Журнал изменений

Align every editor surface with the active theme's visual language and add a size-limited base64 embed option to the image dialog. Harden the integration with the vendor engine after three virtual-DOM regressions.

Core changes:

1. Theme token contract (templates/*/assets/css/base.css):

• field group (--sl-field-*), --sl-color-text-heading, --sl-color-on-dark, --sl-color-primary-hover, --sl-radius-card, --sl-shadow-input canonized; admin defines the field group, lite gains primary-hover
• --sl-field-focus-ring is a color composed as 0 0 0 3px var() in place

2. Editor skin vendor alignment (templates/*/assets/editors/toastui/skin.css):

• chrome, work area, toolbar states, mode switch, dropdown, popups, buttons, inputs, tabs, table selector, context menu, focus rings, selection, placeholders, md syntax accents and WYSIWYG content colors mapped to tokens
• one control standard across all windows: theme font chain (vendor font stack removed), fields 32px/12px/field tokens, buttons 32px/12px, hints 11px; emoji tabs restyled as the popup button pair with primary active
• toolbar header painted by the wrapper (rounded corners fixed), md tab bottom border restored, popup pinned to the right edge by CSS instead of the racy JS left assignment

3. Image dialog (plugins/editors/toastui/, templates/*/partials/):

• three insert modes as theme-owned radios: upload to server (default), attachment thumbnail, and NEW base64 embed into the text with a 32 KB client limit (_EMODE* constants in all six locales)
• file selection uploads automatically (no OK click), drag and drop included
• system sl-alert everywhere: upload limits, messages and errors render in an extras strip; file field and hints unified with the file manager

4. Vendor virtual-DOM integration hard rules (editor-upload.js):

• no foreign DOM inside vendor popups: SLAED nodes live in the extras strip and absolutely positioned blocks raised together with the window
• vendor node text patched via nodeValue, never textContent
• popup closing detected by a MutationObserver on the popup style attribute, fixing stuck header strips for guests and async close paths

5. Fullscreen (editor-tags.js):

• height driven by the engine setHeight('100%') with save/restore, bottom tabs and mode switch stay visible; the 100vh CSS override removed

Benefits:

• Switching a theme now changes the complete editor look including geometry
• Anonymous and privileged flows verified end to end without JS errors
• docs/DATA-URI-SECURITY-PLAN.md records the follow-up server-side hardening

Complete the 'theme owns visuals, plugin owns mechanics' migration: every SLAED-authored visual asset now lives in the theme, plugins keep only logic and versioned vendor engines, and switching a theme changes the entire look.

Core changes:

1. Editor asset contract (core/classes/editor.php, plugins/editors/toastui/):

• Theme skin moved to templates/<theme>/assets/editors/toastui/skin.css
  • loaded by Editor::getThemeSkin() right after the engine CSS
  • resolved from the effective editor key after all fallbacks
  • deduplicated per theme:key pair, missing declared skin is logged
• Dialog markup moved to theme partials editor-toastui-{dialogs,files,templates}.html
  • dialogs partial renders window headers via a template loop
  • EditorToastTemplate bypass class deleted, standard getHtmlPart() used
• Plugin JS builds no markup: emoji panel and file manager clone theme-owned <template> blocks and fill textContent/src/data-* only
• Plugin JS renamed to editor-{tags,emoji,upload}.js; dead unminified vendor build toastui-editor.js removed

2. Theme structure validator (core/system.php):

• checkThemeAssets() checks the canonical structure including editor assets declared in editor manifests
• applied on all theme selection paths: user list/save, admin user edit, global config, getTheme() runtime guard

3. Avatars (core/user.php, modules/account/index.php, setup/):

• system avatars and presets live in templates/<theme>/images/avatars/
• getUserAvatarUrl() resolves presets/system from the active theme and accepts only the canonical presets/<name>.<ext> format
• idempotent upgrade migration added to table_update6_3.sql with a PHP-side verification counter in setup

4. Icons and tokens (templates/, core/security.php):

• Bootstrap Icons vendor directory renamed to assets/vendor/bootstrap-icons/
• canonical token dictionary normalized: primary, bg-soft, text-muted, shadow-panel replace brand-link, surface, muted, shadow-medium everywhere
• setExit() uses getThemeAssets() for emergency pages, getThemeCssFiles() and the manual icon CSS include removed
• editor classes renamed to sl-editor-icon-* / sl-editor-emoji-*
• toolbar icon color now follows --sl-color-text-muted
• img_find() renamed to getThemeImagePath()

5. Multilingual search (lang/, plugins/editors/toastui/assets/i18n/, templates/admin/assets/js/):

• emoji set stored as plain symbols, names and search keywords generated from Unicode CLDR for de/en/fr/pl/ru/uk with localized tooltips
• editor labels moved to language constants (_EEMOJI*, _ETABS) in all six locale files
• admin icon picker searches by official Bootstrap Icons tags plus CLDR-derived locale term maps, lazy-loaded on first open

Benefits:

• A theme is a complete, replaceable visual package validated on activation
• Editor CSS order is deterministic: engine first, theme skin second
• No innerHTML markup in plugin JS; designers restyle without touching plugins
• Reproducible avatar migration for existing installations

Add a responsive profile redesign showcase centered on the refined Dense Split concept, with complete account details, trust signals, ratings, module activity, and administrative actions.

Core changes:

1. User profile showcase (demo/user-profile-2026.html):

• Add sixteen responsive profile design variants based on the lite theme system
• Refine Dense Split with complete user data, trust proofs, rating controls, module statistics, and social and administrative actions
• Add switchable activity feeds with threshold-based auto-scrolling and system chips for dates, ratings, and bookmarks

Benefits:

• Provides a detailed visual foundation for the production profile redesign
• Reuses established theme controls, tokens, icons, and interaction patterns

Technical notes:

• Keeps demo-specific CSS and JavaScript inline in the standalone HTML file
• Does not change backend APIs, database schema, routes, or production templates
• Preserves existing production behavior

Keep the guest user block compact and prevent session-bound tokens from breaking its read-only Live refresh.

Core changes:

1. Live session endpoints (index.php):

• Exempt only public read-only session summary and row requests from CSRF validation
• Keep login and state-changing routes protected

2. Guest presentation (templates/lite):

• Restore the online chip and correct greeting order
• Smooth guest action hover states and remove artificial vertical gaps

Benefits:

• Prevents intermittent token mismatch alerts during Live refresh
• Keeps the Dense Login layout compact and predictable

Technical notes:

• No database schema changes
• Public session endpoints remain read-only
• Existing protected actions retain CSRF validation

Add reusable sharing, favorites, live-status, and modal interactions across frontend and admin views. Consolidate browser behavior and template hooks, refresh localized labels, and replace obsolete UI demos with focused component examples.

Core changes:

1. Interactive controls (core/system.php, core/user.php, plugins/system/slaed.js):

• Add canonical sharing with QR, copy, and social network actions
  • Keep comment and forum links stable across pagination and HTMX updates
  • Reuse global confirmation and share dialogs
• Optimize favorite-state rendering and add live refresh controls

2. Template integration (templates/admin, templates/lite):

• Add reusable modal, favorite, freshness, live-chip, and share fragments
• Align admin and frontend styles with the consolidated interaction model

3. Module and demo coverage (modules, demo, lang):

• Wire sharing and favorite controls into supported content modules
• Synchronize interface labels across all active locales
• Replace outdated demo laboratories with focused UI reference pages

Benefits:

• Consistent interactive behavior across modules and asynchronous updates
• Fewer duplicate controls and database lookups
• Clearer template ownership and reusable frontend primitives

Technical notes:

• No database schema changes
• Existing public routes and module contracts remain compatible