Prizma 1.5.7: gallery body background, light and dark sidebar looks, two security fixes and a full bug sweep
This is a larger release than usual. Besides the new features, Prizma's whole code base was reviewed from the start, and everything listed under Fixed was reproduced or measured before it was fixed. Updating is recommended for every site, because of the two security fixes.
New
Gallery body background: the backgrounds you know from the sidebar cards now also work for the panel the media cards sit on, on every gallery page. A palette colour, a bundled image, an image from the library or your own upload (up to 1920 px and 400 KB). With an image, the panel takes the image's text tone so titles and counts stay readable. Admin → Prizma → Sidebar → "Background of the gallery body".
Light and dark for the six sidebar looks: Admin → Prizma → Sidebar → "Colour scheme": Follow the forum (including your members' light/dark switch), Always light or Always dark. The Neon list and Ticket cards now have a day card as well as their night card.
New option "Viewer: title bar above the pop-up" (Options → Prizma: Viewer buttons), off by default. The side panel already shows the title.
Security
E-books (EPUB, MOBI and KF8) could carry scripts that ran for anyone who pressed Read, administrators included. Every book page is now cleaned before it is shown (scripts, frames, event handlers and script links are removed), and HTML pages also get a policy that blocks scripts.
A subtitle file could carry markup that ran a script for anyone who opened the video. Subtitle text now keeps only bold, italic, underline, ruby and timing tags. Subtitles you already have are cleaned when they are served.
Privacy
Audio and video pages no longer load a script from cdn.jsdelivr.net; the subtitle library now ships with Prizma.
Media of a deleted category, or of a deleted private, members-only or unlisted album, could fall back to the gallery-wide permissions and become visible to guests. It now stays visible only to its uploader and to moderators, who find it under All.
Visitors without permission to view the gallery could still see album and collection titles and covers. A feed whose target was deleted kept publishing with gallery-wide visibility; it now pauses. Comments awaiting approval could be read in the news feed and search. Counts and the viewer's arrows now include only what the visitor can see.
XFMG import now carries over category permissions; restricted XFMG categories no longer become visible to guests.
Fixed (highlights)
Add media: an upload you abandoned could be published later under another title. Only the file you see in the preview is published now. Removed covers and subtitles are deleted from the server, subtitles can be replaced, and switching between file and link, or Video and Shorts, keeps the right files.
Viewer: after closing the pop-up, Esc, Space and the slideshow kept running in the background. Fast arrow presses move one item at a time, reading mode keeps the arrows in the book, votes update the card's heart, and "Watchlist" and "Set as avatar" in the ⋯ menu work.
"Rotate" and "Set as album cover" keep the pop-up open, and a rotated image turns straight away.
Video conversion: with "Discard the original" on, a converted video lost both files. Files that stayed queued are retried every 30 minutes and marked failed with a reason after about a day. Odd-width videos convert.
LIVE badge: Twitch and Kick are now checked, and YouTube channel live links are no longer marked "not live" for good after the first check.
Links: sources are recognised by their domain only, and Vimeo channel/showcase/unlisted links, SoundCloud playlists and private links, TikTok embeds and their short links now work.
Subtitles saved in older code pages (Turkish, Cyrillic, Central European…) no longer show broken letters. Very large panoramas no longer stop the upload with an out-of-memory error.
Moderation: "Spam clean-up" now covers Prizma media and comments, the moderator log records album moves, bulk edit tells you which item could not be saved, and the Prizma search tab finds comments. Comments and new media go through XenForo's spam checks and length limit like forum posts.
Admin panel: Content → Attachments no longer crashes when a Prizma attachment is listed, "Preview" in the feed editor no longer saves the feed as active, and a custom navigation title survives upgrades.
Cards no longer load a full-size image when XenForo could not make a thumbnail of a very large image.
Upgrading
No table or column changes. Upload the files and run the add-on upgrade as usual.
If your sidebar uses the Neon list or Ticket cards, the upgrade sets "Colour scheme" to Always dark, so it looks exactly as before.
If you had unticked every embed source, all of them were in fact still on. After upgrading that setting really means off; tick the sources you want under Options → Prizma: Integrations and API keys.
Comments and new media from members who fall under XenForo's spam checks (new members with few messages, by default) may now land in the approval queue.
Media already in a deleted category is hidden from members and guests as soon as you upgrade; moderators find it under All. Albums deleted before this version have already released their media, and that cannot be undone automatically.
Uninstalling no longer deletes the clean originals of watermarked images; they are moved to internal_data/erkan_prizma_originals_kept/ with a list of the attachments they belong to.
If you use one of the bundled translations, re-import it after upgrading: Admin → Prizma → Translations → Re-import.
If you have customised Prizma templates in one of your styles, XenForo will list the changed ones as outdated; merge or revert them. This release touches most of the media, album, collection and sidebar templates.
Prizma 1.5.5 — sidebar looks and sidebar backgrounds
New
Six new looks for the gallery's Categories card, chosen on a new admin page, Prizma → Sidebar: Neon list, Poster grid, Editorial list, Tag cloud, Accordion groups and Ticket cards. Each choice comes with a small preview. The current Prizma list stays the default.
The look applies to the Categories card on every gallery page that shows the sidebar: the gallery index, categories, the album and collection lists, single albums and collections, and member galleries. The Albums, Collections and Types cards keep their design.
Neon list and Ticket cards are dark "night" cards in both light and dark styles. The other looks follow your style's light or dark scheme, and fonts come from your style.
A category's own colour carries into every look. Where white text would not be readable on a colour (brick, mustard, olive and the brand purple), the text switches to a dark ink automatically.
In Accordion groups, the group of the category being viewed starts open. In Tag cloud, pills grow with the number of media items. On phones the cards still fold up as before.
Sidebar backgrounds: the sidebar cards can now have a background. The options are none, a palette colour (10 colours, each with its own shade in dark mode), one of the bundled images (4 ready-made images plus a library of 57 more, filterable by category and tone), or your own image.
Your own image is converted to WebP (JPEG where the server cannot write WebP), limited to 1200 px and 200 KB. On upload Prizma measures whether the image needs dark or light text and how much of a translucent veil keeps that text readable. A seamless pattern repeats at its own size, and you can switch repeating on or off. Uploading a new image replaces the old file, and the image can be removed again.
In the Neon list, Ticket cards, Poster grid and Tag cloud looks, the Categories card keeps its own ground; the other cards take the background.
Both settings work with the left and the right sidebar. With the horizontal category bar there is no sidebar, and the page says so.
Changed
The documentation files (README, uninstall notes, API and export schema) are no longer inside the package. They are now topics on the support forum, and the links in the add-on's option description and uninstall notice point there. The recommended server cache rules now also cover the new styles/prizma/ folder.
All new texts are translated into the 11 bundled languages.
Upgrading
Nothing changes until you choose a look or a background: with the defaults (Prizma list, no background) the sidebar renders exactly as in 1.5.4.2.
No table or column changes. Upload the files, including the new styles/prizma/ folder, and run the add-on upgrade as usual.
If you have customised the erkan_prizma_rail template in one of your styles, XenForo will list it as outdated. Merge or revert it, otherwise that style keeps the old sidebar and the new looks and backgrounds do not show there.
Files left over from earlier versions (README.md, UNINSTALL.md and the docs folder inside src/addons/Erkan/Prizma) are not used any more and can be deleted.
Opening an item's edit dialog, closing it without saving, and opening it again on the same page left every field blank. Retyping the title and saving then wrote those empty values over the item, deleting its description and tags and removing the adult (NSFW) flag, with no warning. The edit dialog is no longer cleared on close and is fetched fresh from the server on every open. This had been present since 1.0.0 and was found in our own audit; anything already lost this way has to be re-entered, as media items keep no revision history.
Fixed (1.5.4.1)
Changing an already published video to Reels saved the new type but the card kept its 16:9 shape, so it never appeared in the 9:16 Reels frame. The shape stored at publish time is now dropped when the type changes. Existing Reels items are repaired by the upgrade itself. (reported by Chris59)
The same leftover shape affected every type without a Landscape/Portrait control of its own, and the mirror case too: turning a Reels item back into a video kept the tall shape. Both are fixed for all future conversions. Videos converted before 1.5.4.1 that still show tall are fixed by opening them, choosing Landscape and saving once; they are not changed automatically because a stored 9:16 shape on a video cannot be told apart from a genuinely vertical clip.
In the add and edit dialog the Landscape/Portrait switch no longer sticks to the previous type's setting after you change the type.
No table, column or setting changes. Upload the files and run the add-on upgrade as usual.
Prizma 1.5.4 — watermark settings could not be saved, album layout switcher, and a broad privacy and reliability pass
Fixed — reported by customers
The "Prizma: Uploads and files" options page could not be saved once a watermark had been uploaded: every save returned "Oops! We ran into some problems" with nothing in the server error log. The watermark setting stored the mark's full internal path (data://prizma/watermark/mark-….webp) in a visible field, so that string was posted with every save, and web application firewalls (ModSecurity / OWASP rules, common on LiteSpeed) reject request bodies containing a data:// prefix as a code-execution signature — the request never reached PHP. The setting now stores only the file name, so nothing of that shape is ever posted. Existing installations are migrated during the upgrade; there is no need to re-upload the watermark. (Chris59)
Uploading a new watermark now really removes the previous mark file instead of leaving it behind in the data folder.
New
Album pages now have the same layout switcher as category pages: Uniform, Compact, Vertical, Sheet, Flow, Board and List, honouring the layouts you enabled in Options and the "View memory" setting, remembered per album. Showcase is deliberately not offered on albums because it builds its hero and strips from a category or type scope and would show content from outside the album. An album that contains only one media type now opens with that type's default layout from Options ("Default view per media type"), so an album of photos opens the way the Image type page does; mixed albums keep opening in Uniform. (Chris59)
Fixed — privacy
The film strip and the position counter under the viewer could show media the visitor is not allowed to see. For media with no category and no album, the scope was "every item of the same type", with no album-privacy or category filter, so titles, thumbnails and links of items in private, members-only and unlisted albums, and in categories the visitor cannot view, appeared in the strip, and the counter included them. The scope is now the item's own pool (no category, no album, same type), and category scopes filter album privacy as well.
Album pages rendered their media cards without checking the Prizma "view" permission, so a group with that permission removed could still open an album link and see cards, thumbnails and full-size attachment URLs. Album pages now filter the same way category and collection pages already did, and "Add all to collection" on an album does too.
Media in unlisted albums was still discoverable through tag pages, comment search results, and the news feed / members' latest activity, even though media search already excluded it. All discovery surfaces now share a single rule, so an unlisted album is reachable by direct link only, as documented.
The person-tag box resolved e-mail addresses to accounts, which turned an upload-permission endpoint into a way to test whether an e-mail address belongs to a member and learn the username. It now matches on username only. Changing a media owner does the same.
Members could move media into categories they are allowed to see but not allowed to add to, through single edit, bulk edit and bulk move; bulk edit accepted any category id at all. All three now require the add permission on the destination, and the category pickers only list categories you can actually add to.
The attachment endpoint accepted uploads of Prizma media attachments from any logged-in member, including members with no Prizma permissions. It now applies the same check as the add-media wizard.
The "Detect" button on the add-media screen made outbound requests to the linked provider for any logged-in member, regardless of upload rights, and had no flood control. It now requires the same permission as the wizard and is flood-checked.
Fixed — interface
Translations in languages that use an apostrophe (French and Italian among the shipped packs) broke the JavaScript phrase block on every Prizma page, so button labels and messages fell back to raw keys. Phrases are now emitted with JSON-safe escaping.
Person tags never appeared and could not be added when the gallery opens media in an overlay, which is the default. The script is now bound the way XenForo binds handlers to inserted content.
Keyboard navigation kept firing after the media overlay was closed, and each prev/next step in the overlay left another set of handlers behind, which made the slideshow Space and Escape keys respond several times over. Handlers are now torn down properly, and a stale handler stops responding.
Closing the add-media dialog without publishing left the uploaded file on the server and attached it to the next media published from that dialog; the dialog could also stay in bulk mode, so a following single upload was published without the details entered for it. Both are reset now.
If a bulk publish failed (server error, timeout), the publish button stayed disabled and the progress bar frozen; the dialog now recovers.
The reactions list overlay showed a raw phrase key as its title.
The breadcrumb showed a hard-coded "Prizma" next to the navigation entry, so a board that renamed the gallery saw the old name and a duplicated crumb. The crumb now comes from the navigation entry alone.
Rotate and "Use as album cover" could be submitted twice with a fast double click, rotating 180 degrees or writing the cover twice.
Two Turkish strings shipped in the music bar and one in the bulk cover queue; all are translated now.
No table or column changes. The upgrade does rewrite one setting (the watermark file reference), so run the add-on upgrade after uploading the files rather than only replacing them.
Prizma 1.5.3 — fixes for 1.5.2 (licence verification, portrait watermark, upload size picker)
Fixed — reported by customers
"Verify my licence" crashed with Undefined constant SODIUM_CRYPTO_SIGN_PUBLICKEYBYTES on servers without the PHP sodium extension. The 1.4.6 fix had been lost when 1.5.0 regenerated the licence client from a shared template; the fix now lives in that template and a release check runs the client on a PHP process without sodium before any package is built.
Watermark seemed missing on portrait photos in the media viewer while thumbnails showed it: the viewer stage clipped a strip off the top and bottom of tall images, and the bottom-right watermark sat in the hidden strip. Tall images are now bound to the stage's inner height.
Upload size picker (Original / 2560 / 1600 / 1024 px) could not be clicked: the pills sat underneath the invisible file-chooser overlay of the drop zone. They now work with mouse and touch, and "Original" no longer resizes in the browser at all (it keeps the board's own limit), so camera data is preserved as the hint says.
Fixed — watermark
Rotating a watermarked image rotated the logo with it (sideways logo in the wrong corner). The clean original is now rotated and the watermark re-applied.
Bulk "Add watermark" / "Remove watermark" refused the whole selection with "no permission" if a single item did not apply (a video, an exempt member's photo, an unstamped image). Such items are now skipped.
Uploading a JPG as "Panoramic" and switching it to "Image" afterwards bypassed the watermark. The switch now stamps the image.
GIF and other unsupported uploads left an unused full-size copy of the original on disk. The copy is only kept when a watermark is actually applied, and it is removed when the file is deleted.
Fixed — licence page
Saving the licence page with an empty key no longer deletes the stored key.
Re-saving the same key keeps the current verdict instead of showing "not verified yet" until the server answers.
A revoked or unknown key no longer turns back into "stale" (warning-only) after 37 days without contact.
The "What Prizma sends" list now includes the per-request nonce.
The weekly check no longer skips every other week because of a timing overlap with the 7-day interval.
Signature verification never throws on a malformed server reply.
Other
Template version stamps corrected: since 1.0 many templates had been changed without their version stamp moving, so customised copies were never flagged as outdated. All templates now carry the version in which they last changed. If you have customised Prizma templates in your style, expect the control panel to list them under "Outdated templates" once after this upgrade; review and merge them as usual.
The album-privacy lookup that runs on every gallery page for logged-in members, and the uninstall confirmation page, now tolerate a database that has not been upgraded yet (files copied, upgrade not run yet) instead of failing with a server error.
No database changes compared with 1.5.2 — upload the files and run the add-on upgrade as usual (coming from 1.4.x, the upgrade also applies the 1.5.0–1.5.2 schema changes).
Two menu items on the media page, left and right, for anyone who can already edit that media — its owner, and moderators. No new permission to configure.
Rotating also regenerates the thumbnails and refreshes the copy sitting in visitors' browsers, so the new orientation appears straight away instead of after a hard refresh. That second part is easy to get wrong and is the reason "rotate" features often look like they do nothing.
It re-encodes the file, so the camera data (EXIF) is kept on the media page but no longer travels inside the downloaded file, and each rotation costs a little quality.
Offered for JPEG, PNG and WebP. Not offered — the button simply is not shown — for GIFs (a rotated GIF would be flattened to a single frame on GD servers, and there is no reliable way to tell an animated one from a static one first), for older BMP/AVIF uploads the image drivers cannot re-encode, for images whose file is shared with another add-on's content (imported galleries do this, and rotating here would change it there too), and for images above XenForo's image resize ceiling.
Choose an upload size
A picker on the upload screen: Original, 2560, 1600 or 1024 pixels.
JPEG and PNG are resized in the member's own browser before anything is sent, so the upload is faster as well as smaller. GIF and WebP cannot be re-encoded in the browser and are sent unchanged.
Any rung at or above your Maximum image dimension setting is hidden, and a member's choice can only ever make an image smaller than that setting — never larger.
Original is preselected on purpose: resizing re-encodes the photo and drops its camera data. The picker says so.
The picker is on after upgrading, with Original preselected, so nothing changes unless a member picks a smaller rung. Turn it off in Options → Prizma → Upload.
Watermark
Stamp your logo onto images as members upload them, or onto media you already have. Upload the logo and preview it in ACP → Prizma → Watermark; the on/off switch, position, size and opacity live in Options → Prizma → Upload.
The original file is always kept. Removing a watermark restores the exact bytes of the stored file as it was before the mark went on, and re-stamping never degrades the picture, because the stamp is always composited from that clean copy rather than from an already-stamped one.
Position, size and opacity are settings, not fixed values — nine positions, size as a share of the image width, opacity from faint to solid.
A preview button renders your watermark onto a sample image using your own server's image library, over a light-to-dark gradient. Use it before switching the feature on: how a semi-transparent mark blends is decided by that library, and the two common ones composite with different primitives. I would rather show you the result on your own machine than promise you one.
Add watermark and Remove watermark are bulk actions from the gallery, so existing media can be done in batches you pick rather than all at once. Removing requires moderator rights over the media — a member cannot strip the site's mark off their own upload.
A permission, Upload without the site watermark, exempts a user group, both at upload time and when media is stamped in bulk.
Left unstamped rather than failing: GIFs, images that share a file with another add-on's content, and images above the image resize ceiling.
And the honest limit: a watermark stops casual reposting and nothing more. A screenshot or a crop defeats it.
Languages
Dutch (Nederlands) is now bundled and complete.
That makes eleven languages alongside English, each of them complete at 755 of 755 phrases. Everything new in this release was translated into all eleven rather than left in English.
When you import a language pack, XenForo finishes by rebuilding the compiled text, and the control panel runs that for you straight after the import with a progress bar. If it is ever interrupted, the Translations screen shows a pending notice.
Upgrade note
This release adds one database column and changes several templates that shipped earlier. If you have customised Prizma's templates, XenForo will flag the changed ones as outdated — re-merge them, or you will miss the new controls on those screens.
This release finishes albums, and adds a new idea next to them. Most of it comes from one detailed post by @smallwheels, who asked five specific questions about how albums behave. All five are answered here.
Albums
Pick your own cover — and it stays picked. The cover used to be whatever the newest upload happened to be, with no way to say otherwise. You can now choose any item in the album, and the next upload no longer takes your choice away. If the item you pinned is later hidden by a moderator, your choice is remembered rather than discarded, and it comes back when the item does. Automatic (newest item) is still there and still the default.
Or upload a cover that isn't in the album at all — a title card, or a cover for an album you have created but not yet filled.
Arrange the media in the order you want. Drag the cards, or focus one and use the arrow keys, then save. The album page, the viewer's filmstrip and the "3 / 12" position counter all follow the order you set, so nothing contradicts itself. The arrange screen holds up to 500 items at a time.
Or set a default order instead of arranging by hand: newest first, oldest first, or by title.
Shared albums. Invite other members to an album and they can upload into it — an event several people photographed, for example. What they upload stays theirs: reactions, reports and moderation all point at the real author, and a contributor can only remove their own media (moderators aside, as everywhere else). It is an invite list rather than a group permission; there is no "any member may upload here" mode yet.
Add media you have already uploaded to an album, without uploading it again. The picker lists your own media. Note that this moves the item — an album is where a piece of media lives, so it leaves whatever album or category it was in before.
Collections
A collection gathers media that already exists in your gallery. Nothing is uploaded twice and nothing moves: the same photo can sit in as many collections as you like while still living in its one album or category.
Fill one however suits you — add an item from its own page, add a batch from the gallery with inline moderation, or push an entire album into a collection in one step.
Each collection has its own cover and privacy, and the items in it can be arranged by hand.
Collection pages never leak. Whatever goes into a collection, every viewer only ever sees the items they were already allowed to see — a public collection cannot expose media from a private album, or from a category they cannot open.
Collections are curated by hand in this release. Collections that fill themselves from rules you set are the 1.7.0 item on the roadmap.
A new privacy option
Unlisted, for albums and collections: anyone with the link can open it, but it never appears in listings, in anyone else's pages, in your sitemap, in on-site search or in search engines. (Gallery moderators still see it in listings, as they do everything else.)
Moving from XenForo Media Gallery
Shared albums now come across intact. XFMG's per-album share lists become Prizma contributors, so an album several people could upload to keeps working the same way after the import. XFMG's "any member may upload" mode has no equivalent yet; those import as normal albums.
Album categories are respected. An album that lived in an XFMG album category is imported according to that category's guest visibility — publicly visible categories become public albums, permission-restricted ones become private albums. The import never makes an album more visible than it was.
Renaming the gallery
The page title now follows the Navigation bar title option, so renaming the gallery renames it everywhere instead of leaving "Prizma" in the browser tab. Thanks to Cam for reporting it.
Fixes
A panoramic item with no playable file drew an empty placeholder icon. It was using a Font Awesome 6 name on a Font Awesome 5 board, so there was simply nothing to draw.
On narrow windows and on phones the gallery could be dragged about ten pixels sideways. A background layer behind the sidebar was reaching past the edge of the page.
A collection cover could show a thumbnail from a restricted category. Covers now pass the same permission check as the items in the grid.
Unlisted album media could be found through on-site search by people who were never given the link. Owners, contributors and moderators still find their own.
Upgrading is more forgiving. If the add-on's files are in place before its database changes have run — which is how XenForo's own installer sequences things — media pages now degrade quietly instead of erroring.
Upgrade note
This release changes 8 templates that shipped in earlier versions: erkan_prizma_album_edit, _album_list, _album_view, _icons, _media_add, _media_view, _rail and prizma_adapter.less. If you have customised any of them, XenForo will flag them as outdated — re-merge them, or you will miss the new controls on those screens.
Five releases have gone out since 1.4.5, and almost all of them came from customer reports. Here is everything in one place.
Licence validation on servers without Sodium (1.4.6)
Validating a licence failed outright on hosts with the sodium PHP extension switched off, which meant the add-on could not be activated at all on those servers. Prizma now ships a pure-PHP fallback (paragonie/sodium_compat, ISC licensed) that loads only when the extension is missing. Nothing changes where it is already present.
Bulk upload straight into an album (1.4.7)
The bulk screen now has an album selector. Dropping two or more files at once only offered a category, so filling an album meant uploading one file at a time. Album (for all) follows the same rule as the single-file flow: media placed in an album carries no category, the album is its home.
After a bulk upload into an album you land on the album page rather than the gallery — gallery listings deliberately leave album media out, so the old destination made a successful upload look like nothing had happened.
And the window closes itself when the upload finishes (1.4.8). Everything uploaded correctly before, but the browser was never told to move on, so the dialog sat there and had to be closed by hand.
Music covers (1.4.7, 1.4.9, 1.4.10)
The cover is read from the file's own ID3 tag. Upload an MP3 carrying embedded artwork and Prizma attaches it as the cover automatically, along with the artist and album names. Your own choices always win: a cover you uploaded is never replaced, and an artist or album you typed is never overwritten — the tag only fills what is empty. The tag reader is our own code, so no GPL library enters the product, and it reads only the beginning of the file.
A cover that cannot be loaded no longer leaves the player empty. If the full-size image could not be fetched, the player hid it without a trace — no broken image, no message, nothing in any log — and all you saw was a plain gradient, while the same artwork kept showing correctly on the card. The stage now falls back to the card image.
The stage takes its shape from the picture it is actually showing, so a wide cover no longer sits letterboxed in a square box.
Artist and album keep their values when you edit a track (and a book's author, ISBN and year). Those boxes came up empty every time, so it looked as though the information had been thrown away — it never was, but there was no way to correct a typo without retyping the field. Emptying a box now clears the value, which was previously impossible.
YouTube /live/ links (1.4.7)
The link YouTube's share button gives you after a stream ends now works. Finished streams are shared as youtube.com/live/VIDEOID, a form the link parser did not know. The item was still created — title and thumbnail arrived through oEmbed — but the player had no video to load.
Items you already added are repaired by the upgrade, so there is nothing to delete and re-add.
Media feeds: channel addresses now just work (1.4.9)
A YouTube "@Name" address is accepted. YouTube's share button hands out youtube.com/@Name, and that address contains no channel ID anywhere — so a feed added that way downloaded the channel's web page and tried to read it as a feed. The feed looked installed and the counter stayed at 0. Prizma now looks the channel up itself. A bare channel handle works too, as do the older /c/ and /user/ addresses.
Still no API key. The channel page publishes its own feed address; Prizma reads it once and remembers it.
Existing feeds repair their own address on the first check after the update.
"Import now" works. The button was sending the wrong kind of request and always answered "This action is available via POST only" — it had never worked.
A feed that cannot be read now says what is wrong in plain language instead of quoting the XML parser.
Video conversion: safer on small disks (1.4.8)
A conversion no longer starts when the server is short of temporary space. Converting a video needs roughly twice that video's size free locally, and running out does not just fail the conversion — a full disk breaks uploads, sessions and logs for the whole site. Prizma checks first and, if there is not enough room, leaves the video in the queue with the reason recorded and tries again later. The attempt is not counted against the file.
Leftover working files are cleaned up. If the server killed a conversion mid-flight, its temporary file could stay behind — and for video that means a large file. Those leftovers are now named so they can be recognised, and are removed automatically a few hours later. Files belonging to a running conversion are never touched.
Swedish included (1.4.8)
Prizma now ships with a Swedish translation — complete, with Swedish date and number formatting. That brings the bundled languages to ten: English, German, Spanish, French, Italian, Portuguese (Brazil), Japanese, Korean, Chinese and Swedish. Install it from Admin → Prizma → Translations.
If you have already translated Prizma into Swedish yourself, nothing changes unless you choose to import this file over your own phrases.
Compatibility: XenForo 2.3.0+ · PHP 8.0+
Thank you to everyone who reported these — nearly every item above exists because somebody took the time to describe what they were seeing.
VK Video, VK Clips and Rutube — now actually working
1.4.0 listed VK and Rutube as supported sources, but pasting one of their links said "not recognised". This release fixes that properly and goes further than the original plan.
VK Video and Rutube links are accepted — every public URL form we could find: vkvideo.ru/video-…, vk.com/video-…, the vk.com/video?z=video-… form that VK's own share menu produces, and rutube.ru/video/… with or without tracking parameters.
VK Clips become Shorts. A vkvideo.ru/clip-… link is recognised as a vertical short and lands in the Shorts type, not Video. You can still switch the type by hand.
Title and cover come in automatically for VK — no API key, no VK app, no verification. VK's own embed player is used.
Rutube fills in more: title, cover, duration, description and the original publication date, all without any key. Rutube offers no developer keys to third parties, so there is nothing to configure and nothing to break.
The underlying bug also affected Kick, Flickr and Imgur links: the add-media dialog was rejecting anything the client-side quick check didn't know about, without ever asking the server. It now asks the server, so a source the server supports always works even if the quick check lags behind. (requested by @club_home)
Kick
Kick stream titles, covers and the live badge — new Kick Client ID and Kick Client Secret options under Prizma: Integrations and API keys, exactly like the existing Twitch pair. Create an app at kick.com/settings/developer and paste the two values. Leave them empty and Kick embeds keep playing as before, just without title, cover or badge.
The live badge is now refreshed for Kick embeds. It was never queried in earlier versions.
Kick does not allow embedding recordings or clips — there is no official player for them, and Prizma will not scrape. A kick.com/channel/videos/… or /clips/… link therefore shows the channel's live stream, and Prizma now says so in the dialog instead of silently swapping. The pasted link is kept as the item's source.
YouTube channel live streams
youtube.com/channel/UC…/live links now embed the channel's current live stream, no video id needed.
youtube.com/@handle/live links are resolved through the YouTube Data API using the key you may already have entered. Without a key, Prizma tells you why the link cannot be used and what to paste instead — it no longer just says "not recognised".
Layout and admin panel
Category sidebar on the right.Category navigation has a third choice, Sidebar (right rail), for themes that already carry a menu on the left. The left rail stays the default; nothing changes unless you switch. (requested by @Chris59 )
Codec warning is now a compact single-line strip over the player, and it no longer squeezes the video. On narrow screens it wraps as before.
The codec warning can be turned off — Viewer: unplayable-codec warning under Prizma: Viewer buttons. Detection and compatibility conversion are not affected by this switch.
Admin navigation: the "Prizma" block in the control panel now shows Options as a heading with all five settings pages under it, including Appearance and layout, which previously could only be reached through the main options list.
Fixes
The unplayable-codec strip was laid out as a sibling of the player and could shrink the video to a narrow column. It is now an overlay.
Category icon picker group names in the admin panel are now in English.
Upgrade notes
No schema changes. Two new options (Kick), one new option value (right rail), one new on/off switch (codec warning). All default to today's behaviour.
After upgrading, ACP → Prizma → Options → Integrations and API keys is where the Kick fields live. Existing YouTube and Twitch keys are untouched.
If you have VK or Rutube items that were added without a cover, run Rebuild caches → Refresh Prizma embed covers once — both sources are now included in that job.
Leaving Prizma — export to XenForo Media Gallery (XMFG)
A gallery is a long commitment, so this release makes the way out part of the product.
One command moves your gallery into XFMG. Categories, albums, media, comments, five-star ratings, tags, reactions and person tags are written into XFMG's own tables. Files are not copied — the new attachment row points at the same stored file, so moving a 200 GB gallery costs no extra disk space and takes no time proportional to your library size.
A dry run comes first, and it writes nothing. Before anything moves you get a per-item report: what transfers cleanly, what transfers but loses something, and what cannot go at all — each with the reason. The decisions are read from your XFMG settings rather than a hardcoded list: its extension lists, its title and description limits, and XenForo's own media-site definitions. Define a new media site in XenForo and the plan updates itself.
The losses are documented, not discovered afterwards. A schema document ships with the add-on: what maps to what, what is dropped, and why the things that cannot move cannot move. Books, for example, have no equivalent type in XFMG and no allowed extension there — so those items stay in Prizma and their files stay on disk, untouched.
Uninstalling cleans up after itself. Prizma's rows in shared tables — search index, moderator log, news feed, tags, reactions, bookmarks, alerts, content permissions — are removed on uninstall. Attachments are deliberately left alone, because deleting member files during an uninstall is not a decision an add-on should make for you. (requested by @CrazyChef )
Video that browsers cannot play
An honest warning — this part needs nothing installed..mp4 is the name of a container, not a codec. A file recorded on a recent phone or exported from an editor can be a perfectly valid .mp4 whose video track is HEVC/H.265, which most browsers refuse to decode. Everything looks correct server-side, so nothing warns anybody: the member uploads, the page loads, and the player is simply blank — no error, no explanation. Prizma now reads the container's real codec on upload and says so above the player, naming the codec. The warning is printed only when the answer is certain: if the container cannot be parsed, or holds a track Prizma does not recognise, it stays quiet. A wrong warning is worse than none, because it sends a member to delete a file that was fine.
Automatic conversion — new option, off by default, needs FFmpeg. With it on, a video browsers cannot play is converted to MP4/H.264 in the background and the player uses that copy. The member's file is never touched: Download, the XFMG export, codec detection and EXIF all keep reading the original. (There is exactly one exception and you have to switch it on yourself — see the notes below.)
Automatic cover frames for uploaded video. Until now a member who uploaded their own video was left with an empty placeholder, while embedded media got a cover from the provider. Prizma now grabs a frame from the first second. It works even on HEVC — so the file the browser cannot play still gets a cover, and the member at least sees what they uploaded.
You can see what is happening. While a conversion is in flight the media page says so instead of showing the codec warning; when it finishes the member gets a notification and both messages disappear. Admins get ACP → Prizma → Video conversions: every file considered, its state, the FFmpeg error if it failed, the output size, how long the encode took, and buttons to retry or clear a record.
Smaller changes
Two new maintenance jobs on the rebuild screen: one stamps each item with a pointer to its own uploaded file, one queues conversions for video uploaded before you enabled the feature.
All 9 bundled translations updated — 100% coverage (634 phrases).
Fixes
The download button could go missing. On images and panoramas the Download link was absent from the media page, because the player was not resolving a file for those two kinds of item. This affects 1.3.5 as well — upgrading fixes it, with nothing for you to run.
The admin icon picker now reads in English. The category icon picker listed its group headings in Turkish.
Things worth knowing
Conversion produces one compatibility copy. Multiple resolutions or quality levels are not part of this release.
Codec detection covers ISO containers (mp4, m4v, mov, m4a). MKV, AVI and WMV are deliberately out of scope — they do not play in browsers anyway, so a second parser would tell you nothing new.
Long videos are skipped, not half-converted. There are two independent limits. A video whose length is over 10 minutes by default is never attempted — it is listed on the conversion screen with the reason and left exactly as it is. Separately, an encode still running after 10 minutes of processing is stopped, so one pathological file cannot hold up the queue. Measured on a 4-core server with a 20-minute 1080p source: simple footage encoded in 306s, complex detailed footage in 604s, and 892s with threads restricted to 1 — which is why the shipped default is deliberately cautious. Raise the length limit if your server is quick and your videos are long; the conversion screen shows you when an encode was abandoned.
Books cannot move to XFMG. There is no book type there and the extensions are not in its allowed lists. Those items stay in Prizma and their files stay on disk.
A separate cover image and subtitle files do not move to XFMG either, because XFMG holds one file per item. The dry run tells you this per item rather than letting you find out afterwards.
Only if you turn it on:Delete the original after a successful transcode destroys the member's uploaded file permanently, and from then on Download and the export hand out the re-encoded copy. It is off by default and should stay off unless disk space genuinely forces your hand. The dry run flags every item affected by it.
Upgrade notes
Schema: two pointer columns on the media row plus one table for conversion bookkeeping. The upgrade fills the pointers in by itself with a background job — nothing for you to run.
Both features do nothing until you switch them on. With the FFmpeg path left empty, everything that depends on FFmpeg stays quietly off and Prizma behaves exactly as it does today. Shared hosting often has no ffmpeg; that is a supported configuration, not an error.
Nothing changes for existing media, existing covers or existing links.
On a large board the job queue can run for a while after an uninstall — reaction scores and permission rebuilds run for every user. That is XenForo's own housekeeping, not a stuck uninstall.
Swedish included (1.4.8)
