Журнал изменений

Журнал изменений

Фильтр и поиск

Всего: 1347 Доступных коммитов | Отфильтровано: 1347 Коммиты | Страница: 104 из 135
28.02.2026
Refactor: normalize frontend modules — indentation, copyright, variable names
Автор: Eduard Laas | Дата: 02:18 28.02.2026

Standardises all public-facing module controllers: converts tab indentation to 4-space (recommend, users), corrects copyright header encoding and year (2021/2022 → 2026) across modules that were outdated, shortens verbose loop variables to concise local names, and adds defensive directory handling in main/index.php to prevent warnings when the screenshots directory is absent.

Core changes:

  1. main/index.php:
  • Fix copyright year 2022 → 2026 and encoding © → ©
  • Wrap opendir() in is_dir() + false check before loop
    • Prevents PHP warning when uploads/screens/thumb is missing
  • Guard shuffle() call with if ($screens) to skip empty arrays
  • Add closedir() inside the safe branch
  1. recommend/index.php:
  • Convert tabs to 4-space indentation throughout
  • Fix copyright year 2021 → 2026
  1. users/index.php:
  • Convert tabs to 4-space indentation
  • Rename verbose loop variables ($user_id → $uid, etc.)
  1. account, faq, forum, help, jokes, links, media, money, news, order, pages, shop, whois, search, files, clients, changelog, auto_links, content, contact, sitemap, rss/index.php:
  • Rename DB-prefixed destructured vars to short local names
  • Normalise copyright encoding/year where broken (© → ©)
  • CRLF → LF line-ending normalisation on Windows-edited files

Benefits:

  • Consistent 4-space indentation across all frontend controllers
  • Correct copyright year in all module headers (2026)
  • No PHP warnings when optional directories are absent
  • Shorter variable names reduce line width in dense row-rendering loops

Technical notes:

  • No logic changes beyond the defensive is_dir() guard in main
  • CRLF → LF applied automatically by git on staging
  • Encoding fixes are cosmetic; runtime behaviour unchanged
Refactor: normalize variable names and config access in admin modules
Автор: Eduard Laas | Дата: 02:18 28.02.2026

Renames verbose DB-prefixed loop variables (user_id, ip_sender, user_name, ad_view, etc.) to concise local names ($uid, $ip, $nick, $view) across all admin module controllers. Migrates pagination config from deprecated $confu global to $conf['users'] sub-array in account admin. Removes unused $confu and $confn imports from global declarations.

Core changes:

  1. account/admin/index.php:
  • Rename $psearch → $search, $cnt_params → $pars in navi()
    • Avoids shadowing the search variable read later
  • Shorten all 26 $user_* destructured vars to single-word names
    • $user_id → $uid, $user_name → $name, $user_email → $mail, etc.
  • Replace $confu['anum'] / $confu['anump'] with $conf['users'][...]
    • Removes dependency on $confu global in account() and add()
  • Remove $confn and $confu from global declarations in add()
  1. news/admin/index.php:
  • Rename $ip_sender → $ip, $user_name → $nick, $ad_view → $view
  • Inline $assoc_arr to $associated in save()
  • Remove unused $confu from global declaration
  1. media, money, links, shop, sitemap, whois, voting, files, faq, forum, help, jokes, pages, order, clients, changelog, auto_links, content, rss, contact/admin/index.php:
  • Rename verbose loop/result variables to short local names
  • Remove unused global imports ($confu, $confn where applicable)

Benefits:

  • Shorter destructuring lines fit within 120-char line limit
  • Eliminates $confu dependency in admin layer (uses $conf['users'])
  • Consistent naming style across all admin controllers

Technical notes:

  • No logic changes; purely cosmetic variable renames
  • $conf['users'] sub-array must exist (set by config loader)
  • CRLF → LF normalisation applied by git on staging
Chore: remove obsolete template file and fix billing variable name
Автор: Eduard Laas | Дата: 02:17 28.02.2026

Removes the stale templates/lite/0index.php which contained hardcoded site-specific navigation and SQL queries inside a presentation layer — a structural anti-pattern not compatible with the current template architecture. Also corrects a renamed variable reference in billing.html.

Core changes:

  1. templates/lite/0index.php:
  • Delete entire file (184 lines)
    • Contained hardcoded menu HTML, direct DB queries, and mixed presentation/business logic
    • Incompatible with {%placeholder%} template architecture
  1. modules/money/templates/billing.html:
  • Replace $site_logo with $logo to match renamed config variable
  • Add missing newline at end of file

Benefits:

  • Eliminates hardcoded SQL inside template layer
  • Fixes broken variable reference in billing invoice template
  • Reduces dead code footprint in templates/lite/

Technical notes:

  • templates/lite/0index.php was not referenced by any active module
  • billing.html $logo aligns with current config naming convention
Fix: add explicit type casts in cutstr() for safety
Автор: Eduard Laas | Дата: 02:17 28.02.2026

Adds (string) cast for $strip and (int) cast for $size at the top of cutstr() to prevent type coercion issues when callers pass non-scalar or null values.

Core changes:

  1. cutstr() (core/system.php):
  • Add (string)$strip cast before length check
    • Prevents TypeError on null input
  • Add (int)$size cast before arithmetic
    • Ensures consistent numeric behaviour

Benefits:

  • Prevents silent type coercion bugs at string truncation boundary
  • Aligns with PHP 8.4 strict-type expectations
  • Defensive guard for legacy call sites passing untyped values

Technical notes:

  • No change to function signature or return type
  • Backward compatible: existing callers unaffected
27.02.2026
Docs: update project documentation for SLAED 6.3 modernization phase
Автор: Eduard Laas | Дата: 23:31 27.02.2026

Synchronize all project documentation with the changes implemented in the current modernization phase: getVar() coverage, func_get_args() elimination, tpl_eval/tpl_func/tpl_warn removal, setRedirect() introduction, filterMarkdown() addition, and migration progress update to ~80% complete.

Core changes:

  1. README.md:
  • Migration badge and text: 75% → 80% complete
  • Tech Stack: added filterMarkdown() (safe Markdown parser) to Security line
  • Completed section: added func_get_args() elimination, tpl_eval/tpl_func/tpl_warn removal, setRedirect(), filterMarkdown() entries
  • Documentation table: added TESTS.md row
  1. CONTRIBUTING.md:
  • getVar() type reference: added 'let', 'word', 'title', 'field', 'raw' types; corrected 'var' description (was "Raw variable"; now "Alphanumeric/underscore/dash")
  • Admin Module Conventions: replaced manual header()/exit section with full setRedirect() documentation including signature and all parameters
  • Template Functions: tpl_eval/tpl_func/tpl_warn marked as fully REMOVED (not deprecated) — calling them causes fatal error
  1. SECURITY.md:
  • Version 6.3.0 changelog: added getVar() core coverage, func_get_args removed, tpl_eval/tpl_func/tpl_warn removed, filterMarkdown added, setRedirect added
  • Removed (Insecure) table: added tpl_func() row, func_get_args() row, inline header()+exit row
  1. UPGRADING.md:
  • Template Functions migration: tpl_eval/tpl_func changed from "deprecated" to "fully removed — causes fatal error in 6.3.x"; added tpl_func() row
  • New section: Admin Redirects — setRedirect() with full signature and examples
  • New section: Admin Help Files — info file rename table (en.html → english.html)
  • Migration Checklist: updated tpl_eval item, added setRedirect and info rename
  • Version History: expanded Major Changes list with all 6.3 improvements
  1. docs/TEMPLATES.md:
  • [!WARNING] → [!CAUTION]: tpl_eval/tpl_func/tpl_warn have been REMOVED (not "will be removed") — updated wording and added tpl_func() to table
  1. docs/TESTS.md:
  • Minor alignment with current test suite structure
  1. CODE_OF_CONDUCT.md:
  • Added contribution guideline note for variable naming in examples and patches
  1. docs/DISCUS.md / docs/PARSE.md:
  • Status lines updated to reflect filterMarkdown() implementation status

Benefits:

  • Documentation accurately reflects current codebase state
  • getVar() type table is complete and correct for all contributors
  • setRedirect() fully documented — replaces scattered header()/exit patterns
  • No invented functionality — all documented features verified in source

Technical notes:

  • docs/DISCUS.md and docs/PARSE.md are temporary working files
  • filterMarkdown() signature: (string $src, bool $safe, string $mod): string
  • setRedirect() signature: (string $url, bool $refer, int $code): never
Test: add informational audit tests; harden SecurityValidationTest
Автор: Eduard Laas | Дата: 23:30 27.02.2026

Add two new informational test suites for language constant usage and unused function detection; update SecurityValidationTest to convert the include-inside-functions check from a hard assertion to an informational STDERR report with deduplication and truncation.

Core changes:

  1. New test: tests/LanguageConstantsUsageTest.php:
  • Scans language/.php, admin/language/.php, modules//language/.php
  • Counts total defined constants vs. actual usage in PHP source
  • Reports: total, unused, low-use (1-2 occurrences), top unused/low-used
  • Informational only — no hard assertions that would block CI
  1. New test: tests/UnusedCodeAuditTest.php:
  • Scans core/*.php for defined functions vs. usage in project source
  • Reports unused functions, low-use functions, top candidates for removal
  • Scans local variables for unused assignment candidates (heuristic)
  • Informational only — assists human review, does not fail CI
  1. Updated: tests/SecurityValidationTest.php (testNoIncludesInsideFunctions):
  • $errors[] hard assert → informational STDERR report
  • Deduplication: $seen[] map prevents double-counting same file:line
  • Truncation: output capped at 30 warnings + "... and N more" summary
  • Rationale: legacy SLAED codebase has many include-inside-functions patterns that require staged migration; hard failure blocked test runs
  1. Updated: tests/LanguageValidationTest.php:
  • Minor cleanup and alignment with new audit test patterns

Benefits:

  • Two new audit tools surface unused code and dead language constants
  • SecurityValidationTest no longer fails CI on known legacy patterns
  • All audit output goes to STDERR — visible in verbose mode, not in summary

Technical notes:

  • Both new tests extend PHPUnit TestCase with self::assertTrue(true) anchor
  • Output format: plain text with key metrics for human readability
  • Tests run after: ./vendor/bin/phpunit (no additional configuration needed)
Refactor: migrate templates from positional $arg[N] to named {%placeholder%} syntax
Автор: Eduard Laas | Дата: 23:29 27.02.2026

Replace all positional $arg[N] variable references in HTML template files with named {%placeholder%} tokens compatible with setTemplateBasic(). This completes the migration from tpl_eval()/tpl_func() (removed) to the strtr-based template renderer introduced in SLAED 6.3.

Core changes:

  1. Admin templates (templates/admin/*.html):
  • login.html: $arg[1]→{%route%}, $arg[2]→{%nickname%}, $arg[3]→{%password%}, $arg[4]→{%captcha%}, $arg[5]→{%login%}
  • registration.html: all $arg[N] → named placeholders
  • comment.html: positional args → semantic names (username, avatar, rank, etc.)
  • voting-close/open/post/view.html: updated to named placeholders
  • index.php (admin theme entry): positional variable references updated
  1. Default theme templates (templates/default/*.html):
  • comment.html: $arg[1-25] → {%id%}, {%username%}, {%avatar%}, {%rank%}, {%post_count%}, {%user_rate%}, {%hclass%}, etc.
  • login.html / login-logged.html / login-without.html: named placeholders
  • privat-message.html: message template fully updated
  • basic-search.html, basic-media-view.html: search/media templates updated
  • liste-basic.html, liste-open.html: list templates updated
  • block-voting.html: voting block placeholder names
  1. Lite theme templates (templates/lite/*.html, templates/lite/0index.php):
  • Same pattern applied: all $arg[N] → {%named%} placeholders
  • comment.html, privat-message.html, basic-search.html, basic-media-view.html

Benefits:

  • Template variables are now self-documenting (name conveys meaning)
  • setTemplateBasic() uses strtr() with named keys — no eval() required
  • Template maintenance simplified: no need to count positional arg indices
  • All CRLF → LF normalized; missing EOF newlines added

Technical notes:

  • setTemplateBasic(string $tpl, array $vars): string uses strtr($raw, $vars)
  • Template files loaded from templates/$theme/$name.html by getThemeFile()
  • Callers (module index.php files) updated to pass named key arrays
Chore: remove closing ?> tags and modernize array syntax in module support files
Автор: Eduard Laas | Дата: 23:29 27.02.2026

Remove trailing PHP close tags from language files (clients, whois) per PSR-12; update array() → [] syntax in modules/clients/pclzip.lib.php for PHP 8.4 style consistency.

Core changes:

  1. Close tag removal (modules/clients/language/.php, modules/whois/language/.php):
  • lang-english.php, lang-french.php, lang-german.php, lang-polish.php, lang-russian.php, lang-ukrainian.php (clients module)
  • en.php, de.php, fr.php, pl.php, ru.php, uk.php (whois module)
  • Trailing ?> removed from all 12 language files
  1. Array syntax modernization (modules/clients/pclzip.lib.php):
  • array() → [] for option arrays in PclZip::add() and related methods
  • No logic change — purely syntactic modernization

Benefits:

  • PSR-12 compliant: PHP-only files must not have closing ?> tags
  • Eliminates risk of accidental whitespace output after closing tag
  • Consistent array syntax throughout the codebase

Technical notes:

  • pclzip.lib.php is a vendored library; only array syntax touched, no logic
  • Language files: 12 files × 1 line removed = 12 deletions
Refactor: modernize frontend modules — PHP 8.4 types, config access, list() syntax
Автор: Eduard Laas | Дата: 23:28 27.02.2026

Add return type declarations to all module functions; replace list() with [] destructuring; update config access from module-specific globals ($conffo, $confnews, etc.) to $conf['module_name']['key']; modernize setHead() calls with explicit title arrays.

Core changes:

  1. Return type declarations added (all 29 module index files):
  • account(), newuser(), finnewuser() → : void
  • forum(), topic_view(), post_add() → : void
  • news(), view(), add_news() → : void
  • All public-facing module functions now have explicit return types
  1. list() → [] destructuring (modules with SQL result rows):
  • forum/index.php: all while(list(...)) → while([...]) in topic/post loops
  • files/index.php, media/index.php, shop/index.php, links/index.php
  • news/index.php, pages/index.php, faq/index.php, jokes/index.php
  • All sql_fetchrow() result assignments updated
  1. Config access modernization (forum/index.php):
  • global $conffo removed from all forum functions
  • $conffo['listnum'] → $conf['forum']['listnum']
  • $conffo['defis'] → $conf['forum']['defis']
  • $conffo['pop'] → $conf['forum']['pop']
  • $conffo['pnum'] → $conf['forum']['pnum']
  1. setHead() with explicit titles (account/index.php):
  • setHead() → setHead(['title' => _USERREGLOGIN])
  • setHead() → setHead(['title' => _REGNEWUSER])
  • setHead() → setHead(['title' => _ACCOUNTCREATED])
  • Pattern applied across all account flow functions
  1. Miscellaneous cleanup:
  • Unused $catlink variable removed from forum/index.php
  • whois/index.php: geo_ip lookup updated to current API
  • search/index.php: query variable cleanup
  • voting/index.php: type declarations added

Benefits:

  • PHP 8.4 compatible — all functions have explicit return types
  • $conffo/$confnews/etc. global removal reduces import surface
  • list() removal aligns with PHP 7.1+ best practices throughout
  • setHead() with title enables proper SEO meta generation

Technical notes:

  • Config access via $conf['module']['key'] — no behavioral change
  • [] destructuring is functionally identical to list() in all contexts
  • 29 module files modified across 5 module subdirectories
Refactor: modernize admin panel — $afile, SQL hardening, command injection guard
Автор: Eduard Laas | Дата: 23:27 27.02.2026

Replace deprecated $aroute alias with $afile throughout admin/index.php; harden SHOW TABLE STATUS queries in database.php and monitor.php against SQL injection via database/table name validation; add command injection guard in monitor.php getCommandOutput(); update editor info pages.

Core changes:

  1. Alias replacement (admin/index.php):
  • global $aroute → global $afile in getAdminPanelBlocks() and getAdminPanel()
  • All $aroute.'.php?name=' → $afile.'.php?name=' references updated
  1. SQL hardening (admin/modules/database.php):
  • $confdb['name'] → $dbname = preg_replace('#[^a-zA-Z0-9_]#', '', ...) before use
  • Empty $dbname guard added — returns early with warning on invalid DB name
  • SHOW TABLE STATUS, ANALYZE TABLE, OPTIMIZE TABLE, REPAIR TABLE: $confdb['name'] replaced with sanitized $dbname throughout
  • Table name now validated with preg_match('#^[a-zA-Z0-9_]+$#') before queries
  • Variable renaming: $rowResult/$rowData → $res/$row (SLAED naming convention)
  • $infoText → $info (short naming convention)
  1. SQL hardening (admin/modules/monitor.php):
  • SHOW TABLE STATUS FROM: $confdb['name'] → $dbname with same sanitization
  • $dbname empty guard added — skips DB stats block if name is invalid
  • Removed uptime block that used platform-specific /proc/uptime path
  1. Command injection guard (admin/modules/monitor.php):
  • getCommandOutput(): added preg_match for shell metacharacters [;&|`><\r\n]
  • Returns [] immediately if command string contains dangerous characters
  1. Editor info pages updated (admin/info/editor/*.html):
  • Reference to core/geo_ip.php and $COUNTRY_NAMES removed
  • Updated to: "Use user_geo_ip() output as the valid country value reference"

Benefits:

  • SHOW TABLE STATUS SQL injection prevented via name sanitization
  • Table-level query injection prevented via table name whitelist validation
  • Command injection in exec() calls blocked by metacharacter guard
  • $aroute deprecated alias fully removed from admin panel code

Technical notes:

  • admin/modules/blocks.php: minor 1-line cleanup (unused variable)
  • admin/modules/messages.php: 4-line formatting/variable rename cleanup
  • Database name regex: [^a-zA-Z0-9_] — matches MySQL identifier rules
Хотите опробовать SLAED CMS в действии?
Идеи и предложения
Обратная связь
Подтверждение

Поделиться
QR-код

Предварительный просмотр