Журнал изменений
Expose the existing dev_mode flag in the admin interface so it can be toggled without manually editing config files or local.php.
Core changes:
- admin/modules/config.php:
- Added radio_form row for dev_mode (after site close toggle)
- Added 'dev_mode' => getVar('post', 'dev_mode', 'num') to save $cont
- admin/language/*.php (6 files):
- Added _DEVMODE constant after _DEAKTIVE (alphabetical order) ru: «Режим разработки» en: «Developer Mode» de: «Entwicklermodus» fr: «Mode développeur» pl: «Tryb deweloperski» uk: «Режим розробника»
- config/global.php:
- Added 'dev_mode' => false as explicit default
Benefits:
- dev_mode can be enabled/disabled without file editing
- Config fingerprint tracking active when dev_mode is on
- Consistent with all other boolean toggles in general preferences
Technical notes:
- getConfig() already provides $conf['dev_mode'] ??= false fallback
- normalize() converts false → '0', true → '1' on save
- String '0' is falsy in PHP, behavior unchanged
Replace var_export() with a recursive closure that produces modern PHP short-array syntax ([]) consistent with all config/*.php files.
Core changes:
- setConfigFile() (core/system.php, setup/index.php):
- Added $exp closure: renders arrays as [...] with 4-space indent
- Replaced var_export($data, true) with $exp($data)
- Output format now matches manually-converted config files
Benefits:
- Config files saved by admin panel are readable and consistent
- No more array() vs [] style mismatch after save
- Multi-level arrays (ratings, modules) properly indented
Technical notes:
- $exp recurses for nested arrays using depth counter
- Scalar values still use var_export() for correct quoting
- Both system.php and setup/index.php versions kept in sync
Remove legacy variable-assignment format and update all callers.
The function now writes config files in the modern return [...]
format compatible with getConfig() which uses require $file.
Core changes:
- setConfigFile() (core/system.php, setup/index.php):
- Signature simplified: removed $name and $type parameters
- Output format changed from
$name = var_export(...)toreturn var_export(...) - Guard
if (!defined(...)) die(...)removed (no longer needed) - Wrapping logic added: global.php → flat array, others → [$key => $arr]
- setup/index.php copy also modernized to match core version
- All 30 callers updated (20 files):
- Removed 2nd string argument (variable name like 'conf', 'confmd')
- Removed 5th empty string argument where present
- PHP warnings fixed (core/system.php, core/user.php):
- rss_select(): added
global $confrs - bb_decode(): preg_replace null guard added (
?? '') - user.php: $cid undefined key, $fstatus, user variables
Benefits:
- Config writes now produce files readable by getConfig()
- Saved admin settings no longer break the entire CMS
- Cleaner API without semantic-free string parameters
Technical notes:
- Wrapping: pathinfo(basename($fp), PATHINFO_FILENAME) determines key
- global.php → flat merge into $conf; all others → keyed sub-array
- Both system.php and setup/index.php versions kept in sync
Replaces direct usage of the global $prefix variable with the PREFIX_DB constant defined in core/security.php. This eliminates the need to declare $prefix in every function's global list and makes DB table references explicit.
Core changes:
- core/admin.php:
- All SQL queries: $prefix."_table" → PREFIX_DB."_table"
- Removed $prefix from global declarations in affected functions
- Applies to admininfo(), fav_aliste(), fav_adel(), ajax_privat() and others
- core/user.php:
- All SQL queries: $prefix."_table" → PREFIX_DB."_table"
- Removed $prefix from global declarations in affected functions
- Consistent with the modernization pattern applied to admin/modules/
Benefits:
- Fewer global declarations per function (cleaner signatures)
- Consistent with admin modules already using PREFIX_DB
- Eliminates risk of $prefix being unset in a function scope
Technical notes:
- PREFIX_DB defined as: define('PREFIX_DB', $conf['db']['prefix']) in core/security.php
- Backward compat: $prefix alias still set for not-yet-modernized modules
Modernized modules (changelog, rss, sitemap, account) were still loading config files directly via require_once/include. Since config files now return arrays instead of setting globals, these calls no longer populated the expected $confX variables. Replace each with a direct $conf read.
Core changes:
- modules/changelog/index.php and changelog/admin/index.php:
- Removed: require_once CONFIG_DIR.'/changelog.php'
- Added: $conflog = $conf['changelog'] ?? []
- modules/rss/index.php and rss/admin/index.php:
- Removed: require_once CONFIG_DIR.'/rss.php'
- Added: $confrs = $conf['rss'] ?? []
- modules/sitemap/admin/index.php:
- Removed: require_once CONFIG_DIR.'/sitemap.php'
- Added: $confma = $conf['sitemap'] ?? []
- modules/account/index.php:
- Removed: include('config/config_news.php') and require_once .../rss.php
- Added: $confn = $conf['news'] ?? [] and $confrs = $conf['rss'] ?? []
- modules/account/admin/index.php:
- Removed: require_once CONFIG_DIR.'/config_news.php' (inside add() function)
- Added: $confn = $conf['news'] ?? [] (using already-declared global $conf)
Benefits:
- Eliminates TypeError: chlogRenderCommits() argument #2 must be array, null given
- Config data now comes from the single authoritative $conf source
- Consistent with the new architecture: no direct config file reads in modules
Technical notes:
- Un-modernized modules are covered by transition aliases in core/security.php
- include('config/config_X.php') in old modules are now silent no-ops
Extends the existing transition alias block to cover all module-specific config variables. This allows not-yet-modernized modules to keep using their legacy $confX globals while the config files now return arrays instead of setting globals as side effects.
Core changes:
- Transition aliases (core/security.php):
- Added 17 new module aliases to the existing block:
- $confn / $conffa / $conff / $confw / $confal / $confl (news, faq, files, whois, auto_links, links)
- $confj / $conffo / $confh / $confp / $confso / $confm (jokes, forum, help, pages, shop, media)
- $confmo / $confor / $confco / $confcn (money, order, contact, content)
- $confma / $conflog (sitemap, changelog)
- All set at global scope once at startup via $conf['namespace'] ?? []
Benefits:
- 33 not-yet-modernized modules continue working without changes
- include('config/config_X.php') calls in old modules become harmless no-ops
- Single authoritative source: all values come from $conf loaded by getConfig()
- Enables gradual per-module migration without big-bang changes
Technical notes:
- Aliases are temporary; remove after full migration to $conf['namespace']
- content module uses $confcn (not $confn) to avoid collision with news
- Changelog and RSS admin modules set their alias locally (redundant, harmless)
Converts the entire config/ directory to the new unified architecture. Every data config file now returns ['namespace' => [...]] so getConfig() can safely merge them all into a single $conf array without side effects.
Core changes:
- Legacy config files (config/config_*.php — 25 files):
- All converted from $confX = array(...) assignments to return ['key' => [...]]
- Dangerous files set to return null (getConfig() skips null values safely):
- config_global.php: was overwriting $conf in getConfig() function scope
- config_header.php: was executing echo during config load
- config_comments.php, config_users.php, config_templ.php: superseded
- config_chmod.php, system.php: empty files
- Active config files (config/comments.php, users.php, fields.php, etc.):
- Converted to return ['namespace' => [...]] format
- Heredoc strings preserved where needed (filetype.php, config_contact.php, etc.)
- Integer values kept as integers (sitemap.auto_t = 86400, not '86400')
- New file: config/local.php
- Template for server-specific overrides (DB credentials, dev_mode, etc.)
- Contains _meta.base_fingerprint placeholder for fingerprint tracking
- Only file the system writes to at runtime
Benefits:
- Zero side effects when loading config files (no global assignments)
- getConfig() collects all configs in one pass via glob()
- local.php overrides applied safely via filterConfigMerge()
- Dangerous files neutralized (return null) instead of deleted
Technical notes:
- Namespace keys match the module names (news, forum, shop, etc.)
- Backward compat: transition aliases defined in core/security.php
- config_rewrite.php and config_rules.php left unchanged (executable code)
Replaces scattered per-module config loading with a single, centralized bootstrap system. All config files are now loaded once at startup into a unified $conf array, eliminating duplicate includes and global variable pollution across modules.
Core changes:
- Config loader (core/system.php):
- getConfig(): loads all config/*.php via glob(), merges into $conf
- Skips local.php (overrides file); applies it separately via filterConfigMerge()
- Triggers fingerprint update when dev_mode=true and configs have changed
- filterConfigMerge(): safe recursive merge — only existing keys, type-matched
- Prevents adding unknown keys or type mismatches from local.php
- getConfigFingerprint(): SHA1 over basename+sha1_file for each default config
- Including filename in hash detects file additions and removals
- checkConfigFingerprint(): convenience wrapper for fingerprint comparison
- setConfigFingerprint(): reads local.php as array, updates _meta.base_fingerprint
- Atomic write: file_put_contents(tmp) + rename(); unlinks tmp on failure
- var_export output converted to [...] syntax via post-processing regex
- chmod(0640) only on newly created files
Benefits:
- Single load point eliminates N redundant file includes per request
- Fingerprint mechanism enables safe dev-mode config tracking
- filterConfigMerge prevents accidental key injection from local.php
- Atomic write prevents corrupt local.php on server crash
Technical notes:
- config/local.php is the only writable runtime config file
- dev_mode=true enables auto-update of local.php fingerprint
- All config files must return ['namespace' => [...]] or null
- Backward compat: old $confX globals set as aliases in core/security.php
Replace hardcoded Open Graph and Schema.org strings in the SEO settings panel with language constants across all 6 supported languages (ru, en, de, fr, pl, uk).
Core changes:
- Admin language files (admin/language/*.php):
- Add _OGRAPH - Open Graph toggle label
- Identical in all languages (technical term)
- Add _OGRAPHT - Open Graph template field label
- Translated per language
- Add _SCHEMA - Schema.org toggle label
- Identical in all languages (technical term)
- Add _SCHEMAT - Schema.org template field label
- Translated per language
- Add _TPLVARS - Template variables reference with descriptions
- Format: <b>[var]</b> - Description (matches existing _TPINFO style)
- Each variable on its own line via <br>
- Fully translated descriptions per language
- Admin config module (admin/modules/config.php):
- Replace 4 hardcoded strings with constants _OGRAPH, _OGRAPHT, _SCHEMA, _SCHEMAT
- Replace hardcoded variable list with _TPLVARS in both OG and Schema.org template fields
Benefits:
- Admin panel now fully translatable for OG/Schema section
- Variable descriptions visible to admin with bold formatting
- Consistent style with existing _TPINFO constant pattern
- Zero hardcoded strings remaining in SEO config section
Technical notes:
- _TPLVARS uses HTML (<b>, <br>) consistent with _TPINFO
- HTML5 <br> used (not XHTML <br/>)
- Constants appended after _SEOCTITLE group in each language file
Addresses 6 distinct errors found in config/logs/error.txt (17.02.2026). All fixes eliminate PHP 8.x warnings without changing business logic.
Core changes:
- engines_word() (core/system.php):
- Add null coalescing for missing query key in parse_url() result
- Fixes 116 log entries: Undefined key "query" + parse_str(null)
- Triggered by referer URLs without query string
- checkFileChmod() (core/system.php):
- Create test file before chmod attempt, delete after test
- config/chmod.php is a temporary test file, must be created first
- Prevents chmod(): No such file or directory warning
- head() session cleanup (core/system.php):
- Guard unlink(sess.txt) with file_exists() check
- Prevents unlink warning when file was never created
- create_dump() (core/system.php):
- Add is_readable() check before md5_file()
- Skips files with permission denied (e.g. .htaccess)
- bb_decode() (core/system.php):
- Cast $sourse to string with null fallback before preg_replace
- Prevents str_replace(null) deprecation notice
- $file initialization (index.php):
- Replace undefined $file reference with ?: operator
- Fixes Undefined variable $file warning on line 39
Benefits:
- Error log reduced from 120+ entries to 0 for these error types
- No false warnings masking real errors in production log
- PHP 8.x deprecation notices eliminated