merge branch v2 (release 2.0.0-beta.28)

Author: marcantondahmen

CHANGELOG.md

@@ -1,8 +1,16 @@
 # Changelog
 
-## [v2.0.0-beta.27](https://github.com/marcantondahmen/automad/commit/3e26371c253034f7ca73d2fa470f1c75c0cb0a76)
+## [v2.0.0-beta.28](https://github.com/marcantondahmen/automad/commit/4ff284fe9dd5e38c014dfba0018bac5eac0e91d1)
 
-Sun, 12 Apr 2026 20:28:19 +0200
+Thu, 30 Apr 2026 10:23:59 +0200
+
+### Bugfixes
+
+- fix public access to the user-collection/create-first-user api route after the first user has been created ([4ff284fe](https://github.com/marcantondahmen/automad/commit/4ff284fe9dd5e38c014dfba0018bac5eac0e91d1))
+
+## [v2.0.0-beta.27](https://github.com/marcantondahmen/automad/commit/6e97e9d6a8e33380428ceed04b61bcb8109d6464)
+
+Sun, 12 Apr 2026 20:41:57 +0200
 
 ### New Features
 

automad/src/server/App.php

@@ -56,7 +56,7 @@
  * @license See LICENSE.md for license information
  */
 class App {
-	const VERSION = '2.0.0-beta.27';
+	const VERSION = '2.0.0-beta.28';
 
 	/**
 	 * Required PHP version.

automad/src/server/Controllers/API/UserCollectionController.php

@@ -36,6 +36,7 @@
 namespace Automad\Controllers\API;
 
 use Automad\API\Response;
+use Automad\App;
 use Automad\Core\Messenger;
 use Automad\Core\Request;
 use Automad\Core\Text;
@@ -57,6 +58,10 @@ class UserCollectionController {
 	 * @return Response the response object
 	 */
 	public static function createFirstUser(): Response {
+		if (is_readable(UserCollection::FILE_ACCOUNTS)) {
+			App::exit('Another user has been created already', '', 403);
+		}
+
 		$Response = new Response();
 
 		if (empty($_POST)) {

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "automad",
-  "version": "2.0.0-beta.27",
+  "version": "2.0.0-beta.28",
   "description": "Automad",
   "author": "Marc Anton Dahmen",
   "private": true,