
+
+# v1.3.0-rc.2
+## 05/17/2017
+
+1. [](#new)
+    * Added new `media` and `vardump` Twig functions
+1. [](#improved)
+    * Put in various checks to ensure Exif is available before trying to use it
+    * Add timestamp to configuration settings [#1445](https://github.com/getgrav/grav/pull/1445)
+1. [](#bugfix)
+    * Fix an issue saving YAML textarea fields in expert mode [#1480](https://github.com/getgrav/grav/pull/1480)
+    * Moved `onOutputRendered()` back into Grav core
+
+# v1.3.0-rc.1
+## 05/16/2017
+
+1. [](#new)
+    * Added support for a single array field in the forms
+    * Added EXIF support with automatic generation of Page Media metafiles
+    * Added Twig function to get EXIF data on any image file
+    * Added `Pages::baseUrl()`, `Pages::homeUrl()` and `Pages::url()` functions
+    * Added `base32_encode`, `base32_decode`, `base64_encode`, `base64_decode` Twig filters
+    * Added `Debugger::getCaller()` to figure out where the method was called from
+    * Added support for custom output providers like Slim Framework
+    * Added `Grav\Framework\Collection` classes for creating collections
+1. [](#improved)
+    * Add more controls over HTML5 video attributes (autoplay, poster, loop controls) [#1442](https://github.com/getgrav/grav/pull/1442)
+    * Removed logging statement for invalid slug [#1459](https://github.com/getgrav/grav/issues/1459)
+    * Groups selection pre-filled in user form
+    * Improve error handling in `Folder::move()`
+    * Added extra parameter for `Twig::processSite()` to include custom context
+    * Updated RocketTheme Toolbox vendor library
+1. [](#bugfix)
+    * Fix to force route/redirect matching from the start of the route by default [#1446](https://github.com/getgrav/grav/issues/1446)
+    * Edit check for valid slug [#1459](https://github.com/getgrav/grav/issues/1459)
+
+# v1.2.4
+## 04/24/2017
+
+1. [](#improved)
+    * Added optional ignores for `Installer::sophisticatedInstall()` [#1447](https://github.com/getgrav/grav/issues/1447)
+1. [](#bugfix)
+    * Allow multiple calls to `Themes::initTheme()` without throwing errors
+    * Fixed querystrings in root pages with multi-lang enabled [#1436](https://github.com/getgrav/grav/issues/1436)
+    * Allow support for `Pages::getList()` with `show_modular` option [#1080](https://github.com/getgrav/grav-plugin-admin/issues/1080)
+
+# v1.2.3
+## 04/19/2017
+
+1. [](#improved)
+    * Added new `pwd_regex` and `username_regex` system configuration options to allow format modifications
+    * Allow `user/accounts.yaml` overrides and implemented more robust theme initialization
+    * improved `getList()` method to do more powerful things
+    * Fix Typo in GPM [#1427](https://github.com/getgrav/grav/issues/1427)
+
 # v1.2.2
 ## 04/11/2017

--- a/CODE_OF_CONDUCT.md
+++ b/CODE_OF_CONDUCT.md
@@ -0,0 +1,46 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at contact@getgrav.org. The project team will review and investigate all complaints, and will respond in a way that it deems appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at [http://contributor-covenant.org/version/1/4][version]
+
+[homepage]: http://contributor-covenant.org
+[version]: http://contributor-covenant.org/version/1/4/
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -12,7 +12,7 @@ patches and features.

 ## Grav, Plugins, Themes and Skeletons

-Grav is a large open source project—it's made up of over 100 repositories. When you initially consider contributing to Grav, you might be unsure about which of those 200 repositories implements the functionality you want to change or report a bug for.
+Grav is a large open source project — it's made up of over 100 repositories. When you initially consider contributing to Grav, you might be unsure about which of those 200 repositories implements the functionality you want to change or report a bug for.

 [https://github.com/getgrav/grav](https://github.com/getgrav/grav) is the main Grav repository. The core of Grav is provided by this repo.

@@ -60,20 +60,20 @@ Guidelines for bug reports:
 A good bug report shouldn't leave others needing to chase you up for more
 information. Please try to be as detailed as possible in your report.

-What is your environment? Is it localhost, OSX, Linux, on a remote server? Same happening locally and or the server, or just locally or just on Linux?
+- What is your environment? Is it localhost, OSX, Linux, on a remote server? Same happening locally and or the server, or just locally or just on Linux?

-What steps will reproduce the issue? What browser(s) and OS experience the problem?
+- What steps will reproduce the issue? What browser(s) and OS experience the problem?

-What would you expect to be the outcome?
+- What would you expect to be the outcome?

-Did the problem start happening recently (e.g. after updating to a new version of Grav) or was this always a problem?
+- Did the problem start happening recently (e.g. after updating to a new version of Grav) or was this always a problem?

-If the problem started happening recently, can you reproduce the problem in an older version of Grav? What's the most recent version in which the problem doesn't happen? You can download older versions of Grav from the releases page on Github.
+- If the problem started happening recently, can you reproduce the problem in an older version of Grav? What's the most recent version in which the problem doesn't happen? You can download older versions of Grav from the releases page on Github.

-Can you reliably reproduce the issue? If not, provide details about how often the problem happens and under which conditions it normally happens.
+- Can you reliably reproduce the issue? If not, provide details about how often the problem happens and under which conditions it normally happens.


-All these details will help people to fix any potential bugs.
+All these details will help contributors to fix any potential bugs.

 Important: [include Code Samples in triple backticks](https://help.github.com/articles/github-flavored-markdown/#fenced-code-blocks) so that Github will provide a proper indentation. [Add the language name after the backticks](https://help.github.com/articles/github-flavored-markdown/#syntax-highlighting) to add syntax highlighting to the code snippets.

@@ -120,5 +120,18 @@ accurate comments, etc.) and any other requirements.

 See [Using Pull Request](https://help.github.com/articles/using-pull-requests/) and [Fork a Repo](https://help.github.com/articles/fork-a-repo/) if you're not familiar with Pull Requests.

+Any pull request should be based on the `develop` branch. We will not consider pull requests made to master.
+
 **IMPORTANT**: By submitting a patch, you agree to allow the project owner to
 license your work under the same license as that used by the project.
+
+<a name="translations"></a>
+### Translations
+Translations for Grav core and the Admin plugin are managed through Crowdin:
+
+- Admin: https://crowdin.com/project/grav-admin
+- Core: https://crowdin.com/project/grav-core
+
+Please do not post translations PRs for core or admin translations on GitHub, with the exception of fixes for the english language.
+
+All other plugins and themes translations are handled directly in their GitHub repository, and the string are usually found in the `languages.yaml` file at the root of each project.
--- a/LICENSE.txt
+++ b/LICENSE.txt
@@ -1,6 +1,6 @@
 The MIT License (MIT)

-Copyright (c) 2014 Grav
+Copyright (c) 2018 Grav

 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
--- a/README.md
+++ b/README.md
@@ -1,24 +1,24 @@
 # ![](https://avatars1.githubusercontent.com/u/8237355?v=2&s=50) Grav

-[![SensioLabsInsight](https://insight.sensiolabs.com/projects/cfd20465-d0f8-4a0a-8444-467f5b5f16ad/mini.png)](https://insight.sensiolabs.com/projects/cfd20465-d0f8-4a0a-8444-467f5b5f16ad) [![Slack](https://grav-chat.now.sh/badge.svg)](https://chat.getgrav.org) [![Build Status](https://travis-ci.org/getgrav/grav.svg?branch=develop)](https://travis-ci.org/getgrav/grav) [![OpenCollective](https://opencollective.com/grav/backers/badge.svg)](#backers) [![OpenCollective](https://opencollective.com/grav/sponsors/badge.svg)](#sponsors)
+[![SensioLabsInsight](https://insight.sensiolabs.com/projects/cfd20465-d0f8-4a0a-8444-467f5b5f16ad/mini.png)](https://insight.sensiolabs.com/projects/cfd20465-d0f8-4a0a-8444-467f5b5f16ad) [![Discord](https://img.shields.io/discord/501836936584101899.svg?logo=discord&colorB=728ADA&label=Discord%20Chat)](https://chat.getgrav.org) [![Build Status](https://travis-ci.org/getgrav/grav.svg?branch=develop)](https://travis-ci.org/getgrav/grav) [![OpenCollective](https://opencollective.com/grav/backers/badge.svg)](#backers) [![OpenCollective](https://opencollective.com/grav/sponsors/badge.svg)](#sponsors)

 Grav is a **Fast**, **Simple**, and **Flexible**, file-based Web-platform.  There is **Zero** installation required.  Just extract the ZIP archive, and you are already up and running.  It follows similar principles to other flat-file CMS platforms, but has a different design philosophy than most. Grav comes with a powerful **Package Management System** to allow for simple installation and upgrading of plugins and themes, as well as simple updating of Grav itself.

 The underlying architecture of Grav is designed to use well-established and _best-in-class_ technologies to ensure that Grav is simple to use and easy to extend. Some of these key technologies include:

-* [Twig Templating](http://twig.sensiolabs.org/): for powerful control of the user interface
-* [Markdown](http://en.wikipedia.org/wiki/Markdown): for easy content creation
-* [YAML](http://yaml.org): for simple configuration
-* [Parsedown](http://parsedown.org/): for fast Markdown and Markdown Extra support
-* [Doctrine Cache](http://doctrine-orm.readthedocs.io/projects/doctrine-orm/en/latest/reference/caching.html): layer for performance
-* [Pimple Dependency Injection Container](http://pimple.sensiolabs.org/): for extensibility and maintainability
-* [Symfony Event Dispatcher](http://symfony.com/doc/current/components/event_dispatcher/introduction.html): for plugin event handling
-* [Symfony Console](http://symfony.com/doc/current/components/console/introduction.html): for CLI interface
+* [Twig Templating](https://twig.sensiolabs.org/): for powerful control of the user interface
+* [Markdown](https://en.wikipedia.org/wiki/Markdown): for easy content creation
+* [YAML](https://yaml.org): for simple configuration
+* [Parsedown](https://parsedown.org/): for fast Markdown and Markdown Extra support
+* [Doctrine Cache](https://www.doctrine-project.org/projects/doctrine-orm/en/latest/reference/caching.html): layer for performance
+* [Pimple Dependency Injection Container](https://pimple.sensiolabs.org/): for extensibility and maintainability
+* [Symfony Event Dispatcher](https://symfony.com/doc/current/components/event_dispatcher/introduction.html): for plugin event handling
+* [Symfony Console](https://symfony.com/doc/current/components/console/introduction.html): for CLI interface
 * [Gregwar Image Library](https://github.com/Gregwar/Image): for dynamic image manipulation

 # Requirements

- PHP 5.5.9 or higher. Check the [required modules list](https://learn.getgrav.org/basics/requirements#php-requirements)
+- PHP 5.6.4 or higher. Check the [required modules list](https://learn.getgrav.org/basics/requirements#php-requirements)
 - Check the [Apache](https://learn.getgrav.org/basics/requirements#apache-requirements) or [IIS](https://learn.getgrav.org/basics/requirements#iis-requirements) requirements

 # QuickStart
@@ -83,17 +83,10 @@ $ bin/gpm update


 # Contributing
-We appreciate any contribution to Grav, whether it is related to bugs, grammar, or simply a suggestion or improvement.
-However, we ask that any contributions follow our simple guidelines in order to be properly received.
+We appreciate any contribution to Grav, whether it is related to bugs, grammar, or simply a suggestion or improvement! Please refer to the [Contributing guide](CONTRIBUTING.md) for more guidance on this topic.

-All our projects follow the [GitFlow branching model][gitflow-model], from development to release. If you are not familiar with it, there are several guides and tutorials to make you understand what it is about.
-
-You will probably want to get started by installing [this very good collection of git extensions][gitflow-extensions].
-
-What you mainly want to know is that:
-
- All the main activity happens in the `develop` branch. Any pull request should be addressed only to that branch. We will not consider pull requests made to the `master`.
- It's very well appreciated, and highly suggested, to start a new feature whenever you want to make changes or add functionalities. It will make it much easier for us to just checkout your feature branch and test it, before merging it into `develop`
+## Security issues
+If you discover a possible security issue related to Grav or one of its plugins, please email the core team at contact@getgrav.org and we'll address it as soon as possible.

 # Getting Started

@@ -101,82 +94,25 @@ What you mainly want to know is that:
 * [Install](https://learn.getgrav.org/basics/installation) Grav in few seconds
 * Understand the [Configuration](https://learn.getgrav.org/basics/grav-configuration)
 * Take a peek at our available free [Skeletons](https://getgrav.org/downloads/skeletons)
-* If you have questions, jump on our [Slack Room](https://getgrav.org/slack)!
+* If you have questions, jump on our [Discord Chat Server](https://chat.getgrav.org)!
 * Have fun!

 # Exploring More

 * Have a look at our [Basic Tutorial](https://learn.getgrav.org/basics/basic-tutorial)
 * Dive into more [advanced](https://learn.getgrav.org/advanced) functions
+* Learn about the [Grav CLI](https://learn.getgrav.org/cli-console/grav-cli)
+* Review examples in the [Grav Cookbook](https://learn.getgrav.org/cookbook)

 # Backers
-Support us with a monthly donation and help us continue our activities. [[Become a backer](https://opencollective.com/grav#backer)]
-
-<a href="https://opencollective.com/grav/backer/0/website" target="_blank"><img src="https://opencollective.com/grav/backer/0/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/1/website" target="_blank"><img src="https://opencollective.com/grav/backer/1/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/2/website" target="_blank"><img src="https://opencollective.com/grav/backer/2/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/3/website" target="_blank"><img src="https://opencollective.com/grav/backer/3/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/4/website" target="_blank"><img src="https://opencollective.com/grav/backer/4/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/5/website" target="_blank"><img src="https://opencollective.com/grav/backer/5/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/6/website" target="_blank"><img src="https://opencollective.com/grav/backer/6/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/7/website" target="_blank"><img src="https://opencollective.com/grav/backer/7/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/8/website" target="_blank"><img src="https://opencollective.com/grav/backer/8/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/9/website" target="_blank"><img src="https://opencollective.com/grav/backer/9/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/10/website" target="_blank"><img src="https://opencollective.com/grav/backer/10/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/11/website" target="_blank"><img src="https://opencollective.com/grav/backer/11/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/12/website" target="_blank"><img src="https://opencollective.com/grav/backer/12/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/13/website" target="_blank"><img src="https://opencollective.com/grav/backer/13/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/14/website" target="_blank"><img src="https://opencollective.com/grav/backer/14/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/15/website" target="_blank"><img src="https://opencollective.com/grav/backer/15/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/16/website" target="_blank"><img src="https://opencollective.com/grav/backer/16/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/17/website" target="_blank"><img src="https://opencollective.com/grav/backer/17/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/18/website" target="_blank"><img src="https://opencollective.com/grav/backer/18/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/19/website" target="_blank"><img src="https://opencollective.com/grav/backer/19/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/20/website" target="_blank"><img src="https://opencollective.com/grav/backer/20/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/21/website" target="_blank"><img src="https://opencollective.com/grav/backer/21/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/22/website" target="_blank"><img src="https://opencollective.com/grav/backer/22/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/23/website" target="_blank"><img src="https://opencollective.com/grav/backer/23/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/24/website" target="_blank"><img src="https://opencollective.com/grav/backer/24/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/25/website" target="_blank"><img src="https://opencollective.com/grav/backer/25/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/26/website" target="_blank"><img src="https://opencollective.com/grav/backer/26/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/27/website" target="_blank"><img src="https://opencollective.com/grav/backer/27/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/28/website" target="_blank"><img src="https://opencollective.com/grav/backer/28/avatar.svg"></a>
-<a href="https://opencollective.com/grav/backer/29/website" target="_blank"><img src="https://opencollective.com/grav/backer/29/avatar.svg"></a>
+Support Grav with a monthly donation to help us continue development. [[Become a backer](https://opencollective.com/grav#backer)]

+<img src="https://opencollective.com/grav/tiers/backers.svg?avatarHeight=36&width=600" />

 # Sponsors
 Become a sponsor and get your logo on our README on Github with a link to your site. [[Become a sponsor](https://opencollective.com/grav#sponsor)]

-<a href="https://opencollective.com/grav/sponsor/0/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/0/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/1/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/1/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/2/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/2/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/3/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/3/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/4/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/4/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/5/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/5/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/6/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/6/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/7/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/7/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/8/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/8/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/9/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/9/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/10/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/10/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/11/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/11/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/12/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/12/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/13/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/13/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/14/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/14/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/15/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/15/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/16/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/16/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/17/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/17/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/18/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/18/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/19/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/19/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/20/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/20/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/21/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/21/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/22/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/22/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/23/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/23/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/24/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/24/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/25/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/25/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/26/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/26/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/27/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/27/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/28/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/28/avatar.svg"></a>
-<a href="https://opencollective.com/grav/sponsor/29/website" target="_blank"><img src="https://opencollective.com/grav/sponsor/29/avatar.svg"></a>
+<img src="https://opencollective.com/grav/tiers/sponsors.svg?avatarHeight=36&width=600" />

 # License

@@ -190,5 +126,5 @@ See [LICENSE](LICENSE.txt)

 First install the dev dependencies by running `composer update` from the Grav root.
 Then `composer test` will run the Unit Tests, which should be always executed successfully on any site.
-
+Windows users should use the `composer test-windows` command.
 You can also run a single unit test file, e.g. `composer test tests/unit/Grav/Common/AssetsTest.php`
--- a/bin/composer.phar
+++ b/bin/composer.phar
--- a/bin/grav
+++ b/bin/grav
@@ -41,5 +41,6 @@ $app->addCommands(array(
    new \Grav\Console\Cli\ClearCacheCommand(),
    new \Grav\Console\Cli\BackupCommand(),
    new \Grav\Console\Cli\NewProjectCommand(),
+    new \Grav\Console\Cli\SecurityCommand(),
 ));
 $app->run();
--- a/composer.json
+++ b/composer.json
@@ -3,39 +3,59 @@
    "type": "project",
    "description": "Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS",
    "keywords": ["cms","flat-file cms","flat cms","flatfile cms","php"],
-    "homepage": "http://getgrav.org",
+    "homepage": "https://getgrav.org",
    "license": "MIT",
    "require": {
-        "php": ">=5.5.9",
+        "php": ">=5.6.4",
        "twig/twig": "~1.24",
-        "erusev/parsedown": "~1.6",
+        "erusev/parsedown": "1.6.4",
        "erusev/parsedown-extra": "~0.7",
-        "symfony/yaml": "~2.8",
-        "symfony/console": "~2.8",
-        "symfony/event-dispatcher": "~2.8",
-        "symfony/var-dumper": "~2.8",
+        "symfony/yaml": "~3.4",
+        "symfony/console": "~3.4",
+        "symfony/event-dispatcher": "~3.4",
+        "symfony/var-dumper": "~3.4",
        "symfony/polyfill-iconv": "~1.0",
-        "doctrine/cache": "~1.5",
+        "doctrine/cache": "^1.6",
+        "doctrine/collections": "^1.4",
+        "psr/simple-cache": "^1.0",
+        "psr/http-message": "^1.0",
+        "guzzlehttp/psr7": "^1.4",
        "filp/whoops": "~2.0",
        "matthiasmullie/minify": "^1.3",
        "monolog/monolog": "~1.0",
-        "gregwar/image": "~2.0",
+        "gregwar/image": "2.*",
        "donatj/phpuseragentparser": "~0.3",
-        "pimple/pimple": "~3.0",
-        "rockettheme/toolbox": "~1.0",
+        "pimple/pimple": "~3.2",
+        "rockettheme/toolbox": "1.4.2",
        "maximebf/debugbar": "~1.10",
        "ext-mbstring": "*",
        "ext-openssl": "*",
        "ext-curl": "*",
        "ext-zip": "*",
+        "ext-json": "*",
        "league/climate": "^3.2",
-        "antoligy/dom-string-iterators": "^1.0"
+        "antoligy/dom-string-iterators": "^1.0",
+        "miljar/php-exif": "^0.6.3",
+        "composer/ca-bundle": "^1.0",
+        "phive/twig-extensions-deferred": "^1.0"
    },
    "require-dev": {
        "codeception/codeception": "^2.1",
        "phpunit/php-code-coverage": "~2.0",
-        "fzaninotto/faker": "^1.5"
+        "fzaninotto/faker": "^1.5",
+        "victorjonsson/markdowndocs": "dev-master"
    },
+    "config": {
+        "platform": {
+            "php": "5.6.4"
+        }
+    },
+    "repositories": [
+        {
+            "type": "vcs",
+            "url": "https://github.com/trilbymedia/PHP-Markdown-Documentation-Generator"
+        }
+    ],
    "autoload": {
        "psr-4": {
            "Grav\\": "system/src/Grav"
--- a/composer.lock
+++ b/composer.lock
--- a/index.php
+++ b/index.php
@@ -1,13 +1,15 @@
 <?php
+
 /**
 * @package    Grav.Core
 *
- * @copyright  Copyright (C) 2014 - 2016 RocketTheme, LLC. All rights reserved.
+ * @copyright  Copyright (C) 2015 - 2018 Trilby Media, LLC. All rights reserved.
 * @license    MIT License; see LICENSE file for details.
 */

 namespace Grav;
-define('GRAV_PHP_MIN', '5.5.9');
+
+define('GRAV_PHP_MIN', '5.6.4');

 // Ensure vendor libraries exist
 $autoload = __DIR__ . '/vendor/autoload.php';
@@ -15,9 +17,9 @@ if (!is_file($autoload)) {
    die("Please run: <i>bin/grav install</i>");
 }

-if (PHP_SAPI == 'cli-server') {
+if (PHP_SAPI === 'cli-server') {
    if (!isset($_SERVER['PHP_CLI_ROUTER'])) {
-        die("PHP webserver requires a router to run Grav, please use: <pre>php -S {$_SERVER["SERVER_NAME"]}:{$_SERVER["SERVER_PORT"]} system/router.php</pre>");
+       die("PHP webserver requires a router to run Grav, please use: <pre>php -S {$_SERVER['SERVER_NAME']}:{$_SERVER['SERVER_PORT']} system/router.php</pre>");
    }
 }

@@ -29,7 +31,7 @@ if (version_compare($ver = PHP_VERSION, $req = GRAV_PHP_MIN, '<')) {
 }

 // Register the auto-loader.
-$loader = require_once $autoload;
+$loader = require $autoload;

 // Set timezone to default, falls back to system if php.ini not set
 date_default_timezone_set(@date_default_timezone_get());
--- a/robots.txt
+++ b/robots.txt
@@ -9,3 +9,4 @@ Disallow: /vendor/
 Disallow: /user/
 Allow: /user/pages/
 Allow: /user/themes/
+Allow: /user/images/
--- a/system/assets/jquery/jquery-3.x.min.js
+++ b/system/assets/jquery/jquery-3.x.min.js
--- a/system/assets/whoops.css
+++ b/system/assets/whoops.css
@@ -1,5 +1,5 @@
 body header {
-    background: #8552A2;
+    background: #3085EE;
 }

 body .left-panel {
--- a/system/blueprints/config/security.yaml
+++ b/system/blueprints/config/security.yaml
@@ -0,0 +1,99 @@
+title: PLUGIN_ADMIN.SECURITY
+
+form:
+    validation: loose
+    fields:
+
+        xss_section:
+            type: section
+            title: PLUGIN_ADMIN.XSS_SECURITY
+            underline: true
+
+        xss_whitelist:
+            type: selectize
+            size: large
+            label: PLUGIN_ADMIN.XSS_WHITELIST_PERMISSIONS
+            help: PLUGIN_ADMIN.XSS_WHITELIST_PERMISSIONS_HELP
+            placeholder: 'admin.super'
+            classes: fancy
+            validate:
+                type: commalist
+
+        xss_enabled.on_events:
+            type: toggle
+            label: PLUGIN_ADMIN.XSS_ON_EVENTS
+            highlight: 1
+            options:
+                1: PLUGIN_ADMIN.YES
+                0: PLUGIN_ADMIN.NO
+            default: true
+            validate:
+                type: bool
+
+        xss_enabled.invalid_protocols:
+            type: toggle
+            label: PLUGIN_ADMIN.XSS_INVALID_PROTOCOLS
+            highlight: 1
+            options:
+                1: PLUGIN_ADMIN.YES
+                0: PLUGIN_ADMIN.NO
+            default: true
+            validate:
+                type: bool
+
+        xss_enabled.moz_binding:
+            type: toggle
+            label: PLUGIN_ADMIN.XSS_MOZ_BINDINGS
+            highlight: 1
+            options:
+                1: PLUGIN_ADMIN.YES
+                0: PLUGIN_ADMIN.NO
+            default: true
+            validate:
+                type: bool
+
+        xss_enabled.html_inline_styles:
+            type: toggle
+            label: PLUGIN_ADMIN.XSS_HTML_INLINE_STYLES
+            highlight: 1
+            options:
+                1: PLUGIN_ADMIN.YES
+                0: PLUGIN_ADMIN.NO
+            default: true
+            validate:
+                type: bool
+
+        xss_enabled.dangerous_tags:
+            type: toggle
+            label: PLUGIN_ADMIN.XSS_DANGEROUS_TAGS
+            highlight: 1
+            options:
+                1: PLUGIN_ADMIN.YES
+                0: PLUGIN_ADMIN.NO
+            default: true
+            validate:
+                type: bool
+
+        xss_dangerous_tags:
+            type: selectize
+            size: large
+            label: PLUGIN_ADMIN.XSS_DANGEROUS_TAGS_LIST
+            classes: fancy
+            validate:
+                type: commalist
+
+        uploads_section:
+            type: section
+            title: PLUGIN_ADMIN.UPLOADS_SECURITY
+            underline: true
+
+
+        uploads_dangerous_extensions:
+            type: selectize
+            size: large
+            label: PLUGIN_ADMIN.UPLOADS_DANGEROUS_EXTENSIONS
+            help: PLUGIN_ADMIN.UPLOADS_DANGEROUS_EXTENSIONS_HELP
+            classes: fancy
+            validate:
+                type: commalist
+
--- a/system/blueprints/config/system.yaml
+++ b/system/blueprints/config/system.yaml
@@ -12,24 +12,25 @@ form:
            fields:
                home.alias:
                    type: pages
-                    size: medium
+                    size: large
                    classes: fancy
                    label: PLUGIN_ADMIN.HOME_PAGE
                    show_all: false
                    show_modular: false
                    show_root: false
+                    show_slug: true
                    help: PLUGIN_ADMIN.HOME_PAGE_HELP

                home.hide_in_urls:
-                      type: toggle
-                      label: PLUGIN_ADMIN.HIDE_HOME_IN_URLS
-                      help: PLUGIN_ADMIN.HIDE_HOME_IN_URLS_HELP
-                      highlight: 0
-                      options:
-                          1: PLUGIN_ADMIN.YES
-                          0: PLUGIN_ADMIN.NO
-                      validate:
-                          type: bool
+                    type: toggle
+                    label: PLUGIN_ADMIN.HIDE_HOME_IN_URLS
+                    help: PLUGIN_ADMIN.HIDE_HOME_IN_URLS_HELP
+                    highlight: 0
+                    options:
+                        1: PLUGIN_ADMIN.YES
+                        0: PLUGIN_ADMIN.NO
+                    validate:
+                        type: bool


                pages.theme:
@@ -376,6 +377,12 @@ form:
                    validate:
                        type: number
                        min: 1
+                pages.cache_control:
+                    type: text
+                    size: medium
+                    label: PLUGIN_ADMIN.CACHE_CONTROL
+                    help: PLUGIN_ADMIN.CACHE_CONTROL_HELP
+                    placeholder: 'e.g. public, max-age=31536000'
                pages.last_modified:
                    type: toggle
                    label: PLUGIN_ADMIN.LAST_MODIFIED
@@ -507,6 +514,17 @@ form:
                    help: PLUGIN_ADMIN.CACHE_PREFIX_HELP
                    placeholder: PLUGIN_ADMIN.CACHE_PREFIX_PLACEHOLDER

+                cache.clear_images_by_default:
+                    type: toggle
+                    label: PLUGIN_ADMIN.CLEAR_IMAGES_BY_DEFAULT
+                    help: PLUGIN_ADMIN.CLEAR_IMAGES_BY_DEFAULT_HELP
+                    highlight: 1
+                    options:
+                        1: PLUGIN_ADMIN.YES
+                        0: PLUGIN_ADMIN.NO
+                    validate:
+                        type: bool
+
                cache.cli_compatibility:
                    type: toggle
                    label: PLUGIN_ADMIN.CLI_COMPATIBILITY
@@ -598,6 +616,12 @@ form:
                    help: PLUGIN_ADMIN.REDIS_PORT_HELP
                    placeholder: "6379"

+                cache.redis.password:
+                    type: text
+                    size: small
+                    label: PLUGIN_ADMIN.REDIS_PASSWORD
+
+

        twig:
            type: section
@@ -788,10 +812,12 @@ form:
                        type: bool

                assets.collections:
-                    type: array
+                    type: multilevel
                    label: PLUGIN_ADMIN.COLLECTIONS
                    placeholder_key: collection_name
                    placeholder_value: collection_path
+                    validate:
+                        type: array

        errors:
            type: section
@@ -809,6 +835,8 @@ form:
                        -1: PLUGIN_ADMIN.ERROR_SYSTEM
                        0: PLUGIN_ADMIN.ERROR_SIMPLE
                        1: PLUGIN_ADMIN.ERROR_FULL_BACKTRACE
+                    validate:
+                        type: int


                errors.log:
@@ -861,7 +889,6 @@ form:
                    append: '%'
                    label: PLUGIN_ADMIN.DEFAULT_IMAGE_QUALITY
                    help: PLUGIN_ADMIN.DEFAULT_IMAGE_QUALITY_HELP
-                    classes: x-small
                    validate:
                        min: 1
                        max: 100
@@ -909,15 +936,6 @@ form:
                    validate:
                        type: bool

-                media.upload_limit:
-                    type: text
-                    append: bytes
-                    label: PLUGIN_ADMIN.UPLOAD_LIMIT
-                    help: PLUGIN_ADMIN.UPLOAD_LIMIT_HELP
-                    classes: small
-                    validate:
-                        type: number
-
                media.enable_media_timestamp:
                    type: toggle
                    label: PLUGIN_ADMIN.ENABLE_MEDIA_TIMESTAMP
@@ -929,6 +947,17 @@ form:
                    validate:
                        type: bool

+                media.auto_metadata_exif:
+                      type: toggle
+                      label: PLUGIN_ADMIN.ENABLE_AUTO_METADATA
+                      help: PLUGIN_ADMIN.ENABLE_AUTO_METADATA_HELP
+                      highlight: 0
+                      options:
+                          1: PLUGIN_ADMIN.YES
+                          0: PLUGIN_ADMIN.NO
+                      validate:
+                          type: bool
+


                media.allowed_fallback_types:
@@ -967,6 +996,18 @@ form:
                    validate:
                        type: bool

+                session.initialize:
+                    type: toggle
+                    label: PLUGIN_ADMIN.SESSION_INITIALIZE
+                    help: PLUGIN_ADMIN.SESSION_INITIALIZE_HELP
+                    highlight: 1
+                    options:
+                        1: PLUGIN_ADMIN.YES
+                        0: PLUGIN_ADMIN.NO
+                    default: true
+                    validate:
+                        type: bool
+
                session.timeout:
                    type: text
                    size: small
@@ -975,7 +1016,7 @@ form:
                    help: PLUGIN_ADMIN.TIMEOUT_HELP
                    validate:
                        type: number
-                        min: 1
+                        min: 0

                session.name:
                    type: text
@@ -1092,6 +1133,29 @@ form:
                    validate:
                        type: bool

+                username_regex:
+                    type: text
+                    size: large
+                    label: PLUGIN_ADMIN.USERNAME_REGEX
+                    help: PLUGIN_ADMIN.USERNAME_REGEX_HELP
+
+                pwd_regex:
+                    type: text
+                    size: large
+                    label: PLUGIN_ADMIN.PWD_REGEX
+                    help: PLUGIN_ADMIN.PWD_REGEX_HELP
+
+                intl_enabled:
+                    type: toggle
+                    label: PLUGIN_ADMIN.INTL_ENABLED
+                    highlight: 1
+                    help: PLUGIN_ADMIN.INTL_ENABLED_HELP
+                    options:
+                        1: PLUGIN_ADMIN.YES
+                        0: PLUGIN_ADMIN.NO
+                    validate:
+                        type: bool
+
                wrapped_site:
                    type: toggle
                    label: PLUGIN_ADMIN.WRAPPED_SITE
@@ -1136,9 +1200,45 @@ form:
                    validate:
                        type: bool

+                force_lowercase_urls:
+                    type: toggle
+                    label: PLUGIN_ADMIN.FORCE_LOWERCASE_URLS
+                    highlight: 1
+                    default: 1
+                    help: PLUGIN_ADMIN.FORCE_LOWERCASE_URLS_HELP
+                    options:
+                        1: PLUGIN_ADMIN.YES
+                        0: PLUGIN_ADMIN.NO
+                    validate:
+                        type: bool
+
                custom_base_url:
                    type: text
                    size: medium
                    placeholder: "e.g. http://yoursite.com/yourpath"
                    label: PLUGIN_ADMIN.CUSTOM_BASE_URL
                    help: PLUGIN_ADMIN.CUSTOM_BASE_URL_HELP
+
+                strict_mode.yaml_compat:
+                    type: toggle
+                    label: PLUGIN_ADMIN.STRICT_YAML_COMPAT
+                    highlight: 1
+                    default: 1
+                    help: PLUGIN_ADMIN.STRICT_YAML_COMPAT_HELP
+                    options:
+                        1: PLUGIN_ADMIN.YES
+                        0: PLUGIN_ADMIN.NO
+                    validate:
+                        type: bool
+
+                strict_mode.twig_compat:
+                    type: toggle
+                    label: PLUGIN_ADMIN.STRICT_TWIG_COMPAT
+                    highlight: 1
+                    default: 1
+                    help: PLUGIN_ADMIN.STRICT_TWIG_COMPAT_HELP
+                    options:
+                        1: PLUGIN_ADMIN.YES
+                        0: PLUGIN_ADMIN.NO
+                    validate:
+                        type: bool
--- a/system/blueprints/pages/default.yaml
+++ b/system/blueprints/pages/default.yaml
@@ -21,6 +21,9 @@ form:
          title: PLUGIN_ADMIN.CONTENT

          fields:
+            xss_check:
+              type: xss
+
            header.title:
              type: text
              autofocus: true
@@ -32,7 +35,7 @@ form:
                validate:
                  type: textarea

-            uploads:
+            header.media_order:
              type: pagemedia
              label: PLUGIN_ADMIN.PAGE_MEDIA

@@ -310,6 +313,31 @@ form:
                  toggleable: true
                  help: PLUGIN_ADMIN.APPEND_URL_EXT_HELP

+            routes_only:
+              type: section
+              title: PLUGIN_ADMIN.ROUTE_OVERRIDES
+              underline: true
+
+              fields:
+
+                header.routes.default:
+                  type: text
+                  toggleable: true
+                  label: PLUGIN_ADMIN.ROUTE_DEFAULT
+
+                header.routes.canonical:
+                  type: text
+                  toggleable: true
+                  label: PLUGIN_ADMIN.ROUTE_CANONICAL
+
+                header.routes.aliases:
+                  type: array
+                  toggleable: true
+                  value_only: true
+                  size: large
+                  label: PLUGIN_ADMIN.ROUTE_ALIASES
+
+
            admin_only:
              type: section
              title: PLUGIN_ADMIN.ADMIN_SPECIFIC_OVERRIDES
--- a/system/blueprints/pages/external.yaml
+++ b/system/blueprints/pages/external.yaml
@@ -1,5 +1,5 @@
 title: PLUGIN_ADMIN:EXTERNAL
-@extends:
+extends@:
    type: default
    context: blueprints://pages

@@ -25,7 +25,7 @@ form:
            content:
              unset@: true

-            uploads:
+            header.media_order:
              unset@: true

            header.external_url:
--- a/system/blueprints/pages/modular.yaml
+++ b/system/blueprints/pages/modular.yaml
@@ -1,7 +1,5 @@
 title: PLUGIN_ADMIN.MODULAR
-@extends:
-    type: default
-    context: blueprints://pages
+extends@: default

 form:
  fields:
@@ -13,35 +11,28 @@ form:
        content:
          fields:

+            modular_title:
+              type: spacer
+              title: PLUGIN_ADMIN.MODULAR_SETUP
+
            header.content.items:
-              type: select
+              type: text
              label: PLUGIN_ADMIN.ITEMS
              default: '@self.modular'
-              options:
-                '@self.modular': Modular Children
+              size: medium

            header.content.order.by:
-              type: select
+              type: text
              label: PLUGIN_ADMIN.ORDER_BY
-              default: date
-              options:
-                folder: PLUGIN_ADMIN.FOLDER
-                title: PLUGIN_ADMIN.TITLE
-                date: PLUGIN_ADMIN.DATE
-                default: PLUGIN_ADMIN.DEFAULT
+              placeholder: date
+              help:
+              size: small

            header.content.order.dir:
-              type: select
+              type: text
              label: PLUGIN_ADMIN.ORDER
-              default: desc
-              options:
-                asc: PLUGIN_ADMIN.ASCENDING
-                desc: PLUGIN_ADMIN.DESCENDING
+              help: '"desc" or "asc" are valid values'
+              placeholder: desc
+              size: small

-            header.process:
-              type: ignore
-            content:
-              type: ignore
-            uploads:
-              type: ignore

--- a/system/blueprints/user/account.yaml
+++ b/system/blueprints/user/account.yaml
@@ -20,7 +20,6 @@ form:
                title: PLUGIN_ADMIN.ACCOUNT
                underline: true

-
            username:
                type: text
                size: large
@@ -41,10 +40,11 @@ form:
                type: password
                size: large
                label: PLUGIN_ADMIN.PASSWORD
+                autocomplete: new-password
                validate:
                  required: false
                  message: PLUGIN_ADMIN.PASSWORD_VALIDATION_MESSAGE
-                  pattern: '(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{8,}'
+                  config-pattern@: system.pwd_regex

            fullname:
                type: text
@@ -67,6 +67,38 @@ form:
                default: 'en'
                help: PLUGIN_ADMIN.LANGUAGE_HELP

+            twofa_check:
+                type: conditional
+                condition: config.plugins.admin.twofa_enabled
+
+                fields:
+
+                    twofa:
+                        title: PLUGIN_ADMIN.2FA_TITLE
+                        type: section
+                        underline: true
+
+                    twofa_enabled:
+                        type: toggle
+                        label: PLUGIN_ADMIN.2FA_ENABLED
+                        classes: twofa-toggle
+                        highlight: 1
+                        default: 0
+                        options:
+                          1: PLUGIN_ADMIN.YES
+                          0: PLUGIN_ADMIN.NO
+                        validate:
+                          type: bool
+
+
+                    twofa_secret:
+                        type: 2fa_secret
+                        outerclasses: 'twofa-secret'
+                        markdown: true
+                        label: PLUGIN_ADMIN.2FA_SECRET
+                        sublabel: PLUGIN_ADMIN.2FA_SECRET_HELP
+
+
            security:
                title: PLUGIN_ADMIN.ACCESS_LEVELS
                type: section
@@ -75,10 +107,11 @@ form:

                fields:
                    groups:
-                        type: selectize
+                        type: select
+                        multiple: true
                        size: large
                        label: PLUGIN_ADMIN.GROUPS
-                        data-options@: '\Grav\User\Groups::groups'
+                        data-options@: '\Grav\Common\User\Group::groupNames'
                        classes: fancy
                        help: PLUGIN_ADMIN.GROUPS_HELP
                        validate:
--- a/system/config/media.yaml
+++ b/system/config/media.yaml
@@ -18,7 +18,7 @@ types:
    mime: image/jpeg
  jpeg:
    type: image
-    thumb: media/thumb-jpeg.png
+    thumb: media/thumb-jpg.png
    mime: image/jpeg
  png:
    type: image
@@ -28,12 +28,10 @@ types:
    type: animated
    thumb: media/thumb-gif.png
    mime: image/gif
-
  svg:
    type: vector
-    thumb: media/thumb.png
+    thumb: media/thumb-svg.png
    mime: image/svg+xml
-
  mp4:
    type: video
    thumb: media/thumb-mp4.png
@@ -56,13 +54,12 @@ types:
    mime: video/x-flv
  webm:
    type: video
-    thumb: media/thumb.png
+    thumb: media/thumb-webm.png
    mime: video/webm
  ogv:
    type: video
    thumb: media/thumb-ogg.png
    mime: video/ogg
-
  mp3:
    type: audio
    thumb: media/thumb-mp3.png
@@ -85,11 +82,12 @@ types:
    mime: audio/wav
  aiff:
    type: audio
+    thumb: media/thumb-aif.png
    mime: audio/aiff
  aif:
    type: audio
+    thumb: media/thumb-aif.png
    mime: audio/aif
-
  txt:
    type: file
    thumb: media/thumb-txt.png
@@ -104,66 +102,60 @@ types:
    mime: application/msword
  docx:
    type: file
+    thumb: media/thumb-docx.png
    mime: application/msword
  xls:
    type: file
+    thumb: media/thumb-xls.png
    mime: application/vnd.ms-excel
-  xlt:
-    type: file
-    mime: application/vnd.ms-excel
-  xlm:
-    type: file
-    mime: application/vnd.ms-excel
-  xlsm:
-    type: file
-    mime: application/vnd.ms-excel
-  xld:
-    type: file
-    mime: application/vnd.ms-excel
-  xla:
-    type: file
-    mime: application/vnd.ms-excel
-  xlc:
-    type: file
-    mime: application/vnd.ms-excel
-  xlw:
-    type: file
-    mime: application/vnd.ms-excel
-  xll:
+  xlsx:
    type: file
+    thumb: media/thumb-xlsx.png
    mime: application/vnd.ms-excel
  ppt:
    type: file
+    thumb: media/thumb-ppt.png
+    mime: application/vnd.ms-powerpoint
+  pptx:
+    type: file
+    thumb: media/thumb-pptx.png
    mime: application/vnd.ms-powerpoint
  pps:
    type: file
+    thumb: media/thumb-pps.png
    mime: application/vnd.ms-powerpoint
  rtf:
    type: file
+    thumb: media/thumb-rtf.png
    mime: application/rtf
-
  bmp:
    type: file
+    thumb: media/thumb-bmp.png
    mime: image/bmp
  tiff:
    type: file
+    thumb: media/thumb-tiff.png
    mime: image/tiff
  mpeg:
    type: file
+    thumb: media/thumb-mpg.png
    mime: video/mpeg
  mpg:
    type: file
+    thumb: media/thumb-mpg.png
    mime: video/mpeg
  mpe:
    type: file
+    thumb: media/thumb-mpe.png
    mime: video/mpeg
  avi:
    type: file
+    thumb: media/thumb-avi.png
    mime: video/msvideo
  wmv:
    type: file
+    thumb: media/thumb-wmv.png
    mime: video/x-ms-wmv
-
  html:
    type: file
    thumb: media/thumb-html.png
@@ -172,17 +164,29 @@ types:
    type: file
    thumb: media/thumb-html.png
    mime: text/html
+  ics:
+    type: iCal
+    thumb: media/thumb-ics.png
+    mime: text/calendar
  pdf:
    type: file
    thumb: media/thumb-pdf.png
    mime: application/pdf
+  ai:
+    type: file
+    thumb: media/thumb-ai.png
+    mime: image/ai
+  psd:
+    type: file
+    thumb: media/thumb-psd.png
+    mime: image/psd
  zip:
    type: file
    thumb: media/thumb-zip.png
    mime: application/zip
  7z:
    type: file
-    thumb: media/thumb-7zip.png
+    thumb: media/thumb-7z.png
    mime: application/x-7z-compressed
  gz:
    type: file
@@ -190,6 +194,7 @@ types:
    mime: application/gzip
  tar:
    type: file
+    thumb: media/thumb-tar.png
    mime: application/x-tar
  css:
    type: file
@@ -203,4 +208,3 @@ types:
    type: file
    thumb: media/thumb-json.png
    mime: application/json
-
--- a/system/config/security.yaml
+++ b/system/config/security.yaml
@@ -0,0 +1,31 @@
+xss_whitelist: [admin.super] # Whitelist of user access that should 'skip' XSS checking
+xss_enabled:
+    on_events: true
+    invalid_protocols: true
+    moz_binding: true
+    html_inline_styles: true
+    dangerous_tags: true
+xss_dangerous_tags:
+    - applet
+    - meta
+    - xml
+    - blink
+    - link
+    - style
+    - script
+    - embed
+    - object
+    - iframe
+    - frame
+    - frameset
+    - ilayer
+    - layer
+    - bgsound
+    - title
+    - base
+uploads_dangerous_extensions:
+    - php
+    - html
+    - htm
+    - js
+    - exe
--- a/system/config/site.yaml
+++ b/system/config/site.yaml
@@ -3,7 +3,7 @@ default_lang: en                            # Default language for site (potenti

 author:
  name: John Appleseed                      # Default author name
-  email: 'john@email.com'                   # Default author email
+  email: 'john@example.com'                 # Default author email

 taxonomies: [category,tag]                  # Arbitrary list of taxonomy types

--- a/system/config/system.yaml
+++ b/system/config/system.yaml
@@ -1,141 +1,152 @@
-absolute_urls: false                        # Absolute or relative URLs for `base_url`
-timezone: ''                                # Valid values: http://php.net/manual/en/timezones.php
-default_locale:                             # Default locale (defaults to system)
-param_sep: ':'                              # Parameter separator, use ';' for Apache on windows
-wrapped_site: false                         # For themes/plugins to know if Grav is wrapped by another platform
-reverse_proxy_setup: false                  # Running in a reverse proxy scenario with different webserver ports than proxy
-force_ssl: false                            # If enabled, Grav forces to be accessed via HTTPS (NOTE: Not an ideal solution)
-custom_base_url: ''                         # Set the base_url manually, e.g. http://yoursite.com/yourpath
+absolute_urls: false                             # Absolute or relative URLs for `base_url`
+timezone: ''                                     # Valid values: http://php.net/manual/en/timezones.php
+default_locale:                                  # Default locale (defaults to system)
+param_sep: ':'                                   # Parameter separator, use ';' for Apache on windows
+wrapped_site: false                              # For themes/plugins to know if Grav is wrapped by another platform
+reverse_proxy_setup: false                       # Running in a reverse proxy scenario with different webserver ports than proxy
+force_ssl: false                                 # If enabled, Grav forces to be accessed via HTTPS (NOTE: Not an ideal solution)
+force_lowercase_urls: true                       # If you want to support mixed cased URLs set this to false
+custom_base_url: ''                              # Set the base_url manually, e.g. http://yoursite.com/yourpath
+username_regex: '^[a-z0-9_-]{3,16}$'             # Only lowercase chars, digits, dashes, underscores. 3 - 16 chars
+pwd_regex: '(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{8,}' # At least one number, one uppercase and lowercase letter, and be at least 8+ chars
+intl_enabled: true                               # Special logic for PHP International Extension (mod_intl)

 languages:
-  supported: []                             # List of languages supported. eg: [en, fr, de]
-  include_default_lang: true                # Include the default lang prefix in all URLs
-  translations: true                        # Enable translations by default
-  translations_fallback: true               # Fallback through supported translations if active lang doesn't exist
-  session_store_active: false               # Store active language in session
-  http_accept_language: false               # Attempt to set the language based on http_accept_language header in the browser
-  override_locale: false                    # Override the default or system locale with language specific one
+  supported: []                                  # List of languages supported. eg: [en, fr, de]
+  include_default_lang: true                     # Include the default lang prefix in all URLs
+  translations: true                             # Enable translations by default
+  translations_fallback: true                    # Fallback through supported translations if active lang doesn't exist
+  session_store_active: false                    # Store active language in session
+  http_accept_language: false                    # Attempt to set the language based on http_accept_language header in the browser
+  override_locale: false                         # Override the default or system locale with language specific one

 home:
-  alias: '/home'                            # Default path for home, ie /
-  hide_in_urls: false                       # Hide the home route in URLs
+  alias: '/home'                                 # Default path for home, ie /
+  hide_in_urls: false                            # Hide the home route in URLs

 pages:
-  theme: antimatter                         # Default theme (defaults to "antimatter" theme)
+  theme: quark                                   # Default theme (defaults to "quark" theme)
  order:
-    by: default                             # Order pages by "default", "alpha" or "date"
-    dir: asc                                # Default ordering direction, "asc" or "desc"
+    by: default                                  # Order pages by "default", "alpha" or "date"
+    dir: asc                                     # Default ordering direction, "asc" or "desc"
  list:
-    count: 20                               # Default item count per page
+    count: 20                                    # Default item count per page
  dateformat:
-    default:                                # The default date format Grav expects in the `date: ` field
-    short: 'jS M Y'                         # Short date format
-    long: 'F jS \a\t g:ia'                  # Long date format
-  publish_dates: true                       # automatically publish/unpublish based on dates
+    default:                                     # The default date format Grav expects in the `date: ` field
+    short: 'jS M Y'                              # Short date format
+    long: 'F jS \a\t g:ia'                       # Long date format
+  publish_dates: true                            # automatically publish/unpublish based on dates
  process:
-    markdown: true                          # Process Markdown
-    twig: false                             # Process Twig
-  twig_first: false                         # Process Twig before markdown when processing both on a page
-  never_cache_twig: false                   # Only cache content, never cache twig processed in content (incompatible with `twig_first: true`)
+    markdown: true                               # Process Markdown
+    twig: false                                  # Process Twig
+  twig_first: false                              # Process Twig before markdown when processing both on a page
+  never_cache_twig: false                        # Only cache content, never cache twig processed in content (incompatible with `twig_first: true`)
  events:
-    page: true                              # Enable page level events
-    twig: true                              # Enable Twig level events
+    page: true                                   # Enable page level events
+    twig: true                                   # Enable Twig level events
  markdown:
-    extra: false                            # Enable support for Markdown Extra support (GFM by default)
-    auto_line_breaks: false                 # Enable automatic line breaks
-    auto_url_links: false                   # Enable automatic HTML links
-    escape_markup: false                    # Escape markup tags into entities
-    special_chars:                          # List of special characters to automatically convert to entities
+    extra: false                                 # Enable support for Markdown Extra support (GFM by default)
+    auto_line_breaks: false                      # Enable automatic line breaks
+    auto_url_links: false                        # Enable automatic HTML links
+    escape_markup: false                         # Escape markup tags into entities
+    special_chars:                               # List of special characters to automatically convert to entities
      '>': 'gt'
      '<': 'lt'
-  types: [txt,xml,html,htm,json,rss,atom]   # list of valid page types
-  append_url_extension: ''                  # Append page's extension in Page urls (e.g. '.html' results in /path/page.html)
-  expires: 604800                           # Page expires time in seconds (604800 seconds = 7 days)
-  last_modified: false                      # Set the last modified date header based on file modification timestamp
-  etag: false                               # Set the etag header tag
-  vary_accept_encoding: false               # Add `Vary: Accept-Encoding` header
-  redirect_default_route: false             # Automatically redirect to a page's default route
-  redirect_default_code: 301                # Default code to use for redirects
-  redirect_trailing_slash: true             # Handle automatically or 301 redirect a trailing / URL
-  ignore_files: [.DS_Store]                 # Files to ignore in Pages
-  ignore_folders: [.git, .idea]             # Folders to ignore in Pages
-  ignore_hidden: true                       # Ignore all Hidden files and folders
-  url_taxonomy_filters: true                # Enable auto-magic URL-based taxonomy filters for page collections
+  types: [txt,xml,html,htm,json,rss,atom]        # list of valid page types
+  append_url_extension: ''                       # Append page's extension in Page urls (e.g. '.html' results in /path/page.html)
+  expires: 604800                                # Page expires time in seconds (604800 seconds = 7 days)
+  cache_control:                                 # Can be blank for no setting, or a valid `cache-control` text value
+  last_modified: false                           # Set the last modified date header based on file modification timestamp
+  etag: false                                    # Set the etag header tag
+  vary_accept_encoding: false                    # Add `Vary: Accept-Encoding` header
+  redirect_default_route: false                  # Automatically redirect to a page's default route
+  redirect_default_code: 302                     # Default code to use for redirects
+  redirect_trailing_slash: true                  # Handle automatically or 302 redirect a trailing / URL
+  ignore_files: [.DS_Store]                      # Files to ignore in Pages
+  ignore_folders: [.git, .idea]                  # Folders to ignore in Pages
+  ignore_hidden: true                            # Ignore all Hidden files and folders
+  url_taxonomy_filters: true                     # Enable auto-magic URL-based taxonomy filters for page collections
  frontmatter:
-    process_twig: false                     # Should the frontmatter be processed to replace Twig variables?
-    ignore_fields: ['form','forms']         # Fields that might contain Twig variables and should not be processed
+    process_twig: false                          # Should the frontmatter be processed to replace Twig variables?
+    ignore_fields: ['form','forms']              # Fields that might contain Twig variables and should not be processed

 cache:
-  enabled: true                             # Set to true to enable caching
+  enabled: true                                  # Set to true to enable caching
  check:
-    method: file                            # Method to check for updates in pages: file|folder|hash|none
-  driver: auto                              # One of: auto|file|apc|xcache|memcache|wincache
-  prefix: 'g'                               # Cache prefix string (prevents cache conflicts)
-  cli_compatibility: false                  # Ensures only non-volatile drivers are used (file, redis, memcache, etc.)
-  lifetime: 604800                          # Lifetime of cached data in seconds (0 = infinite)
-  gzip: false                               # GZip compress the page output
-  allow_webserver_gzip: false               # If true, `content-encoding: identity` but connection isn't closed before `onShutDown()` event
+    method: file                                 # Method to check for updates in pages: file|folder|hash|none
+  driver: auto                                   # One of: auto|file|apc|xcache|memcache|wincache
+  prefix: 'g'                                    # Cache prefix string (prevents cache conflicts)
+  clear_images_by_default: true                  # By default grav will include processed images in cache clear, this can be disabled
+  cli_compatibility: false                       # Ensures only non-volatile drivers are used (file, redis, memcache, etc.)
+  lifetime: 604800                               # Lifetime of cached data in seconds (0 = infinite)
+  gzip: false                                    # GZip compress the page output
+  allow_webserver_gzip: false                    # If true, `content-encoding: identity` but connection isn't closed before `onShutDown()` event
  redis:
-    socket: false                           # Path to redis unix socket (e.g. /var/run/redis/redis.sock), false = use server and port to connect
+    socket: false                                # Path to redis unix socket (e.g. /var/run/redis/redis.sock), false = use server and port to connect

 twig:
-  cache: true                               # Set to true to enable Twig caching
-  debug: true                               # Enable Twig debug
-  auto_reload: true                         # Refresh cache on changes
-  autoescape: false                         # Autoescape Twig vars
-  undefined_functions: true                 # Allow undefined functions
-  undefined_filters: true                   # Allow undefined filters
-  umask_fix: false                          # By default Twig creates cached files as 755, fix switches this to 775
+  cache: true                                    # Set to true to enable Twig caching
+  debug: true                                    # Enable Twig debug
+  auto_reload: true                              # Refresh cache on changes
+  autoescape: false                              # Autoescape Twig vars (DEPRECATED, always enabled in strict mode)
+  undefined_functions: true                      # Allow undefined functions
+  undefined_filters: true                        # Allow undefined filters
+  umask_fix: false                               # By default Twig creates cached files as 755, fix switches this to 775

-assets:                                     # Configuration for Assets Manager (JS, CSS)
-  css_pipeline: false                       # The CSS pipeline is the unification of multiple CSS resources into one file
-  css_pipeline_include_externals: true      # Include external URLs in the pipeline by default
-  css_pipeline_before_excludes: true        # Render the pipeline before any excluded files
-  css_minify: true                          # Minify the CSS during pipelining
-  css_minify_windows: false                 # Minify Override for Windows platforms. False by default due to ThreadStackSize
-  css_rewrite: true                         # Rewrite any CSS relative URLs during pipelining
-  js_pipeline: false                        # The JS pipeline is the unification of multiple JS resources into one file
-  js_pipeline_include_externals: true       # Include external URLs in the pipeline by default
-  js_pipeline_before_excludes: true         # Render the pipeline before any excluded files
-  js_minify: true                           # Minify the JS during pipelining
-  enable_asset_timestamp: false             # Enable asset timestamps
+assets:                                          # Configuration for Assets Manager (JS, CSS)
+  css_pipeline: false                            # The CSS pipeline is the unification of multiple CSS resources into one file
+  css_pipeline_include_externals: true           # Include external URLs in the pipeline by default
+  css_pipeline_before_excludes: true             # Render the pipeline before any excluded files
+  css_minify: true                               # Minify the CSS during pipelining
+  css_minify_windows: false                      # Minify Override for Windows platforms. False by default due to ThreadStackSize
+  css_rewrite: true                              # Rewrite any CSS relative URLs during pipelining
+  js_pipeline: false                             # The JS pipeline is the unification of multiple JS resources into one file
+  js_pipeline_include_externals: true            # Include external URLs in the pipeline by default
+  js_pipeline_before_excludes: true              # Render the pipeline before any excluded files
+  js_minify: true                                # Minify the JS during pipelining
+  enable_asset_timestamp: false                  # Enable asset timestamps
  collections:
    jquery: system://assets/jquery/jquery-2.x.min.js

 errors:
-  display: 0                                # Display either (1) Full backtrace | (0) Simple Error | (-1) System Error
-  log: true                                 # Log errors to /logs folder
+  display: 0                                     # Display either (1) Full backtrace | (0) Simple Error | (-1) System Error
+  log: true                                      # Log errors to /logs folder

 debugger:
-  enabled: false                            # Enable Grav debugger and following settings
+  enabled: false                                 # Enable Grav debugger and following settings
  shutdown:
-    close_connection: true                  # Close the connection before calling onShutdown(). false for debugging
+    close_connection: true                       # Close the connection before calling onShutdown(). false for debugging

 images:
-  default_image_quality: 85                 # Default image quality to use when resampling images (85%)
-  cache_all: false                          # Cache all image by default
-  cache_perms: '0755'                       # MUST BE IN QUOTES!! Default cache folder perms. Usually '0755' or '0775'
-  debug: false                              # Show an overlay over images indicating the pixel depth of the image when working with retina for example
-  auto_fix_orientation: false               # Automatically fix the image orientation based on the Exif data
+  default_image_quality: 85                      # Default image quality to use when resampling images (85%)
+  cache_all: false                               # Cache all image by default
+  cache_perms: '0755'                            # MUST BE IN QUOTES!! Default cache folder perms. Usually '0755' or '0775'
+  debug: false                                   # Show an overlay over images indicating the pixel depth of the image when working with retina for example
+  auto_fix_orientation: false                    # Automatically fix the image orientation based on the Exif data

 media:
-  enable_media_timestamp: false             # Enable media timetsamps
-  upload_limit: 0                           # Set maximum upload size in bytes (0 is unlimited)
-  unsupported_inline_types: []              # Array of supported media types to try to display inline
-  allowed_fallback_types: []                # Array of allowed media types of files found if accessed via Page route
+  enable_media_timestamp: false                  # Enable media timestamps
+  unsupported_inline_types: []                   # Array of supported media types to try to display inline
+  allowed_fallback_types: []                     # Array of allowed media types of files found if accessed via Page route
+  auto_metadata_exif: false                      # Automatically create metadata files from Exif data where possible

 session:
-  enabled: true                             # Enable Session support
-  timeout: 1800                             # Timeout in seconds
-  name: grav-site                           # Name prefix of the session cookie. Use alphanumeric, dashes or underscores only. Do not use dots in the session name
-  secure: false                             # Set session secure. If true, indicates that communication for this cookie must be over an encrypted transmission. Enable this only on sites that run exclusively on HTTPS
-  httponly: true                            # Set session HTTP only. If true, indicates that cookies should be used only over HTTP, and JavaScript modification is not allowed.
-  split: true                               # Sessions should be independent between site and plugins (such as admin)
+  enabled: true                                  # Enable Session support
+  initialize: true                               # Initialize session from Grav (if false, plugin needs to start the session)
+  timeout: 1800                                  # Timeout in seconds
+  name: grav-site                                # Name prefix of the session cookie. Use alphanumeric, dashes or underscores only. Do not use dots in the session name
+  secure: false                                  # Set session secure. If true, indicates that communication for this cookie must be over an encrypted transmission. Enable this only on sites that run exclusively on HTTPS
+  httponly: true                                 # Set session HTTP only. If true, indicates that cookies should be used only over HTTP, and JavaScript modification is not allowed.
+  split: true                                    # Sessions should be independent between site and plugins (such as admin)
  path:

 gpm:
-  releases: stable                           # Set to either 'stable' or 'testing'
-  proxy_url:                                 # Configure a manual proxy URL for GPM (eg 127.0.0.1:3128)
-  method: 'auto'                             # Either 'curl', 'fopen' or 'auto'. 'auto' will try fopen first and if not available cURL
-  verify_peer: true                          # Sometimes on some systems (Windows most commonly) GPM is unable to connect because the SSL certificate cannot be verified. Disabling this setting might help.
-  official_gpm_only: true                    # By default GPM direct-install will only allow URLs via the official GPM proxy to ensure security
+  releases: stable                               # Set to either 'stable' or 'testing'
+  proxy_url:                                     # Configure a manual proxy URL for GPM (eg 127.0.0.1:3128)
+  method: 'auto'                                 # Either 'curl', 'fopen' or 'auto'. 'auto' will try fopen first and if not available cURL
+  verify_peer: true                              # Sometimes on some systems (Windows most commonly) GPM is unable to connect because the SSL certificate cannot be verified. Disabling this setting might help.
+  official_gpm_only: true                        # By default GPM direct-install will only allow URLs via the official GPM proxy to ensure security
+
+strict_mode:
+  yaml_compat: true                              # Grav 1.5+: Enables YAML backwards compatibility
+  twig_compat: true                              # Grav 1.5+: Enables deprecated Twig autoescape setting (autoescape: false)
--- a/system/defines.php
+++ b/system/defines.php
@@ -2,18 +2,18 @@
 /**
 * @package    Grav.Core
 *
- * @copyright  Copyright (C) 2014 - 2016 RocketTheme, LLC. All rights reserved.
+ * @copyright  Copyright (C) 2015 - 2018 Trilby Media, LLC. All rights reserved.
 * @license    MIT License; see LICENSE file for details.
 */

 // Some standard defines
 define('GRAV', true);
-define('GRAV_VERSION', '1.2.2');
+define('GRAV_VERSION', '1.5.10');
 define('GRAV_TESTING', false);
 define('DS', '/');

 if (!defined('GRAV_PHP_MIN')) {
-    define('GRAV_PHP_MIN', '5.5.9');
+    define('GRAV_PHP_MIN', '5.6.4');
 }

 // Directories and Paths
--- a/system/images/media/thumb-3dm.png
+++ b/system/images/media/thumb-3dm.png
--- a/system/images/media/thumb-3ds.png
+++ b/system/images/media/thumb-3ds.png
--- a/system/images/media/thumb-3g2.png
+++ b/system/images/media/thumb-3g2.png
--- a/system/images/media/thumb-3gp.png
+++ b/system/images/media/thumb-3gp.png
--- a/system/images/media/thumb-7z.png
+++ b/system/images/media/thumb-7z.png
--- a/system/images/media/thumb-aac.png
+++ b/system/images/media/thumb-aac.png
--- a/system/images/media/thumb-ai.png
+++ b/system/images/media/thumb-ai.png
--- a/system/images/media/thumb-aif.png
+++ b/system/images/media/thumb-aif.png
--- a/system/images/media/thumb-apk.png
+++ b/system/images/media/thumb-apk.png
--- a/system/images/media/thumb-app.png
+++ b/system/images/media/thumb-app.png
--- a/system/images/media/thumb-asf.png
+++ b/system/images/media/thumb-asf.png
--- a/system/images/media/thumb-asp.png
+++ b/system/images/media/thumb-asp.png
--- a/system/images/media/thumb-aspx.png
+++ b/system/images/media/thumb-aspx.png
--- a/system/images/media/thumb-asx.png
+++ b/system/images/media/thumb-asx.png
--- a/system/images/media/thumb-avi.png
+++ b/system/images/media/thumb-avi.png
--- a/system/images/media/thumb-bak.png
+++ b/system/images/media/thumb-bak.png
--- a/system/images/media/thumb-bat.png
+++ b/system/images/media/thumb-bat.png
--- a/system/images/media/thumb-bin.png
+++ b/system/images/media/thumb-bin.png
--- a/system/images/media/thumb-bmp.png
+++ b/system/images/media/thumb-bmp.png
--- a/system/images/media/thumb-cab.png
+++ b/system/images/media/thumb-cab.png
--- a/system/images/media/thumb-cad.png
+++ b/system/images/media/thumb-cad.png
--- a/system/images/media/thumb-cdr.png
+++ b/system/images/media/thumb-cdr.png
--- a/system/images/media/thumb-cer.png
+++ b/system/images/media/thumb-cer.png
--- a/system/images/media/thumb-cfg.png
+++ b/system/images/media/thumb-cfg.png
--- a/system/images/media/thumb-cfm.png
+++ b/system/images/media/thumb-cfm.png
--- a/system/images/media/thumb-cgi.png
+++ b/system/images/media/thumb-cgi.png
--- a/system/images/media/thumb-com.png
+++ b/system/images/media/thumb-com.png
--- a/system/images/media/thumb-cpl.png
+++ b/system/images/media/thumb-cpl.png
--- a/system/images/media/thumb-cpp.png
+++ b/system/images/media/thumb-cpp.png
--- a/system/images/media/thumb-crx.png
+++ b/system/images/media/thumb-crx.png
--- a/system/images/media/thumb-csr.png
+++ b/system/images/media/thumb-csr.png
--- a/system/images/media/thumb-css.png
+++ b/system/images/media/thumb-css.png
--- a/system/images/media/thumb-csv.png
+++ b/system/images/media/thumb-csv.png
--- a/system/images/media/thumb-cue.png
+++ b/system/images/media/thumb-cue.png
--- a/system/images/media/thumb-cur.png
+++ b/system/images/media/thumb-cur.png
--- a/system/images/media/thumb-dat.png
+++ b/system/images/media/thumb-dat.png
--- a/system/images/media/thumb-db.png
+++ b/system/images/media/thumb-db.png
--- a/system/images/media/thumb-dbf.png
+++ b/system/images/media/thumb-dbf.png
--- a/system/images/media/thumb-dds.png
+++ b/system/images/media/thumb-dds.png
--- a/system/images/media/thumb-dem.png
+++ b/system/images/media/thumb-dem.png
--- a/system/images/media/thumb-dll.png
+++ b/system/images/media/thumb-dll.png
--- a/system/images/media/thumb-dmg.png
+++ b/system/images/media/thumb-dmg.png
--- a/system/images/media/thumb-dmp.png
+++ b/system/images/media/thumb-dmp.png
--- a/system/images/media/thumb-doc.png
+++ b/system/images/media/thumb-doc.png
--- a/system/images/media/thumb-docx.png
+++ b/system/images/media/thumb-docx.png
--- a/system/images/media/thumb-drv.png
+++ b/system/images/media/thumb-drv.png
--- a/system/images/media/thumb-dtd.png
+++ b/system/images/media/thumb-dtd.png
--- a/system/images/media/thumb-dwg.png
+++ b/system/images/media/thumb-dwg.png
--- a/system/images/media/thumb-dxf.png
+++ b/system/images/media/thumb-dxf.png
--- a/system/images/media/thumb-elf.png
+++ b/system/images/media/thumb-elf.png
--- a/system/images/media/thumb-eot.png
+++ b/system/images/media/thumb-eot.png
--- a/system/images/media/thumb-eps.png
+++ b/system/images/media/thumb-eps.png
--- a/system/images/media/thumb-exe.png
+++ b/system/images/media/thumb-exe.png
--- a/system/images/media/thumb-fla.png
+++ b/system/images/media/thumb-fla.png
--- a/system/images/media/thumb-flv.png
+++ b/system/images/media/thumb-flv.png
--- a/system/images/media/thumb-fnt.png
+++ b/system/images/media/thumb-fnt.png
--- a/system/images/media/thumb-fon.png
+++ b/system/images/media/thumb-fon.png
--- a/system/images/media/thumb-gam.png
+++ b/system/images/media/thumb-gam.png
--- a/system/images/media/thumb-gbr.png
+++ b/system/images/media/thumb-gbr.png
--- a/system/images/media/thumb-ged.png
+++ b/system/images/media/thumb-ged.png
--- a/system/images/media/thumb-gif.png
+++ b/system/images/media/thumb-gif.png
--- a/system/images/media/thumb-gpx.png
+++ b/system/images/media/thumb-gpx.png
--- a/system/images/media/thumb-gz.png
+++ b/system/images/media/thumb-gz.png
--- a/system/images/media/thumb-gzip.png
+++ b/system/images/media/thumb-gzip.png
--- a/system/images/media/thumb-hqz.png
+++ b/system/images/media/thumb-hqz.png
--- a/system/images/media/thumb-html.png
+++ b/system/images/media/thumb-html.png
--- a/system/images/media/thumb-icns.png
+++ b/system/images/media/thumb-icns.png
--- a/system/images/media/thumb-ico.png
+++ b/system/images/media/thumb-ico.png
--- a/system/images/media/thumb-ics.png
+++ b/system/images/media/thumb-ics.png
--- a/system/images/media/thumb-iff.png
+++ b/system/images/media/thumb-iff.png
--- a/system/images/media/thumb-indd.png
+++ b/system/images/media/thumb-indd.png
--- a/system/images/media/thumb-iso.png
+++ b/system/images/media/thumb-iso.png
--- a/Show More
+++ b/Show More