Журнал изменений
Replace all per-module include('config/config_.php') and include('config/.php') calls with global config aliases that are already populated by the unified bootstrap in core/security.php. Also update save_conf() calls to setConfigFile() with the new paths.
Core changes:
- All modules/*/admin/index.php (17 files):
- Remove top-level include('config/config_X.php')
- Replace end_chmod/save_conf with checkPerms/setConfigFile
- Update config file path arguments (config_X.php -> X.php)
- All modules/*/index.php (17 files) + blocks/block-auto_links.php:
- Remove include('config/config_X.php') — alias already set globally
- core/user.php:
- Remove include('config/config_shop.php') in navi()
- Remove include('config/config_forum.php') in editpost()
- Use $conf['shop'] and $conf['forum'] via global $conf
- Fix uninitialised $fstatus variable; fix $_GET isset check
- index.php:
- Update require_once paths: config_shop.php -> shop.php, config_uploads.php -> uploads.php
- admin/modules/privat.php:
- Update checkPerms() and setConfigFile() path: privat.php
Benefits:
- Eliminates ~40 redundant file-system reads per request
- Single source of truth: config loaded once in bootstrap
- Consistent use of setConfigFile() for config persistence
Technical notes:
- All config aliases ($confn, $conffo, etc.) remain set in core/security.php
- No functional behaviour change; pure include removal
Drop the redundant config_ prefix from all module config files, aligning naming with the unified config bootstrap introduced in core/system.php. The new names match the module names directly.
Core changes:
- Deleted (23 files) (config/config_*.php):
- config_auto_links, config_comments, config_contact, config_content, config_faq, config_files, config_forum, config_global, config_help, config_jokes, config_links, config_media, config_money, config_news, config_order, config_pages, config_privat, config_rewrite, config_shop, config_templ, config_users, config_voting, config_whois
- Added (20 files) (config/*.php):
- auto_links, contact, content, faq, files, forum, help, jokes, lang, links, media, money, news, order, pages, privat, rewrite, shop, voting, whois
Benefits:
- Simpler, predictable naming: config/{module}.php
- Eliminates the inconsistent config_ prefix across all modules
- lang.php added as a new first-class config file
Technical notes:
- Git detected renames automatically (rename detection enabled)
- config_global, config_templ, config_users, config_comments removed (merged into global config or no longer needed as separate files)
Bump base font sizes in the admin area to improve legibility on higher-DPI displays and modern browsers.
Core changes:
- CodeMirror editor (templates/admin/system.css):
- .CodeMirror font: 11px → 12px Verdana
- .CodeMirror-hints font: 11px → 12px Verdana
- Admin base layout (templates/admin/theme.css):
- body, form elements font: 12px/16px → 13px/16px Tahoma/Arial/Verdana
Benefits:
- Better readability on HD/Retina screens
- Consistent sizing between editor widget and surrounding UI
Technical notes:
- Line-height left at 16px; no layout reflow expected
- No change to colours, spacing, or other visual properties
Replace the deprecated $prefix variable in all SQL snippets shown in project documentation with the PREFIX_DB constant, keeping examples consistent with the actual codebase after the refactor.
Core changes:
- README.md:
- SQL example: '.$prefix.'_users → '.PREFIX_DB.'_users
- CONTRIBUTING.md (2 occurrences):
- SQL examples in "Correct - Safe" and function sample updated
- SECURITY.md:
- Prepared-statement example updated
- UPGRADING.md:
- Migration guide example for 6.3.x updated
Benefits:
- Documentation reflects current coding standard
- New contributors see the correct pattern from the start
Technical notes:
- No functional code changed; documentation only
Harden the Apache rewrite rules to close several attack vectors and improve reliability across all hosting configurations.
Core changes:
- Block PHP execution in uploads (new rule):
- RewriteRule ^uploads/.*.php$ — [F,L,NC]
- Prevents uploaded-file code-execution attacks
- Exploit-string filter (existing block):
- Add [NC] flag to base64_encode and GLOBALS conditions
- Change final RewriteRule target from index.php to — [F,L] (returns 403 instead of silently routing malicious queries)
- HTTP_AUTHORIZATION passthrough:
- Move the Authorization header rule BEFORE the front-controller rule
- Ensures REST/API clients receive the header when using BasicAuth
- Remove trailing [L] flag from original position (was unreachable)
Benefits:
- Uploaded PHP files can no longer be executed via the web
- Malformed query strings return 403 instead of being forwarded
- HTTP Basic Auth works correctly in CGI/FastCGI environments
Technical notes:
- No change to normal request routing
- Backward-compatible with all existing URL rewrite patterns
Simplify file names in config/ by dropping the redundant config_ prefix. Remove the editrewrite admin function that was editing the now-deleted config/config_rules.php file.
Core changes:
- Config file renames:
- config/config_chmod.php → config/chmod.php
- config/config_header.php → config/header.php
- config/config_rules.php — deleted (no longer used)
- Security guard (config/system.php):
- Add FUNC_FILE guard to match style of all other config files
- Remove duplicate license header (already in repo root)
- Reference updates (core/admin.php, admin/modules/editor.php):
- end_chmod(): update tdir to 'config/chmod.php'
- editheader(): switch to CONFIG_DIR.'/header.php'
- htaccess(), robots(): switch to BASE_DIR-prefixed paths
- Remove editrewrite() function entirely
- Admin navigation (admin/modules/editor.php):
- Remove "System Rewrite" tab from editor navigation
- Renumber remaining tabs accordingly
- Documentation (admin/info/blocks-*.html, 6 languages):
- Update all references from config/config_header.php → config/header.php
- Tests (tests/ConfigValidationTest.php):
- Update required file list: config_global.php → global.php
Benefits:
- Cleaner, shorter file names consistent with the rest of config/
- Dead code (editrewrite) removed, reducing surface area
- All paths now use constants (BASE_DIR, CONFIG_DIR) for portability
Technical notes:
- config/chmod.php and config/header.php already existed as new files
- Storage format unchanged; only file names differ
_REDAKTOR was a legacy alias for _EDITOR. Consolidate all references to a single constant and drop the outdated definition from every language file.
Core changes:
- Language files (admin/language/*.php, 6 files):
- Remove define("_REDAKTOR", ...) from de, en, fr, pl, ru, uk
- Remove define("_EREW", ...) and define("_EREWN", ...) — editor rewrite labels
- Remove define("_EINFO3", ...) — rewrite editor info text
- Admin config panel (admin/modules/config.php):
- Replace _REDAKTOR with _EDITOR in editor-selector label
- Editor selector labels (core/system.php):
- Remove redundant _EDITOR prefix from option strings in redaktor() (e.g., _EDITOR.' SLAED BB' → 'SLAED BB')
Benefits:
- Single constant _EDITOR used consistently everywhere
- Removes dead constants that referenced removed functionality
- Reduces translation maintenance overhead
Technical notes:
- _REDAKTOR was functionally identical to _EDITOR
- admin/modules/admins.php already updated in previous commit
Drop all uses of the legacy $prefix variable in favour of the PREFIX_DB constant defined in core/security.php. This completes the migration started in earlier commits and removes the last runtime dependency on the dynamic global.
Core changes:
- Remove $prefix assignment (core/security.php):
- Delete the $prefix = $conf['db']['prefix'] line
- PREFIX_DB constant was already defined; variable was redundant
- All blocks (blocks/block-*.php, 15 files):
- Remove $prefix from global declarations
- Replace ".$prefix."_table with ".PREFIX_DB."_table in all queries
- All front-end modules (modules/*/index.php, 24 files):
- Remove $prefix from function global declarations
- Replace $prefix in every SQL query string
- All admin modules (admin/index.php, admin/modules/.php, modules//admin/index.php):
- Same substitution as front-end modules
- Templates (templates/admin/index.php, templates/lite/index.php, templates/lite/0index.php):
- Remove $prefix from global declarations
- Replace $prefix in SQL queries
Benefits:
- Single source of truth: PREFIX_DB constant eliminates accidental overrides
- Consistent style across the entire codebase
- Prepares for full removal of legacy globals
Technical notes:
- No behaviour change; queries produce identical SQL
- Backward-compatible: PREFIX_DB was already defined before any query runs
Harden .htaccess and fix string quoting in setConfigFile().
Core changes:
- .htaccess:
- Added Options -Indexes (prevent directory listing)
- Added RewriteRule ^config/ [F,L] (block config access)
- Added RewriteRule ^setup/ [F,L] (block installer access)
- Split commented deflate/expires into separate IfModule blocks
- setConfigFile() (core/system.php, setup/index.php):
- Replaced double-quoted "\n" with PHP_EOL and single quotes
- '['.PHP_EOL and ','.PHP_EOL consistent with rest of function
Benefits:
- config/ directory with DB credentials no longer web-accessible
- setup/ installer blocked after initial setup
- Directory listing disabled sitewide
- String quoting consistent with Rule 17 (single quotes)
Rename single-letter and over-length variables to comply with SLAED coding rules (Rule 6: prefer 4-8 chars, no camelCase).
Core changes:
- setConfigFile() (core/system.php, setup/index.php):
- $normalize (9 chars) → $norm
- $exp closure: $a→$arr, $d→$dep, $p→$pad, $i→$ind, $s→$out
- Loop vars: $k→$key, $v→$val throughout the function
Benefits:
- Compliant with Rule 6 (4-8 char variable names)
- No functional changes