Icecube

Security

• Locks are now enforced on every web request, not just control panel requests. Previously the save and delete guards were only registered for CP requests, so any other path that saves an element — front-end form submissions, GraphQL mutations, Element API writes, or other plugins saving elements programmatically — could modify or delete locked content without a password. Console commands remain exempt, since there is no session in which to enter an unlock password.
• The Unlock locked content with password permission is now actually enforced. It was previously registered but never checked, so any logged-in control panel user could unlock any locked element.
• Unlock attempts are now rate limited, which closes off brute-forcing a per-lock or master password. After a configurable number of failed attempts against the same element and action, further attempts from that user are refused for a cooling-off period. Attempts are counted per user, so one editor mistyping a password can't lock out everyone else, and a successful unlock clears the count.

Added

• New Failed Attempts Allowed (default: 5) and Lockout Duration (default: 5 minutes) settings to tune the unlock rate limiting.
• A Craft-backed integration test suite (Codeception) covering lock resolution, session unlocks, save/delete enforcement, and the install migration. Run with composer test-integration.

Changed

• The unlock modal is no longer shown to users without the Unlock locked content with password permission, since they can't complete it. Locked content still can't be saved or deleted by those users.

Upgrade note: because the unlock permission is now enforced, non-admin users need it granted explicitly under Settings → Users → Permissions (or on their user group) before they can unlock content. Admins are unaffected — they satisfy every permission check automatically. If your editors currently unlock content with the master password, grant them this permission before upgrading.

Added

• New locks can now be created from the lock management screen using dropdowns for sections, volumes, category groups, and global sets, instead of entering numeric IDs by hand.

Changed

• Refactored the control panel UI to follow native Craft conventions: the locks list, inline lock panel, unlock modal, and lock badge now use Craft’s data tables, status indicators, lightswitches, and meta panels, and adapt to the CP’s light and dark themes.
• The locks list now shows human-readable target types, scopes, and what each lock protects, with a proper empty state when nothing is locked yet.

Fixed

• Fixed an error that could occur when saving a brand-new element into a section, volume, or category group protected by a rule-based lock.