Журнал изменений
The voting list page exposed raw $stitle in HTML attribute and JS onclick context, and fetched an unused column from the database.
Core changes:
- voting() (modules/voting/index.php):
- Apply htmlspecialchars($stitle, ENT_QUOTES) in title="" attribute
- Apply htmlspecialchars($stitle, ENT_QUOTES) in JS DelCheck() argument to prevent apostrophes from breaking the inline event handler string
- Remove unused 'questions' column from SELECT and list() destructuring
- Remove unused $confv from global declaration in view()
- Replace foreach ($langlist as $key => $val) with $val only
Benefits:
- Eliminates attribute-injection risk for admin-authored titles with quotes
- Prevents JS syntax error in moderator delete confirmation for special chars
- Reduces SELECT payload by one unused column
Technical notes:
- $stitle is already HTML-entity encoded at save time via save_text()
- htmlspecialchars() adds a second encoding layer safe for attribute context
- Behavior preserved; no template or route changes
Previously, if the INSERT into _rating failed (e.g. due to a DB constraint violation), code continued and updated vote counters anyway, causing silent count inflation across all rating-enabled modules.
Core changes:
- Rating function (core/system.php):
- Capture sql_query() result into $inserted
- Wrap all module UPDATE statements and update_points() calls in if ($inserted)
- SELECT + echo ajax_rating() still runs to return current state to client
- avoting_save() (core/system.php):
- Same guard applied to the voting-specific INSERT path
- Vote answer array update and update_points(42) skipped on INSERT fail
- getVoting() result still returned so UI shows current results
Benefits:
- Vote counters stay consistent with actual _rating table rows
- Eliminates data corruption on duplicate-key or race-condition failures
- getVoting() / ajax_rating() always return a response, preserving UX
Technical notes:
- sql_query() returns false on PDOException (caught internally) and logs
- Fix covers both rating() and avoting_save() code paths
- No schema changes in this commit
The admin basic item template used positional array references ($arg[1] through $arg[10]) which were fragile and hard to read. Replaces them with descriptive named tokens matching the keys passed by setTemplateBasic().
Core changes:
- Placeholder rename (templates/admin/basic.html):
- $arg[2] → {%id%}
- $arg[3] → {%title%}
- $arg[4] → {%text%}
- $arg[5] → {%post%}
- $arg[6] → {%date%}
- $arg[7] → {%reads%}
- $arg[8] → {%comm%}
- $arg[9] → {%rating%}
- $arg[10] → {%admin%}
- $arg[1] → {%ctitle%}
Benefits:
- Template is self-documenting; field purpose visible without cross-referencing PHP
- Named tokens decouple template from positional argument order
- Consistent with the named-token convention used in other templates
Technical notes:
- Requires setTemplateBasic() callers to pass named-key arrays
- No HTML structure changed; layout identical
Converts the sitemap public module to current SLAED PHP conventions: 4-space indentation, single-quoted strings, void return type, SITEMAP_DIR constant for file resolution, and updated template helpers.
Core changes:
- Code style (modules/sitemap/index.php):
- Tabs → 4-space indentation throughout
- Double-quoted strings → single-quoted
- sitemap() → sitemap(): void
- File path (modules/sitemap/index.php):
- Hardcoded 'config/sitemap/sitemap.txt' → SITEMAP_DIR.'/sitemap.txt'
- Resolves via constant, independent of working directory
- Template helpers (modules/sitemap/index.php):
- tpl_eval('title', ...) → setTemplateBasic('title', ['title' => ...])
- tpl_eval('open/close') → setTemplateBasic('open/close')
- tpl_warn() → setTemplateWarning()
- Switch style (modules/sitemap/index.php):
- Multiline switch/case → compact single-line form
- Removed closing ?>
Benefits:
- Consistent style with other modernized public modules
- File path resolved via constant rather than implicit cwd
Technical notes:
- Behavior unchanged; pure refactor
- Copyright year updated to 2026
Cleans up the sitemap admin module: replaces $aroute with $afile, uses the SITEMAP_DIR constant for file paths, adds a null-check for fopen(), passes the $legacy parameter to getAdminTabs(), and guards file_get_contents() with is_readable().
Core changes:
- Global variable (modules/sitemap/admin/index.php):
- $aroute → $afile in all functions (sitemap, xsl, xslsave, conf, confsave)
- File path hardening (modules/sitemap/admin/index.php):
- Hardcoded 'sitemap.xsl' → SITEMAP_DIR.'/sitemap.xsl'
- file_get_contents() → is_readable() guard before read
- fopen() now checked for false before entering while loop
- fclose() moved inside the if-block to prevent warning on null handle
- Navigation fix (modules/sitemap/admin/index.php):
- $legacy parameter now forwarded correctly to getAdminTabs()
Benefits:
- Eliminates $aroute global; consistent with other modernized modules
- Prevents PHP warnings from fopen() failure on missing XML files
- File paths resolved via constant rather than implicit cwd
Technical notes:
- Behavior unchanged; pure refactor and hardening
- fopen() suppression (@) retained from original for non-critical read
Rewrites the shop admin module with current SLAED conventions: short op-aligned function names, $afile instead of $admin_file, inline $conf['shop'] access instead of global $confs, and unified template API.
Core changes:
- Navigation (modules/shop/admin/index.php):
- shop_navi() → navi() with typed int + string parameters
- Function renames (modules/shop/admin/index.php):
- shop_clients() → clients()
- shop_clients_act() → clientsact()
- shop_clients_add() → clientsadd()
- shop_clients_save() → clientssave()
- shop_clients_delete() → clientsdel(int $id)
- shop_products() → products()
- shop_products_add() → productsadd()
- shop_products_save() → productssave()
- shop_products_admin() → productsadmin(int|array $id, string $vtyp)
- shop_partners() → partners()
- shop_partners_act() → partnersact()
- shop_partners_add() → partnersadd()
- shop_partners_save() → partnerssave()
- shop_partners_delete() → partnersdel(int $id)
- shop_partners_details() → partnersdetails()
- shop_export() → exportdata()
- shop_conf() → conf()
- shop_conf_save() → save()
- shop_info() → info()
- New: shop() — main listing function
- Global variable cleanup (modules/shop/admin/index.php):
- $admin_file → $afile
- $confs → $conf['shop'] with null-coalesce defaults
- tpl_eval() → setTemplateBasic()
- while (list()) → while ([]) destructuring
Benefits:
- Eliminates deprecated $confs global and panel() call
- Consistent naming aligned with router op values
- Template API unified with other modernized modules
Technical notes:
- Behavior unchanged; pure refactor
- Copyright year updated to 2026
The adm_info() call in info() was passing the numeric flag as the second argument and the module name as the third. The function signature expects (flag, module, ...) — swap restores correct info-panel rendering.
Core changes:
- Argument order fix (modules/rss/admin/index.php):
- adm_info(1, 0, 'rss') → adm_info(1, 'rss', 0)
- Second arg is module name, third is language fallback flag
Benefits:
- Info panel now loads the correct rss module documentation
- Aligns with the adm_info() signature used in all other modules
Technical notes:
- Single-line change; no other logic affected
Rewrites the pages admin module with current SLAED conventions: short op-aligned function names, $afile instead of $admin_file, inline $conf['pages'] access instead of global $confp, and unified template API.
Core changes:
- Navigation (modules/pages/admin/index.php):
- page_navi() → navi() with typed int parameters
- Switched to getAdminTabs() + name=pages&op=... URL pattern
- Function renames (modules/pages/admin/index.php):
- page() → pages() (matches module op)
- page_add() → add()
- page_save() → save()
- page_delete() → del(int $did)
- page_conf() → conf()
- page_conf_save() → confsave()
- page_info() → info()
- Global variable cleanup (modules/pages/admin/index.php):
- $admin_file → $afile
- $confp → $conf['pages'] with null-coalesce defaults
- tpl_eval() → setTemplateBasic()
- tpl_warn() → setTemplateWarning()
- while (list()) → while ([]) destructuring
Benefits:
- Eliminates deprecated $confp global and panel() call
- Consistent naming aligned with router op values
- Template API unified with other modernized modules
Technical notes:
- Behavior unchanged; pure refactor
- Copyright year updated to 2026
Rewrites the order admin module with current SLAED conventions: short op-aligned function names, $afile instead of $admin_file, inline $conf['order'] access, and unified template API.
Core changes:
- Navigation (modules/order/admin/index.php):
- order_navi() → navi() with typed int parameters
- Switched to getAdminTabs() + name=order&op=... URL pattern
- Function renames (modules/order/admin/index.php):
- order_add() → add()
- order_save() → save()
- order_delete() → del(int $did)
- order_conf() → conf()
- order_conf_save() → confsave()
- order_info() → info()
- New: active() — toggles order entry active state
- Global variable cleanup (modules/order/admin/index.php):
- $admin_file → $afile
- $confor → $conf['order'] with null-coalesce defaults
- tpl_eval() → setTemplateBasic()
- tpl_warn() → setTemplateWarning()
- while (list()) → while ([]) destructuring
Benefits:
- Eliminates deprecated $confor global and panel() call
- Consistent naming aligned with router op values
- Template API unified with other modernized modules
Technical notes:
- Behavior unchanged; pure refactor
- Copyright year updated to 2026
Rewrites the news admin module with current SLAED conventions: short op-aligned function names, $afile instead of $admin_file, inline $conf['news'] access instead of global $confn, and unified template API.
Core changes:
- Navigation (modules/news/admin/index.php):
- news_navi() → navi() with typed int parameters
- Switched to getAdminTabs() + name=news&op=... URL pattern
- Function renames (modules/news/admin/index.php):
- news_add() → add()
- news_save() → save()
- news_admin() → admin(int|array $ids, string $vtyp)
- news_conf() → conf()
- news_conf_save() → confsave()
- news_info() → info()
- Global variable cleanup (modules/news/admin/index.php):
- $admin_file → $afile
- $confn → $conf['news'] with null-coalesce defaults
- tpl_eval() → setTemplateBasic()
- tpl_warn() → setTemplateWarning()
- while (list()) → while ([]) destructuring
Benefits:
- Eliminates deprecated $confn global and panel() call
- Consistent naming aligned with router op values
- Template API unified with other modernized modules
Technical notes:
- Behavior unchanged; pure refactor
- Copyright year updated to 2026