Hi guys,
We're pleased to announce the release of T4 Page Builder 2.3.0 — a security-focused update that strengthens the protection of contact and subscription forms while improving administrator notification emails.
If you use T4 Page Builder on a public Joomla website, especially one with contact or subscription forms enabled, we strongly recommend upgrading to the latest version.
T4 Page Builder 2.3.0 Changelog
Security Improvements
- Added Joomla form token validation to contact form submissions
- Improved Captcha enforcement for configured contact forms
- Added rate limiting to contact and subscription endpoints
- Restricted contact form recipients to configured email addresses
- Improved security for the AcyMailing subscription workflow
Admin Experience Improvements
- Improved administrator notification emails for new contact form submissions
- Added all submitted contact information to administrator notification emails
Security Improvements
CSRF Protection for Contact Forms
All contact form submissions now require a valid Joomla security token. This helps prevent cross-site request forgery (CSRF), where a malicious website attempts to submit a form without the visitor’s knowledge.
Improved Captcha Enforcement
Captcha validation is now enforced directly by the component whenever Captcha is configured for a contact form. This ensures that Captcha protection cannot be skipped because of an incorrect plugin state or request condition.
Rate Limiting for Contact and Subscribe Forms
Rate limiting has been added to the contact and subscription endpoints to reduce spam, automated submissions, and other forms of abuse targeting public forms.
Restricted Contact Form Recipients
The contact form endpoint no longer accepts arbitrary recipient addresses from submitted requests. Emails can now be sent only to recipients configured in the component settings, helping prevent unauthorized email delivery through your website.
Subscribe Workflow Security
The subscription workflow has also been reviewed and updated to prevent unauthorized subscription actions and protect connected AcyMailing data.
Admin Experience Improvements
More Detailed Admin Notification Emails
Administrator notification emails for new contact form submissions now include all information provided by the user, rather than only the message content.
This gives site administrators the complete context of each inquiry directly in the notification email, reducing the need to follow up separately for missing information.
Installation & Upgrade Instructions
Before upgrading, please take a full backup of your Joomla website.
- Download T4 Page Builder 2.3.0 from the JoomlArt member area.
- Log in to your Joomla administrator dashboard and go to System → Install → Extensions.
- Upload and install the latest T4 Page Builder package.
- Clear the Joomla cache and test any active contact and subscription forms after completing the update.
Get the Latest Version
Keep your Joomla website secure and up to date with T4 Page Builder 2.3.0. Existing users can download the latest version directly from the JoomlArt member area.
If you are new to T4 Page Builder or need access to T4 Page Builder Pro, explore the available JoomlArt membership plans to find the option that best fits your needs.
Download Latest Version All Features Pricing Plans
Need Help?
If you have any questions or need assistance with the upgrade, please visit our Forum or submit a ticket through the Support Dashboard.
