Hi guys,
We are pleased to announce the release of T4 Page Builder 2.3.0 — a security-focused update that strengthens the protection of contact and subscription forms while improving administrator notification emails.
T4 Page Builder 2.3.0 Changelog
This release introduces important security improvements for public contact and subscription workflows.
- CSRF protection: Added Joomla form token validation to the contact action.
- Captcha enforcement: Added an explicit Captcha requirement instead of relying only on the Captcha plugin state.
- Rate limiting: Added request limits to the contact and subscribe tasks.
- Safer recipients: Hardened anonymous contact submissions to prevent arbitrary recipient addresses from being supplied through requests.
- Subscribe security: Audited and secured the subscribe task against unauthenticated writes to AcyMailing tables.
- Improved admin emails: Administrator notifications now include the full information submitted by the user instead of only the email message.
Security Improvements
CSRF Protection for Contact Forms
The contact action now requires a valid Joomla form token. This helps prevent cross-site request forgery (CSRF), where a malicious website attempts to submit a contact form without the visitor’s knowledge.
Explicit Captcha Requirement
Contact submissions now require explicit Captcha validation instead of relying only on whether the Captcha plugin is enabled.
This closes a potential validation gap and provides more consistent protection against spam and automated submissions.
Rate Limiting for Contact and Subscribe Tasks
Rate limiting has been added to both the contact and subscribe tasks. This helps reduce:
- Spam floods
- Repeated automated submissions
- Excessive requests targeting public forms
- Other forms of automated abuse
Safer Contact Form Recipients
The contact workflow no longer trusts recipient addresses supplied directly through anonymous requests.
Recipient handling is now controlled by the component, preventing arbitrary external email addresses from being used through submitted requests.
Subscribe Task Security Audit
The subscribe task has been audited and secured against the same class of unauthenticated write issue.
This helps prevent unauthorized changes to connected AcyMailing subscription tables.
Admin Experience Improvements
More Detailed Admin Notification Emails
Administrator notification emails now include the full information submitted through the contact form instead of only the email message.
This gives administrators the complete context of each inquiry directly in the notification email, reducing the need to follow up separately for missing information.
Why This Update Matters
Public contact and subscription forms are common targets for spam and automated abuse. T4 Page Builder 2.3.0 introduces stronger validation and request controls to help protect these forms and reduce unauthorized submissions.
- Stronger request validation: Contact submissions must include a valid Joomla form token.
- Consistent Captcha protection: Captcha validation is explicitly required for contact submissions.
- Reduced automated abuse: Rate limiting protects contact and subscribe tasks against repeated requests.
- Controlled email recipients: Anonymous requests can no longer freely supply arbitrary recipient addresses.
- Protected subscription data: The subscribe task is secured against unauthenticated AcyMailing table writes.
- Better administrator context: Notification emails contain all information submitted by the user.
Installation & Upgrade Instructions
- Step 1: Download T4 Page Builder 2.3.0 from your JoomlArt member area.
- Step 2: Log in to your Joomla administrator dashboard.
- Step 3: Go to System → Install → Extensions.
- Step 4: Upload and install the latest T4 Page Builder package.
- Step 5: Clear the Joomla cache after completing the update.
- Step 6: Test all active contact and subscription forms on your website.
Tip: If your website includes custom layouts, overrides, or third-party integrations, test the update on a staging website before installing it on your live site.
Get the Latest Version
Keep your Joomla website secure and up to date with T4 Page Builder 2.3.0.
Existing users can download the latest version directly from the JoomlArt member area. If you are new to T4 Page Builder or need access to T4 Page Builder Pro, explore the available membership plans to find the option that best fits your needs.
Download Latest Version All Features Pricing Plans
