Журнал изменений

Resolves PHP warnings caused by uninitialized variables and unsafe array access across core attachment handler, forum, account, and template modules.

Core changes:

1. Attachment encoder (core/system.php):

• Initialize $timg, $width, $height before conditional branches
  • Prevents "undefined variable" notices when attachment is not an image
• Add isset() guards for $date[4][$i] and $date[5][$i]
  • Avoids "undefined index" when optional dimensions are missing
• Cast $timg to (string) for str_replace() safety

2. Account profile view (modules/account/index.php):

• Initialize $rgroup as empty array and $uranks as empty string
  • Prevents notices when user has no rank groups or point system is off

3. Forum module (modules/forum/index.php):

• Initialize $massiv, $cmassiv, $where, $umassiv as empty arrays
  • Prevents "undefined variable" if early return paths are taken
• Add is_array() + !empty() guard for $userinfo before accessing keys
  • Handles guest/anonymous users who return non-array from getusrinfo()
• Add is_array() + !empty() guard for $umassiv before foreach loop
• Fix missing newline at end of file

4. Template avatar display (templates/lite/index.php):

• Add is_array() + !empty() guard on $userinfo before avatar access
  • Prevents file_exists() warning when getusrinfo() returns non-array
• Extract avatar value into $uavatar with safe fallback

Benefits:

• Eliminates PHP notice/warning log noise in production
• Prevents potential errors for guest or edge-case user states
• Consistent defensive initialization pattern across modules

Technical notes:

• No behavioral changes for normal authenticated users
• All fallback values match existing implicit PHP defaults
• Backward compatible with current template and module contracts

Condense the inline comment for the PATH_INFO rejection block to a concise single-line description.

Core changes:

1. Comment update (security.php):

• Replace verbose multi-clause comment with shorter form
  • Keeps same technical meaning in fewer words

Add 41 new unit tests covering password hashing, input filtering, and template conditionals to establish a regression baseline before the upcoming security hardening changes.

Core changes:

1. Password hash tests (PasswordHashTest.php):

• Verify md5_salt() algorithm: md5(md5(salt) . md5(pass))
  • Consistency, hex format, salt dependency, known values
  • Unicode and special character handling
• Validate future bcrypt format for migration readiness

2. Input filter tests (InputFilterTest.php):

• num_filter: digit extraction, non-numeric handling, edge cases
• var_filter: allowed chars, Unicode support, XSS prevention
• isVar: alphanumeric validation, array handling
• text_filter: HTML escaping, BBCode stripping, type modes
• url_filter: protocol prefixing, empty handling
• save_text: quote/dollar/backslash escaping

3. Template conditional tests (TemplateIfTest.php):

• setTemplateIf: true/false branches, else blocks
  • Nested conditions, string true/false coercion
  • Undefined flags, multiple independent ifs
  • Whitespace tolerance in tags

Benefits:

• Regression safety net before password_hash migration
• Baseline for eval() removal in template system
• Validates filter behavior before SQL parameterization

Technical notes:

• Uses algorithm replicas to avoid system.php dependency chain
• All 113 project tests pass (54 new + 59 existing)
• No changes to production code

Admin editor flag $admin[3] was accessed without null check in admin.php and had inconsistent default value (1) in system.php textarea functions.

Core changes:

1. Admin editor flag guard (core/admin.php):

• Add isset($admin[3]) check with default 0
  • Prevents potential warning if admin session data is incomplete

2. Normalize editor defaults (core/system.php):

• Change default from 1 to 0 in textarea() and textareae()
  • Aligns with security.php pattern: ($admin[3] ?? '') -> (int)'' = 0
  • Default 0 = no visual editor when flag unavailable

Benefits:

• Consistent default behavior across all $admin[3] access points
• Defensive coding against incomplete session data

Technical notes:

• $admin[3] stores editor flags, first char = visual editor toggle
• No runtime errors observed yet (admin always authenticated), but guards added for robustness and PHP 8.1+ strict compliance

RSS feeds returned SQL syntax errors for all module types (news, files, pages, shop, faq) due to missing $confrs variable in function scope, causing truncated LIMIT clause. SQL error logging was also corrupted by text_filter() stripping <= operators from logged queries.

Core changes:

1. RSS feed SQL fix (core/user.php):

• Add $confrs to global declaration in rss_channel()
  • require_once was skipped because rss.php already loaded in system.php
  • $confrs undefined caused $num=null, producing "LIMIT " without value
• Replace deprecated $_GET access with null coalescing operator
  • $_GET['name'], $_GET['cat'], $_GET['num'], $_GET['id']

2. SQL error logging fix (core/security.php):

• Replace text_filter() with htmlspecialchars() in error_sql_log()
  • text_filter() used strip_tags() which treated <= as HTML tag
  • All SQL after <= NOW() was silently stripped from error logs

Benefits:

• RSS feeds now work correctly for all module types
• SQL error logs show complete, untruncated queries
• Eliminates PHP 8.1+ undefined array key warnings in RSS

Technical notes:

• Root cause: system.php:35 loads rss.php globally, require_once in rss_channel() was a no-op, $confrs stayed undefined in function scope
• Affected ~30+ SQL errors per day from bot/crawler RSS requests