Журнал изменений

"Журналы" leave "Безопасность" for a section of their own, and the settings of the copies and the scanner move to the forms of their jobs. The repeated audit of the panel fixes what axe and a live screen reader found over 249 screens. The lasting part of the panel plan moves into the documents, with the page measurements it left for this step. The three share files down to the language files and the probes, so they land together at the owner's word.

Core changes:

1. The journals (admin/modules/logs.php, admin/modules/security.php, admin/modules/scheduler.php):

• name=logs holds the list, op=logview, op=logins, op=download and op=delete under the token and the journal of logs
• the first tab of "Безопасность" is the ban list with the verdict of the self-check
• log_b, dump_age, log_d, dump_skip and mail_d stand on the forms of the jobs dbbackup and filescan
• every form writes its own fields, so configsave() no longer loses proxy (SecurityFormTest)
• sess_d, sess_b and their constants are gone, _LOGS replaces _MONITOR_LOGS

2. The audit (public/templates/admin, public/plugins/system/slaed.js, public/plugins/editors/toastui, tools/label-audit.mjs):

• landmarks and names: one main on a page, the login and setExit() in the admin theme, the lamps, the code blocks, the editor
• keys and state: Space sorts by a head cell, a strip of links marks its page with aria-current
• targets and contrast: 24 px or the spacing of WCAG 2.5.8, the strong tones of the light scheme, the skin of Toast UI
• the file manager keeps a long name in its ellipsis, a phone scrolls its table
• an address of the panel that names no section answers 404 (AdminLogTest)
• the label crawl opens the screens it passed by, tools/ui-audit-baseline.json and tools/ui-contrast.json stored anew

3. The reference (docs/TEMPLATES.md, docs/ARCHITECTURE.md, docs/PERFORMANCE.md, admin/info/panel/ru.md):

• "Parts Of A Screen", "The Engine Of The Parts" and "What the audit of the panel left" in the templates
• the two lamps, the data of "Статистика" and "Мониторинг", the robots and the sections that stay apart in "Admin Shell Boundary"
• the generation, the queries and the polls of both screens, measured on the stand
• section 12 of the help of the panel, and the words of removed things out of two help pages

Benefits:

• A journal is found where its name says, and the settings of a job stand beside that job
• The panel passes axe at two widths in both schemes, with what stays listed and reasoned in the documents
• The plan file can go: what the series decided and measured stands in the tree

Technical notes:

• config/security.php loses sess_b and sess_d, config/modules.php gains the row logs; setUpdateConfig() and setUpdateMerge() drop the keys from a site
• Not breaking for a site: the merge of an update adds the section; the addresses name=security&op=logview and op=logins are gone
• StatisticDataTest::theArchiveHasItsGap stays red since 2026-11-01: statistic_probe.php calls getStatArchive() without its clock, a defect of the test

"Загрузки" becomes "Файловый менеджер". "Редактор" and "Шаблон" leave as sections: their files open in the one browser, a theme as a context that only views and edits, in place of one editor per file on a single page. The screens of the block files and of the XSL stay where they are and save through the same writer, so a stale save is refused everywhere.

Core changes:

1. The file layer (core/classes/filemanager.php, core/admin.php):

• the context theme of FileManager over public/templates/<theme>: browse, preview, download and edit alone
• .htaccess and xsl open in the source editor, as apache and xml
• getAdminFileTheme() takes a folder name and builds no path from the client, getAdminFileQuery() carries ctx and templ
  • getAdminFileBack(), getAdminFileHome() and getAdminFileRel() replace the addresses and names each screen spelled out
• getAdminFileLinks(): direct links to robots.txt, .htaccess and header.php over the tree of the system files

2. The section (admin/modules/uploads.php, config/modules.php):

• the tab op=theme with the list of themes and the warning of Update::THEMES, the tab "Шаблоны вложений"
• getUploadsTabs() replaces the seven copies of the strip
• getRobotsTemplate() and the button of the standard rules move here, into the foot of the editor of that file
• the row uploads takes _EUPLOAD, the rows editor and template are gone; the key name=uploads does not change

3. One writer (admin/modules/blocks.php, modules/sitemap/admin/index.php):

• filecodesave() and xslsave() write through setFileBody(), a new file first through addFileEntry()
• a stale save answers 409 and keeps the typed text (getBlockCodeForm(), getXslForm())

4. The removed sections (admin/modules/, admin/info/, admin/lang/):

• editor.php, template.php and their help are deleted, the help of the section holds what is current
• _EFUNC, _EHEAD, _EHT, _EINFO, _EROB, _ERON, _ESAVED with their variants, _TEMPLATES and _STYLES leave the six locales
• _UPLOADS_TPLS and _UPLOADS_QUICK are added, _EROBSTD and _EINFOPHP stay

5. The stub and the update (config/system.php, core/system.php, core/classes/update.php, public/update.php):

• config/system.php, which nothing included, is deleted with its place in the loader, setConfigFile() and isSiteFile()
• setUpdateModules() moves the file of an old site to system.php.old, as the loader would now require it, and stops when it cannot
• setUpdateModules() renames a stored _UPLOADS to _EUPLOAD; the records of the two sections drop as any without a module

6. Templates (public/templates/admin/):

• the strip of the direct links in file-browser.html, the slot of window-foot-edit.html, the button of the robots rules

7. Reference (docs/, UPGRADING.md, CONTRIBUTING.md, admin/info/, modules/*/admin/info/):

• "Compile And Render" and "Editing A Theme From The Panel" in docs/TEMPLATES.md, the entry in docs/VERSIONS.md
• UPGRADING.md names the new addresses and what to do with code left in config/system.php

8. Tests and tools (tests/, tools/):

• FileManagerEditTest holds the theme context and the one writer, FileManagerCatalogTest the root of the area
• UpdateSetupTest holds the rename and the move of the old file, its failure included
• the probes and ReleaseToolTest take header.php as the reserved file; ui-shots.json and ui-contrast.json name the new pages

Benefits:

• A theme opens one file at a time instead of 221 editors on one page
• Every save of a file of the panel compares a version under the directory lock
• Four sections become one, where an administrator looks for files

Technical notes:

• The screens name=editor and name=template are gone; every other address of name=uploads stays
• config/header.php opens whole, with its first lines, which are no longer stripped and added back
• A theme now edits any text file up to 2 MB, not only html and css; the screen is the super administrator's alone
• No schema change; a site rebuilds config/local.php for the new section registry

The last small findings of the panel audit are closed. A file name in an address could ban a visitor as an attack, a save of the upload settings rewrote a zero the form promises to keep, the presentation invented its visitors, and the fields of the site had no name. Each is corrected at its source, and what the audit reported but the current code no longer shows was measured and left alone.

Core changes:

1. The attack detector (core/security.php):

• checkGet() and checkCookie() take the SQL keywords only where no letter touches them
  • Eyedropper-....gif in key= no longer writes hack.log, queues a mail or, with the block setting, bans the visitor
  • the bound is letters and not \b, as /!50000UNION/ has a digit before the word
• a keyword beside a digit or a separator still counts, and so does the name of a table with the prefix

2. The upload limits (admin/modules/uploads.php):

• configsave() keeps a 0 in moderfiles, userfiles and guestfiles, as _CONFINES and getEditorFileJson() read it: no limit
• a save without an edit no longer turns the userfiles and guestfiles 0 of the row layout into 100

3. The presentation (modules/presentation/index.php):

• "Онлайн" shows getSessionCounts() alone, the floor 48 + visits % 37 is gone
• the cache chart stays staged, as the comment of getPresentationData() says

4. Muted zeros and the warning tone (admin/modules/database.php, public/templates/admin/):

• a zero of "Расходы" takes sl-muted, an InnoDB value that is not zero the plain tone, and the help says so
• is_dimmed leaves the admin inline-badge.html, so sl-dimmed of the panel is the menu row that is off
• the light --sl-warning-strong of the admin theme goes to #b23b0b: sl-chip-warn over the sidebar reads 4.53:1, it read 3.98:1

5. The fields of the site (modules/search, modules/account, modules/forum, modules/node, core/user.php, public/templates/lite/):

• search, registration, the profile, the feed box of the cabinet, private messages, a material and the forum name every field
  • label_for and an id in the form rows, aria_label where no label stands, select_label of form-submit.html
• the list of search applies by its button, so the required word is held by the form; RSS keeps its submit on change, as its section rebuilds the categories of the form on the server

6. CodeMirror (public/plugins/system/editor.js):

• getAreaAttr() gives the editable area tabindex="0": it was a Tab stop already, and axe now counts its scroller as reachable

7. Tests and tools (tests/, tools/):

• UpdateConfigTest holds that the version of the old site is not carried, in place of a comparison of null with null
• InputFilterTest holds the bounds of the detector, UploadIntegrationTest the zero of the save
• PanelPartsTest holds the site modules too, but for RSS
• label-audit.mjs counts an image with its alt in a label as its text; the baseline holds no entry, 492 routes
• ui-contrast.json is written anew for the moved tone, ui-audit-baseline.json is stored

8. Reference (docs/VERSIONS.md, admin/info/database/ru.md):

• the entry of the change and the column "Расходы" in its current state

Benefits:

• A file name no longer costs a visitor a ban, and the injection forms the detector caught are still caught
• A setting means what its hint says, and a number on the presentation is a real one where the page claims it
• The label crawl of the panel and the site runs against an empty baseline

Technical notes:

• No schema, URL or API change; config/uploads.php stays as shipped
• A save of the upload settings on a site where 0 was typed now keeps the 0, which lifts the limit
• A keyword standing alone in a value still counts as an attack, as before: drop_down.gif, or a search for select

A section of the panel can be delegated, and two of them handed out credentials with it: the settings of "Пользователи" gave and took the OAuth keys, and the settings of "Журнал изменений" gave the GitHub token in the value of its field. The keys move to "Безопасность", which is the super administrator's alone, and the access to GitHub stays with that administrator.

Core changes:

1. The OAuth keys (admin/modules/security.php, modules/account/admin/index.php, admin/lang/*.php):

• the tab "OAuth-ключи" of "Безопасность", op=oauthkeys and op=oauthsave, with the fields and the write of config/oauth.php
  • the write keeps merging over the stored file, so the endpoints the form does not carry stay
• config() and save() of the account module no longer draw or write them; op=oauthlist stays in "Пользователи"
• the constant _SEC_OAUTH in the six languages

2. The access to GitHub (modules/changelog/admin/index.php):

• source, ghowner, ghrepo and ghtoken are drawn and written for isAdmin(true) alone
  • with an owner or a repository of their choice another administrator would send the site there with the token
• a save by another administrator keeps the stored four and changes the other settings

3. Tests and tools (tests/Unit/AdminSecretTest.php, tests/Support/route_probe.php, tools/label-audit.mjs):

• AdminSecretTest holds both over real requests: what a delegated administrator sees and writes, what a super administrator does, a save without the token, and that no journal holds a value
• the label crawl opens op=oauthkeys

4. Help and reference (admin/info/security/ru.md, modules/account/admin/info/ru.md, modules/changelog/admin/info/ru.md, docs/VERSIONS.md, UPGRADING.md):

• how to get the keys moves to the help of "Безопасность"
• OAuth in the help of "Пользователи" is a section of its own, no longer inside the settings of the module
• the help of "Журнал изменений" says who sets the source and the access

Benefits:

• Delegating "Пользователи" or "Журнал изменений" no longer hands out a credential or the use of one
• The keys live beside the other settings only the super administrator reaches

Technical notes:

• Breaking: op=save of name=account no longer takes the fields oactive, gactive, gclientid, gsecret, mactive, mclientid and msecret; they go to name=security&op=oauthsave
• Breaking: the tab "Конфигурации" of name=security moves from index 4 to index 5
• No schema change and no step of a version; the stand database keeps only the login rows of the check
• config/layout.php and config/security.php are not part of the commit

The engine of the series lands in the admin theme and the screens "Статистика" and "Мониторинг" are rebuilt on it by their data. The other screens of the panel take the window, the tiles, the meters on top and the mark "i", and the counter of the statistics becomes the only record of visits, so the module "Переходы" is gone.

Core changes:

1. The engine of the series (public/templates/admin/assets/js/admin-ui.js, core/helpers.php, tests/Unit/DecimalTextTest.php):

• the live chart with its glide and guide, the day columns, the archive strip, the rhythm, the week by hours
• the stack, the bar rows, the table of days, the figure apart from its text
• filterDecimal(), with filterSize() through it

2. "Статистика" (admin/modules/statistic.php, core/monitor.php, public/templates/admin/partials/cockpit.html, statistic-cockpit.html, fragments/series.html, tests/Unit/StatisticDataTest.php):

• getStatData() gives the dial of the day, the windows, the log of days and op=live
  • the archive strip is kept in storage/counter/archive.json, built on the first opening
• the GD chart, statistic-extended.html and the settings bet and shi are gone

3. "Мониторинг" (admin/modules/monitor.php, core/monitor.php, partials/monitor-cockpit.html, tests/Unit/MonitorSignalTest.php):

• the pulse and thirteen signals of getServerSignalList(), getServerLamp() and getSupportEnd()
• the tiles over the live chart, the windows, the findings of the audit
• op=live takes the place of op=status, op=traffic and op=sync
• basic-monitor.html, monitor-chart.html, .sl-monitor-card and the part signal are gone

4. The screens of the panel (admin/modules/newsletter.php, database.php, security.php, config.php, update.php, modules/search/admin/index.php, modules/sitemap/admin/index.php, modules/master/admin/index.php, core/admin.php):

• the window, the tiles and the meters on top on the screens of the inventory of ADMIN-UX.13
• the meter of a campaign only with a real limit, a campaign with nothing expected shows its figures alone
• the quota of "Загрузки" over the file list, by Upload::getUsedBytes(), made public

5. The parts under the screens (core/helpers.php, core/system.php, partials/admin-list.html, fragments/pane-cap.html, popover.html, meter.html, file-browser-props.html, partials/file-browser.html, theme.css, base.css):

• getTplMeter() moves from the monitor into the helpers, with the row form sl-meter-row
• getTplLongCell() and CELL_LONG open a value of 16 characters or more behind the mark, a shorter one keeps its title
• the key pane of getTplAdminList() puts a list inside a window, by the one head pane-cap.html
• a cut cell that ends a row stays inside the table, the open overflow of a last cell belongs to the dial
• a status wraps instead of covering its neighbour, --sl-col-sent-width takes a figure with its word

6. Visitor accounting (core/security.php, core/system.php, public/index.php, config/statistic.php, config/global.php, config/modules.php, admin/modules/statistic.php, admin/modules/config.php, core/classes/cache.php, storage/update/sql/table.sql, table_update6_3.sql, modules/search/index.php, tests/Unit/StatsContractTest.php):

• a line of statistic.log gains the hosts, the landing pages, the names and the types of robots
  • a full field lets a frequent key in by evicting the rarest
• a source counts the start of a session only, the new source ai is checked first
• getBotInfo() reads the masks of five types, getVisitBot() adds a visit without Accept-Language as a robot
• the lists and the masks move to the settings of the statistics, the tab "Краулеры" of the configuration is gone
• admin/modules/referers.php, config/referers.php, the table _referer and the log of addresses are gone
• Cache::setBody() retries a rename on a busy file

7. Reference, help, tests and gates (docs/TEMPLATES.md, docs/VERSIONS.md, docs/UPDATE.md, docs/NODE.md, UPGRADING.md, README.md, admin/info//ru.md, modules//admin/info/ru.md, admin/lang/*.php, public/demo/, tests/Unit/PanelPartsTest.php, tests/Support/panel_probe.php, monitor_probe.php, statistic_probe.php, decimal_probe.php, tools/):

• the help of every changed screen, the constants in the six languages, the contract and the key pane of the list
• PanelPartsTest holds the meter, the mark and the window of a list by their keys and their escaping
• the baselines stored from the tree

Benefits:

• The two richest screens and the rest of the panel are built of one set of parts
• A long value is read whole behind one mark, a figure shows as a meter only where a real limit stands behind it
• One record of visits replaces two mechanisms, and a robot no longer writes search words or enters "Аудитория"

Technical notes:

• Breaking: name=referers, the table {prefix}_referer and config/referers.php are gone; is_bot(), from_bot(), engines_word() and updateRefererTrack() are gone, custom code calls getBotInfo(getAgent()); bots and fbots left config/global.php
• Breaking: the tabs of name=config after "Цензура" moved up by one: the cache is tab=4 and the mail is tab=5
• Breaking: op=status, op=traffic and op=sync of the monitor give way to op=live; the settings bet and shi are gone
• The stand database changed: DROP TABLE {prefix}_referer on another machine, also after loading a dump
• config/layout.php and config/security.php are not part of the commit