Журнал изменений

Официальный сайт SLAED CMS

Журнал изменений

Фильтр и поиск

Всего: 1159 Доступных коммитов | Отфильтровано: 1159 Коммиты | Страница: 1 / 116
Сегодня (07.09.2026)
Feature: the cabinet becomes one standard, the settings page reaches the bridge, and the rig learns to walk two modes at once
Автор: Eduard Laas | Дата: 13:40 07.09.2026

The settings page is brought to the bridge variant of the stand with the mechanics the theme already carries, and what the page taught is folded back into the cabinet: one box, one head, one form row and one file window for every page under the account. The screenshot rig, which was the slowest gate of the work, walks its two modes side by side and stops waiting for a page that could never settle.

Core changes:

  1. Settings page (modules/account/index.php, partials/account-settings.html):
  2. the lamps, the rail, the tiles, the save bar and the gallery follow set-10-bridge

    • the rail marks stand at even fractions of the width, the first flush left and
the last flush right, and the road walked is a width the script writes
  • the lamps paint their figure in the tone of a category, warning through the new
--sl-warning-strong step, because the base step fails AA for large bold type
  • a preset picked in the gallery saves itself over htmx through setavatar() and the toast confirms it; the form bar does not rise for a control that saved itself

  • the journal tile and the profile ring are gone, the password tile takes the width
  • getFieldsInRows() gives the extra fields as data, and getTplFieldsIn() is that list folded into form rows for its five other callers

  • sixteen constants came and six went again: the hints under the questions and the heads of the tiles stay, the short rail captions did not

  • Form rows (theme.css, base.css):
  • the caption column of a form is one column per form: .sl-form and .sl-opt-tile lay fit-content(--sl-form-label-width) and minmax(0, 1fr), and a row standing directly in them takes subgrid, so the captions line up on one edge and the fields on another; a browser without subgrid keeps the quarter

  • a row holding an editor folds on the mount point and no longer only after the script arrives, and a hint asks for no width of its own, so the caption column is not sized by either for the moments the parser stands on the editor scripts

  • the track of an editor row has a floor of zero: a bare 1fr could not shrink below the toolbar and made every page with a comment form scroll sideways at 768

  • Cabinet and profile (partials/account-home.html, account-profile.html, account-profile-feed.html, fragments/account-nav.html, theme.css):

  • the panel of the cabinet and of the profile is the settings tile, and every heading is the tile head with the chip of tone, joined by selector list

  • the inner pages carry the full-size cabinet tiles, each with its subtitle
  • the activity feed's tabs wear the chip, the cabinet rows share the entry's metrics, and the hub of the profile is a scrolling feed of entries

  • the spinning indicator freezes with any hovered feed, and the scroll walks translateY(-50%) of the doubled feed instead of a distance measured before the avatars had loaded

  • the card and the deck wear the tile's box, the RSS field is the field, the empty badge is hidden, and a button carries a gap between its icon and its label

  • Layout (layouts/app.html, home.html, theme.css):
  • the layout names the sides it rendered on #container as sl-has-left and sl-has-right, and the CSS reads them instead of :has(#sidebar): the aside stands after the content, and a first frame painted before the parser reached it laid the content over the full width and then pulled it back

  • File manager window (partials/file-manager.html in both themes):
  • the window opened for a form field carries data-sl-window like the one opened from an editor: it drags, expands and stacks the same way; the two copies stay identical

  • Screenshot rig (tools/ui-shots.mjs, tools/ui-shots.json, docs/TEMPLATES.md):
  • the two modes of the manifest walk side by side in contexts of their own, a full capture takes about five minutes instead of ten

  • --only takes a comma list, so a change is re-compared on the pages it touched
  • the ticking counter of a live box is masked; it was why the article page never settled

  • Stand (demo/fav-01..04, demo/assets/demo.js, demo/README.md):
  • a fourth series proposes four faces for the favourites page out of the parts the cabinet already has: shelves, tabs, bays and the table told what it lacked

  • Node plan (docs/node/*):
  • the working list and the review of the package, and the plan documents adjusted after the review

Benefits:

  • One box, one head and one form row across settings, cabinet and profile, and the two file windows become one

  • Every cabinet page arrives without a layout shift; measured zero on messages, settings and favourites

  • The rig costs half the wall clock and reports a page that moved instead of one that never settled

Technical notes:

  • Two tokens join the API: --sl-warning-strong and --sl-form-label-width; the template-written --sl-d-at, --sl-d-of and --sl-d-spy are registered under data and --sl-d-distance leaves it

  • tools/ui-contrast.json is regenerated from the walk after the palette changed
  • The constants _ACCOUNT_LOG, _ACCOUNT_FILLNOTE, _ACCOUNT_LINKED, _ACCOUNT_SIGNIN and _ACCOUNT_GALLERY are removed; a theme or a language file that named them will not find them

Вчера (06.09.2026)
Test: the upload route walk stops leaving a minted secret in the tree
Автор: Eduard Laas | Дата: 16:09 06.09.2026

The walk drops the compiled configuration between rows, and on a checkout that is what makes the server mint a new master secret and persist it into the tracked config/security.php. The walk now guards that file, and prevents the mint rather than only cleaning up after it.

Core changes:

  1. Guarding the shipped security file (tools/upload-route-check.php):
  2. setConfigGuard() takes a snapshot before the sessions are opened and gives the file back through register_shutdown_function(), so an interrupted run leaves nothing behind either

  3. the shipped secret is seeded with the live one for the length of the walk

    • a token is derived before the request that carries it, and that request is the
one that rebuilds and mints, so cleaning up afterwards cannot save the answer
  • measured: without the seed the isolated editor mode fails 21 rows
  • the merge is warmed by one request before the file goes back, because the walk leaves it deleted and the next visitor to the stand would otherwise mint the master minutes after the run reported a clean tree

  • one row asserts the restore and names the change in its detail; it never asserts the absence of a change, since both the seed and the mint are expected

Benefits:

  • A generated master secret can no longer reach a commit through this tool, which no gate in the tree would have caught

  • The editor and full modes are stable instead of depending on whether the shipped secret happened to be empty when the run started

Technical notes:

  • With no compiled configuration to read the live secret from there is nothing to seed with, and the walk then behaves as it did before

  • A process killed without running its shutdown handlers can still leave the seeded secret in place

Docs: the node plan stops being a frame and becomes a decided one
Автор: Eduard Laas | Дата: 16:08 06.09.2026

Every document of the node design moves from a frame to an approved state. The status table of the directory turns from a list of open questions into a list with nothing left blocking approval, and the fifteen documents behind it are filled in to match.

Core changes:

  1. Directory status (docs/node/README.md):
  2. the plan reads "planning finished, implementation not started"
  3. every one of the fifteen documents is marked approved, with no blocker left
  4. document 12 is renamed to the boundary of the old data rather than its transfer
  5. Contracts filled in:
  6. 05-core-api.md: the public contracts and their signatures
  7. 06-types.md: the type, field and capability model
  8. 03-database.md: the extension tables and the remaining lifecycle transitions
  9. 02-naming.md: the names of the remaining classes, methods and lang constants
  10. 13-testing.md: what each layer is held by
  11. 15-decisions.md: the log grows with the decisions the rest of the pass took
  12. The remaining documents follow the same pass:
  13. goals, code structure, routing, rendering, integrations, extensions, security and performance, migration boundary and roadmap

Benefits:

  • The plan can be executed without reopening the questions it was written to close
  • The decision log carries why each answer was chosen, not only what it is

Technical notes:

  • Documentation only; no code of the subsystem exists yet
  • Written in Russian, as the rest of this directory is
Feature: a profile becomes a comment target of its own
Автор: Eduard Laas | Дата: 16:08 06.09.2026

Profile discussions come back as an ordinary comment target rather than a mechanism of their own: account joins the map the Comment class already drives, so writing, moderation, censoring and the points award reach a profile through the same path every other target uses.

Core changes:

  1. Comment targets (core/classes/comment.php):
  2. account enters the MODULES map with _users and the points slot 3
  3. the target is excluded from the denormalised counter, because _users carries no comments column of its own

    • setTargetCount() and addTargetCount() refuse it
    • the drift report skips it, so no repair is attempted on a column that is absent
  4. getTargetMode() answers for a profile on its own branch: the row must exist, and $conf['users']['prof'] closes it to anyone who is not signed in

  5. the site snapshot carries prof beside the censor settings
  6. Profile view (modules/account/index.php):
  7. view() renders the comment block for the profile it has just drawn
  8. Rating slots (core/system.php):
  9. the account rating reads the points slot 2 instead of 0
  10. Probes and tests (tests/):
  11. the comment write probe walks the new target beside the other eight
  12. both counter expectations answer zero for account, and the probe does not set acomm on a table that has no such column

Benefits:

  • One write path for every comment target: a profile discussion is moderated, censored and credited exactly as a news discussion is

  • No second counter to keep honest, because the profile target has none

Technical notes:

  • _users has no comments column and no acomm column; both are handled by excluding the target rather than by adding columns

  • Guest access to a profile discussion follows $conf['users']['prof']
Эта неделя (02.09.2026)
Feature: the file manager becomes the one door the system asks for a file
Автор: Eduard Laas | Дата: 21:40 02.09.2026

Take the file manager out of the editor plugin and make it the one way the whole system asks for a file. A form row no longer carries a bare file field: it carries a button that opens the same window an editor opens, and what was picked comes back as a chip. The storage of already uploaded files becomes reachable from every place a file is asked for instead of only from inside an editor.

Core changes:

  1. Upload places (core/system.php):
  2. getUploadPlaceRule() resolves one rule for one place, named with a dot

    • the grammar ^[a-z0-9_]+\.[a-z0-9_]+$ lives here and in no caller
    • three branches: <mod>.attach, files.dist, users.avatar
    • answers every field the routes read, not only the limits
    • the upload right is two settings ANDed: upload && add, upload && addquest
    • users.avatar is a member place: guestupload and guestfiles are hard zero
  3. mod is the module a place is moderated as, never the first segment: users.avatar answers account, and no caller splits the place string

  4. ops names which of the four routes a place permits; a field place permits editorFiles alone, so a form place can never reach an upload or a deletion

  5. getUploadFileArea() replaces getEditorFileArea() and is built from the rule
  6. getUploadTakenFile() resolves one client path for both form handlers
  7. getUploadPlaceView() answers the module, the rights and the extension list
  8. Place routing (index.php, plugins/editors/toastui/driver.php):
  9. the go=4 entry guard reads place, raw: filterVar() empties a string with a dot
  10. getEditorRouteRule() gates on ops beside its three existing guards
  11. every endpoint URL carries place instead of mod, built server side, so both ends of the contract migrate in one step and no shim is needed

  12. The window becomes the theme's (core/helpers.php, templates/{lite,admin}):
  13. getFileManagerWindow() builds it from the place rule, in either mode
  14. getFileManagerField() builds the row: the button, the chip and the three hidden carriers the submit takes to the handler

  15. partials/editor-toastui-files.html becomes partials/file-manager.html
  16. the window rules move from assets/editors/toastui/skin.css into theme.css under the new root sl-fm-win; the administrative browser owns the bare sl-fm-* names, so the window stays scoped rather than unscoped

  17. the shot panel rules move with them: getWindowShot() is already system-wide
  18. fragments/file-input.html is deleted; fragments/file-field.html replaces it
  19. The runtime leaves the plugin (plugins/system/filemanager.js):
  20. editor-upload.js becomes plugins/system/filemanager.js and is delivered by getFileManagerWindow() once per request, so a page with no editor behaves

  21. addField(id, node, opt) is the second entry: a box instead of an editor
  22. the eleven draw templates the runtime needs move to file-manager-templates.html; the four emoji ones stay with the driver

  23. SlaedToastUi keeps tags, emoji and the word lists; editor-tags.js calls the new namespace explicitly and no alias is created

  24. The two callers (modules/files/index.php, modules/account/index.php):
  25. both read the three outcomes in a fixed defensive order and resolve a stored path through getUploadTakenFile(), which refuses it unless the owner matches

  26. the catalogue passes getEditorFileOwner() and never the integer user id, which used to turn every guest token into zero and match one guest against another

  27. the avatar keeps plan 2's arbitration: a preset beats anything the window produced, and an avatar failure does not roll back the profile

  28. Tooling and tests:
  29. tools/upload-route-check.php walks the new place routes; its merge deletion is verified rather than assumed, and the master secret is re-read per call while the last non-empty value is held

  30. tools/ui-contract.php follows the rules into the theme

Benefits:

  • One door: adding a file is one gesture everywhere, and stored files are reachable from every place a file is asked for

  • One rule per place instead of a rule assembled by hand in each module, so a limit and a right are answered in one file and read the same before and after

  • The server refuses what the interface does not draw: an interface that draws no button is not a guard, and the ops gate is enforced in one place

  • Guest uploads are isolated per session instead of sharing the owner segment 0

Technical notes:

  • Breaking: the editor endpoints take place=<mod>.<slot> and no longer accept mod=<mod>; a dot cannot travel through filterVar(), which is why the parameter is new rather than widened. Both ends are built server side and migrate together

  • Breaking: _FILE_USER, _AVATAR_USER and _EDITOR_ADD are removed from lang. The first two lost their callers with the rows they captioned; the third was a scoped duplicate of the global _ADD, identical in all six locales

  • Breaking: templates/{lite,admin}/fragments/file-input.html is deleted. A theme or module calling it must move to file-field.html through getFileManagerField()

  • sl-toastui-upload survives as a second class on the window: it cures the fixed button height the vendor root imposes and belongs where the vendor is

  • data-editor is deliberately not renamed: it is read by five producers and a template-only rename would break the editor silently

  • Files stored before this change keep the owner segment 0 and are listed to nobody; they are not migrated, which is the correct failure direction

29.08.2026
Docs: the upload plan stops sending its reader after two deleted documents
Автор: Eduard Laas | Дата: 17:12 29.08.2026

The first two plans of the queue are finished and each deleted itself with its last batch, but the third still named both by path. A reader following the reading order would open the plan, go looking for its two prerequisites and find neither.

Core changes:

  1. Queue section (docs/UPLOAD-FIELD-2026.md):
  2. the two finished plans are named without a path, and said to be deleted
  3. what outlived each of them is named instead

    • plan 1: the Form Row Contract of docs/TEMPLATES.md and getFieldIds()
    • plan 2: the Settings Page Contract of the same file
    • the two live defects plan 2 left open, and where each is now recorded
  4. the handover section below is flagged as the only surviving copy of what plan 2 hands over

Benefits:

  • The reading order resolves; every docs path this plan names now exists
  • A reader is not left guessing whether a missing prerequisite means missing work

Technical notes:

  • Documentation only; no batch, no code and no behaviour is changed
  • The dead docs/FILE-MANAGER-CONCEPT-2026.md citation is left alone: the plan already knows it is dead and batch 3 is told to replace it

Docs: the label crawl says why it is already red
Автор: Eduard Laas | Дата: 17:06 29.08.2026

The crawl fails on this stand before any edit, and the record of that was deleted with the plan that measured it. A future reader would meet a red gate and look for the cause in their own work.

Core changes:

  1. Label crawl (docs/TEMPLATES.md):
  2. the failure is coverage, not violations: 366 stored against 365 rendered

    • three route variants no longer answer, two of them record-bound
    • proved by stashing a whole batch and running the same audit on the committed tree
  3. and a warning not to --store over it, which would adopt a regression as the floor

Benefits:

  • A red gate that is not yours is recognisable in a minute instead of an hour

Technical notes:

  • Documentation only; the loss itself is untouched and still wants an investigation
Docs: three findings outlive the plan that found them
Автор: Eduard Laas | Дата: 16:58 29.08.2026

The account settings plan was deleted with its last batch, and it carried two live defects and one rig property that nothing else in the tree records. Each is written where its subject lives rather than in a register nobody reads.

Core changes:

  1. Editor defect (docs/EDITORS.md):
  2. a value carrying <br> comes back from a driver without them, measured to the byte

    • block fell 1475 to 1387, exactly 22 tags; sig fell 213 to 201, exactly 3
    • the settings form rewrites both columns on every save, so any save costs a member their line breaks
    • both wrong guesses already spent are recorded, so the next reader does not spend them again
  3. Settings page defect (docs/TEMPLATES.md):
  4. a validation stop rebuilds every field from the stored row and discards the typed input

    • measured with a broken token: a typed occ came back as the stored value
  5. Contrast registry blind spot (docs/TEMPLATES.md):
  6. a masked or initially hidden element is never sighted, so it has no measured contrast at all

    • time is masked for the shots and holds no pair on any page of the tree

Benefits:

  • A user-facing data loss stays findable after the document that found it is gone
  • The next reader of the contrast registry knows what a zero does not cover

Technical notes:

  • Documentation only; no code, no schema and no behaviour change
  • Neither defect is fixed here; both want a batch of their own
Docs: the node subsystem gets a design plan before a line of it is written
Автор: Eduard Laas | Дата: 16:38 29.08.2026

A sixteen part plan for the content subsystem that is meant to serve several material types at once and retire the same-shaped modules one by one, without growing a second CMS inside SLAED. Status is design; no implementation has started, and nothing in the tree reads any of it yet.

Core changes:

  1. Plan set (docs/node/):
  2. README names the reading order and the status
  3. goals, naming, database, code structure and the public core API

    • types, fields and settings; routing; rendering
  4. integrations with SLAED, type extensions, security and performance
  5. data migration from the modules being replaced, testing, roadmap
  6. a decision journal, so a settled question is not reopened by the next reader

Benefits:

  • The design is arguable before it is expensive, while it is still only prose
  • A decision journal keeps the reasoning with the plan instead of in a session

Technical notes:

  • Documentation only; no code, no schema, no route and no configuration change
  • Written in Russian, as the working language of these plans
Feature: the settings page is read top to bottom, and every section says what it costs
Автор: Eduard Laas | Дата: 16:37 29.08.2026

The account settings stop being four tabs hiding four endpoints and become one page of sections and tiles: PHP hands over nested data, the template owns every tag and class, and the state of the account is readable before a single field is touched. The password keeps a form of its own so a mistyped old password cannot be answered with "saved" about half the page.

Core changes:

  1. Page assembly (modules/account/index.php):
  2. edithome() builds sections, tiles, lines and fields instead of markup

    • a section that renders nothing is never appended, so the rail counts what exists
    • a validation stop carries its section name and the message lands beside its cause
    • the shared form opens before the first section marked inform and closes after the last
  3. getProfileFillRate(), getAccountLamps() and getAccountLog() name the three things the page computes

    • the fill rate counts six plain controls, and the two it leaves out are left out for a reason each
    • the log is assembled from columns that already carry a time and adds no table and no column
    • a provider sign-in not later than its linking is the linking, and is not printed twice
  4. Page template (templates/lite/partials/account-settings.html):
  5. one partial renders sections, tiles, lamps, rail, log and save bar

    • PHP names a width number and a tone number; the template maps both to classes
    • the tile is the fold container, so rows fold on the tile and never on the window
  6. Page behaviours (plugins/system/slaed.js):
  7. data-sl-spy marks the current section, data-sl-meter recomputes completeness as you type
  8. data-sl-dirty raises the save bar on the first change and reverts on discard

    • the hidden state is armed by the script, so a page without JavaScript keeps a usable bar
  9. Theme (templates/lite/assets/css/theme.css, base.css):
  10. the sl-opt-* vocabulary, three component tokens, and sl-is-ok and sl-is-info beside sl-is-warn
  11. the yes/no switch label takes the body colour, clearing a 4.17 contrast pair the crawler found
  12. Dead code removed (templates/lite/fragments/table-row.html, table.html):
  13. the is_avatar_link branch and the is_avatar_grid flag lost their last caller with the preset gallery

    • the gallery is now one radio group of 127 options inside the shared form, carrying one token

Benefits:

  • One save button for one page, instead of four forms pretending to be one
  • The page carries 3 CSRF tokens where it carried 128
  • Every caption id comes from getFieldIds(), and no label is emitted without a control

Technical notes:

  • The saveavatar route is gone; the avatar arbitration lives inside savehome()
  • An avatar failure does not roll back the profile: the profile is one UPDATE, the avatar a second
  • Fifteen language constants added across all six locales
  • The settings page contract now lives in docs/TEMPLATES.md and the work plan is deleted

Всего: 1159 на 116 страницах по 10 на каждой странице

1 2 3 4 5 6 7 8 9 10 116
Хотите опробовать SLAED CMS в действии?
Идеи и предложения
Обратная связь
Подтверждение

Поделиться
QR-код

Предварительный просмотр