Skip to content

Conversation

@jkraffthha
Copy link
Contributor

I've made a fix to make cms_pico compatible with nextcloud 31.
For that I've change the app structure using bootstrap.
The main issue was the replacement of ILogger by LoggerInterface.
I haven't been able to make the HTMLPurifier work properly (for now), so I'm bypassing it, which might be an issue (it's not in my current user case).
I've only been able to test it on two seperate Nextcloud instance running Nextcloud 31.

jkraffthha and others added 3 commits December 31, 2025 08:29
Added compatibility information for Nextcloud 26 and noted potential issues with HTML purifier.

Signed-off-by: Joanny Krafft <144920174+jkraffthha@users.noreply.github.com>
Clarified compatibility notes and improved language.

Signed-off-by: Joanny Krafft <144920174+jkraffthha@users.noreply.github.com>
@PhrozenByte
Copy link
Member

PhrozenByte commented Jan 5, 2026

Thank you for your contribution! 👍

However, most of this (but not all, like the bootstrap class) has been fixed in the cms_pico-1.0 branch already. The master branch is for the never released Pico CMS for Nextcloud 2.0; the last stable (but long end-of-life) version 1.0 can be found in the cms_pico-1.0 branch. I've merged cms_pico-1.0 into master to reduce confusion in the future.

This also creates a merge conflict with your PR. You can rebase if you want to, but please note that I'm not going to merge it (or any other PR for this matter), because:

Pico CMS for Nextcloud has long reached its end-of-life. See 1fbe212 for details. Since Pico (https://github.com/picocms/Pico) has reached its end-of-life too and nobody is willing to take up responsibility, both Pico and the cms_pico app are in an abandoned state (also see picocms/Pico#716). Since releasing a new stable version requires a minimum guarantee of support, "just making it compatible" and releasing a new version is no option.

Pico users can keep on using standalone Pico, but users of the Nextcloud app really should not: Integrating Pico into Nextcloud is a very delicate matter. It can easily create major security issues for your Nextcloud instance: If users manage to integrate active contents into their website, they could potentially take over the whole Nextcloud instance. Thus it's a very, very bad idea to keep on using the Nextcloud app.

Personally I wouldn't even use it with an updated version of HTMLPurifier, but with the ancient version cms_pico currently uses, or disabling it altogether, one basically asks for users to hack the Nextcloud instance. So, please don't do that. Naturally, it's OSS, so you can if you really want to, but you've been warned and I very strongly advise against it.

I'm very sorry, but Pico CMS for Nextcloud is really dead and shouldn't be used right now 😞 Bringing it back to life wouldn't just require one to fix the few compatibility issues, but revive both Pico and the Nextcloud app, and to give at least a medium-term commitment to provide said minimum guarantee of support. See picocms/Pico#716 for more details.

@jkraffthha
Copy link
Contributor Author

Hi,
Thanks for the clarification on the cms_pico-1.0 branch, I obviously misunderstood what was there and what wasn't.
I figured that merging it would probably not be an option. It was just in case others might be stuck with conservative users that don't want to use the Nextcloud Collective app (for now, at least), or any other solution I've demoed. The security issue might actually be the only argument that might get through to the project lead.
In any case, thank you so much for taking the time to clarify things up.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants