Журнал изменений

Stage 1, batch 4 of docs/COMMENTS-REDESIGN-2026.md. The admin comment module no longer touches the comment table: every read and write it performed now goes through the Comment class, which leaves the class as the only place that knows how a comment is stored, permitted and counted.

Core changes:

1. Moderation write methods (core/classes/comment.php):

2. deleteComment() removes one comment and takes the target counter and the author points back when the removed row was published

   • the module and the target come from the stored row, never from the

request, so the stage 0 trust boundary holds for deletion too

• updateBody() stores the body a moderator typed, verbatim

  • the moderation form is not the author edit path and applies neither

checkEditRules() nor filterHtml() nor the edit window

• setStatus() takes the read-then-compare guard the moderation module always had

  • a comment already carrying the wanted status is answered as done

without writing, so a repeated click cannot count its target twice

• the frontend path inherits the guard and loses a double count it

never intended; the rendered fragment is unchanged

1. Moderation module (admin/modules/comments.php):

2. the module selector reads getModuleList(), the list and its count read getAdminList(), the edit form reads getComment()

3. the four write handlers call setStatus(), deleteComment() and updateBody(); no handler takes $db any more

4. the pager renders through getTplPagerView() from the total the list itself counted, replacing getTplPager() and its separate COUNT

   • the $where/$wcnt pair is gone, and with it the second, differently

spelled description of one list

• the rewritten list loop drops its snake_case names per .rules/global.md
• Trust boundary guard (tests/Unit/CommentTrustBoundaryTest.php):

• deleteComment() joined the methods asserted to read module and target from the stored row

• the numcom() assertion follows the $cid the new status guard needs

Benefits:

• the moderation list can no longer count one thing and show another
• a repeated approve or delete leaves counters and points untouched

• the admin panel gains prepared statements everywhere it had them by hand, and loses one hand-built subquery

Technical notes:

• no table or column changes; the current sort is untouched

• three measured behaviour changes, each a consequence of the move: an out-of-range page now clamps instead of answering "no information", &num=0 no longer builds "LIMIT -25, 25", and delete() redirects by the tab the request came from instead of by the deleted row's status

• parity measured over real HTTP with a signed-in administrator: 42 URLs in two rounds, 39 byte-identical in the module content region, the three others being the page clamp above; 16 write scenarios left identical rows, bodies, target counters, points and row count

Stage 1 batch 3 of docs/COMMENTS-REDESIGN-2026.md: adding, editing and moderating a comment no longer happen in the request handlers. The subsystem owns the rules, the permissions and the state changes, and the handlers read the request and render the answer, which is what lets stage 2 make the write transactional in one place instead of at three call sites.

Core changes:

1. Comment write path (core/classes/comment.php):

2. addComment(), updateComment() and setStatus() carry the frontend writes

   • the target mode, the author, the address and the moderation state are

resolved from the server context, never taken from the request

• checkAddRules() answers the single message the submit path shows,

checkEditRules() the list the edit path shows; both are merged into
checkRules() in stage 2, not here

• getLinkFlag(), getLastTime() and getLastId() carry the auto-link rule,

the flood window and the anchor id of a fresh row

• CommentStatus names the value written to the status column; the acomm

comparisons stay bare because CommentMode belongs to stage 2

• the counters still run through the global numcom(), and the target still resolves through the global getCommentMode(), as the batch table requires; batch 6 absorbs both

• Request handlers (core/user.php, core/system.php):

• addComment() shrank from 48 lines to 16, updateComment() from 43 to 22 and updateCommentStatus() from 15 to 7

• none of the three holds comment SQL any more; the alerts, the ajax textarea, filterContent(), ashowcom() and addAdminMail() stay with the handler

• Write parity checks (tests/):

• CommentWriteTest drives the class against the live rows of the installation inside a transaction that is always rolled back

  • all eight modules store the row they resolved, increment their own target

counter and award their own points slot

• an anonymous comment lands pending and moves neither
• every refusal answers the message the submit path answered
• the author edits inside the window and is refused after it; a visitor

edits and moderates nothing

• CommentTrustBoundaryTest follows the code it guards: the stage 0 contract is now read off the class, and the handlers are asserted to carry neither a request module nor comment SQL

Benefits:

• one description of what may be written, shared by the three routes
• the counter and the points slot of every module are measured, not assumed
• the write path is ready for the transaction and the reqkey of stage 2

Technical notes:

• no schema and no markup change; behaviour is preserved down to the falsy body test that keeps a body of "0" from being saved, and to the edit length rule that still measures the last word in bytes

• the six POSTs that reach the three routes answer byte for byte the same as before the move, with the comment count and the target counter unchanged

• comment-baseline verify stays OK on all eight modules
• the moderator paths need a browser session and are not covered by this batch

Stage 1 batch 2 of docs/COMMENTS-REDESIGN-2026.md: the render function no longer queries the comment table itself. It asks the subsystem for one page and assembles markup, which is what lets the later stages change storage and sorting in one place instead of at every call site.

Core changes:

1. Comment list rendering (core/system.php):

2. ashowcom() reads through $com->getList() instead of its own SQL

   • the count query, the page query and the author group join are gone
   • pagination, the visibility scope and the running comment number now come

from the class, so a count can no longer disagree with the page it counts

• the unreachable ADMIN_FILE read branch left with the read it built; the

admin render branches stay until the function itself is removed

• local names follow the naming rules of .rules/global.md

  • the running number $a became $numb, the checkbox flag $b became $mark

Benefits:

• 253 lines down to 186, and no direct comment SQL left in the render path
• one description of what a viewer may see, shared by the count and the page
• a broken comments.num setting falls back to 15 instead of dividing by zero

Technical notes:

• no schema, template or markup change; the rendered output is byte for byte the same

• verified against the pre-move file over 26 URLs in both sort directions: first, middle, last, out-of-range and zero pages, a target with no comments, a target spilling one row onto a second page, one holding exactly the page size, garbage and negative page parameters, and a missing target id

• comment-baseline verify stays OK on all eight modules

• the signed-in and moderator views need a browser session and are not covered by this batch

Stage 1, batch 1 of docs/COMMENTS-REDESIGN-2026.md opens the move of the comment engine out of the 253-line ashowcom() monolith into one class. This batch adds the class and its reads only; nothing calls them yet, so the running system is untouched and every later batch migrates call sites against a surface already proven equal to the queries it replaces.

Core changes:

1. Comment subsystem (core/classes/comment.php):

2. New class owning every read of the comment table

   • getCount() and getList() serve the frontend list with its pagination
   • getAdminList() serves the moderation list across state, module and the five search fields
   • getComment(), getUserList() and getModuleList() serve the admin edit form, the profile activity feed and the module selector
3. CommentStatus and CommentMode enums replace the bare 0/1/2 literals of status and acomm
4. getScope() and getAdminScope() build a visibility scope once and getTotal() counts against that same source, so a list and its count cannot describe different rows
5. getAuthors() resolves the author records of one page in a single round trip, keeping the group-join precedence the current rendering relies on
6. getPager() holds the page arithmetic the frontend and the moderation list currently spell out twice
7. Request wiring (core/system.php):
8. The class loads beside the other services and is constructed after the parser as $com
9. The constructor takes $conf as a third argument because no class in core/classes reaches for a global and the reads need the comments section for their pagination
10. Read parity harness (tests/Support/contract_probe.php, tests/Unit/CommentReadTest.php):
11. New commentread probe mode puts every legacy statement beside the method replacing it, against the live rows of the installation
12. 8 test cases cover the count, the first and last list page, the author record, the activity feed, the module list, a single read, a missing id and all five moderation filters
13. The list case was proven to fail by flipping the sort direction, so the parity claim is measured rather than asserted

Benefits:

• Byte parity of the rendered comment list becomes checkable per batch instead of at the end of a twenty-site diff
• One visibility predicate per list removes the class of defect the hand-built where/count pair of the admin module still carries
• The read surface is settled before any call site moves, so the migration batches change callers only

Technical notes:

• No table, column or index changes; no behaviour change, because nothing calls the class yet
• Public reads select status = 1 rather than status != 0 per the design query rule; the column holds 0 and 1 only across all 7357 rows and the probe proves the results identical
• The author search keeps two placeholders for one term because emulated prepares are off and a native statement refuses a repeated named placeholder
• getUserList() shares its name with the unrelated global function at core/system.php:4792, which no stage removes; a method and a function of one name coexist without ambiguity

Stage 1 batch 5 of docs/MAIL-2026.md gives the three transports a configuration and an administrator a way to prove it works before real mail depends on it. The delivery half of the subsystem is now reachable from the panel rather than from a hand-written file, and the shipped defaults keep every installation delivering through PHP mail() until someone chooses otherwise. The 26 call sites still use addMail(), so nothing an installation sends has changed.

Core changes:

1. Configuration (config/mail.php):

2. Ship every key the plan lists at its documented default, transport php, the site-derived and SMTP credential fields empty

   • keys are written in the order setConfigFile() writes them, since it sorts

before export and a shipped file in reading order would be rewritten by the
first save

• the queue keys ship complete but have no control yet: a row for batch or

keep would govern machinery that arrives in stage 2

1. Mail tab (admin/modules/config.php):

2. getMailPanel() builds the _MAILOPT tab: transport, sender identity, SMTP, the Sendmail path, the test send, then the existing mtemp

   • getMailRow() carries the transport a row belongs to, so the value hook can

hide it for every other one

• the password field renders empty whatever is stored, and an empty

submission keeps the stored value through the setConfigFile() merge

• a missing openssl or a disabled proc_open is reported beside the control it

disables; neither control is removed, because a disabled field posts nothing
and the next save would silently reset it

• save() writes config/mail.php over the stored section, so the queue keys and an unchanged password survive

  • transport and encryption accept only their listed values
  • a sender or Reply-To address that fails validation refuses the whole save

before any file is written, rather than being stored and silently stopping
delivery

• mailtest() is the fourth operation: POST, checkSiteToken(), the recipient defaults to adminmail, and the answer is either success or the transport's own error string

  • the field carrying the password is dropped from the request first, because

Logger records every posted field with a failure entry and the button
submits the shared config form

1. Row visibility (plugins/system/slaed.js):

2. setFieldShows() shows a row only for named values of another control, beside the tab-index hook it complements and in the same style

   • a row is written visible and is only ever hidden, so the settings stay

reachable when the script is not

1. Locales (admin/lang/*.php):

2. Twenty-one constants in all six languages, reusing _USER, _PASSWORD, _NONE, _SEND and _ERROR rather than adding scoped duplicates

3. Tests and plan (tests/Unit/MailConfigTest.php, docs/MAIL-2026.md):

4. Five cases hold the shipped file to its key set, its defaults, its key order and its string types, so a fresh install and an upgrade cannot diverge

5. Record the batch in Progress with its decisions, the defect found and fixed inside it and the blockers left open

Benefits:

• Delivery can be pointed at a relay, a binary or PHP mail() from the panel, and the choice is proved by a one-click test send instead of by the next password reset that fails

• Configuration and its writability notice live where every other config section already lives, with no new module, no new tab and no new token mechanism

• The value-driven hook is general: any row can now depend on the value of another field, which the tab-index hook could not express

Technical notes:

• The test send reads the stored configuration, so settings are saved and then tested; the row says so

• An empty password field cannot clear a stored password, which is what makes it safe to render the field empty

• Header-bound values are stored as typed and sanitised where they reach a header, since the input text filter would corrupt a sender name inside MIME

• Without JavaScript the config module shows its first tab only, which is how every tab on that screen already behaved