Журнал изменений

A :root block with named CSS custom properties is added to base.css and every hardcoded colour, size, and shadow value across base.css, theme.css, and basic-monitor.html is replaced with the corresponding token. No visual changes are intended — this is a pure token-extraction refactor.

Core changes:

1. base.css — design token block (:root):

• Colour palette: --sl-color-bg/-soft/-muted/-subtle, -border/-border-strong, -text/-text-soft, -muted, -primary (and -hover/-soft/-tint), -success (and -strong/-soft), -danger (and -strong/-soft), -warning (and -strong/-soft), -accent/-accent-soft, -info-soft
• Size tokens: --sl-size-control (28px), -pager (30px), -head (32px), -icon (18px)
• Radius tokens: --sl-radius-control (3px), -panel (4px), -soft (6px)
• Spacing tokens: --sl-space-xs (4px), -sm (6px), -md (8px), -lg (12px)
• Shadow tokens: --sl-shadow-soft, -control, -control-active, -hover-soft
• Typography tokens: --sl-text-shadow-light, -text-shadow-dark
• Focus token: --sl-focus-primary

2. base.css — all hardcoded values replaced:

• html background gradient, legend, body font colour, h2/h5, links, hr, inputs, blockquote, focus ring, required input colours

3. theme.css — all hardcoded values replaced:

• Buttons (sl-but-), callout blocks (sl-callout-) now use Bootstrap Icon via font-family bootstrap-icons on ::before; content codes updated to BI
• Status icons, sort arrows, toggle controls, tips, div-grid rows
• Block-sidebar, dashboard-panel, radio-switch, pager, alerts (sl-warn/sl-info)
• Debug sections, preview blocks, menu grid, session summary
• Table, tabs, voting widget, monitor, login shell — complete token migration

4. basic-monitor.html:

• SVG linearGradient stop-color and path stroke attributes for chart lines (gUp/gDown/gCpu/gRam) replaced with CSS var() references

Benefits:

• Single source of truth for all colour decisions; theme changes require only token updates in :root
• Enables future dark-mode or white-label overrides via a single :root block
• Removes ~300 scattered hex literals from stylesheets

Technical notes:

• CSS var() in SVG stop-color is supported in all modern browsers
• No Sass/PostCSS required; native CSS custom properties only
• Callout ::before now uses BI icon codes (f430, f26a, f33a, f622) replacing Unicode symbols; font-family declaration ensures correct rendering

The voting admin edit form is restructured to use toggle-form-block for each answer row, matching the pattern used in fields/rss/replace. getVotingView() gains a forceResult parameter so the admin preview always shows results regardless of vote state or user role.

Core changes:

1. modules/voting/admin/index.php:

• Table head adds is_col_title flag and explicit class_name for lang/module columns (sl-col-lang, sl-col-module) for fixed-width layout
• Title cell splits into prefix_html (info-tooltip) + has_content_text
• Answer input rows replaced with toggle-form-block: each answer pair (body[] text + answer[] number) lives in its own collapsible block; empty answers from index 1 onward are hidden by default
• getVotingView() called with forceResult=true so the admin preview is always in result-display mode

2. core/system.php — getVotingView():

• New $forceResult parameter (default false)
• When true: querylang is bypassed ('1 = 1'), rate forced to 1, result branch always taken, admin edit links suppressed, navigation links (polls, votes, comments) hidden; submit form also suppressed
• toggle_onclick removed from both image-preview calls in getEditorFiles()

3. core/admin.php:

• toggle_onclick removed from both image-preview calls in getAdminUploadFiles(); image-preview now uses data-sl-toggle-* via the template (set in the preceding template commit)

Benefits:

• Admin can preview voting results without casting a vote or ending the poll
• Answer fields follow the same expand/collapse UX as fields and rss modules
• No toggle_onclick parameters remain in core or voting module

Technical notes:

• forceResult=true suppresses is_moder() check and all front-end links; the preview is intentionally read-only and context-free

All manual htmlspecialchars() calls in admin module files are replaced by the new has_content_text / content_text, has_value_text / value_text, and has_field_text / field_text template slots. Escaping now happens inside the Mustache fragments at the output boundary instead of in PHP.

Core changes:

1. admins.php:

• Cell content for name, title, lang columns uses has_content_text; the concatenated htmlspecialchars($name) after info-tooltip moves to a separate content_text slot with prefix_html for the tooltip

2. blocks.php:

• filecode() form row for filename uses has_field_text / field_text

3. database.php:

• getSqltable() cells for type, table, sql use has_content_text
• dump() alert for parse error passes raw $parsed['error'] without manual escaping; the alert fragment handles output encoding

4. fields.php / replace.php:

• toggle_onclick replaced with toggle_target_id + is_toggle_block to wire the new button toggle; no htmlspecialchars changes (values are constants)

5. groups.php:

• Tooltip + badge cell splits into prefix_html (tooltip) + content_html (badge); color_attr no longer manually escaped

6. scheduler.php:

• nextr, stat, priority cells switch to has_content_text / content_text
• Title cell: info-tooltip moves to prefix_html, title text to content_text

7. security.php:

• banlist() tooltip items for IP_CIDR and BANN_REAS use has_value_text
• Ban reason cell uses has_content_text
• config() textarea value_text for dump_skip loses manual htmlspecialchars

Benefits:

• Removes ~20 htmlspecialchars() calls from PHP business logic
• Escaping is now consistently enforced at template render time
• Callers read cleaner: no ENT_QUOTES / ENT_SUBSTITUTE flags in PHP

Technical notes:

• Template fragments updated in the preceding commit handle escaping via Mustache {{ }} (auto-escaped) vs {{{ }}} (raw HTML) distinction

Six new template fragments are introduced to support the voting admin redesign and to provide reusable list and AJAX-action primitives.

Core changes:

1. comment-action-ajax.html (fragment):

• HTMX-powered action link with hx-get, hx-target, hx-swap attributes
• Supports class variants: is_favorite, is_button_blue, is_cart_plus, is_cart_minus; used as the Vote submit button in voting widget

2. editor-action-menu.html (fragment):

• Alternative row-actions variant using bi icon as trigger span directly without the wrapper nav structure; kept for editor-specific contexts

3. list-item.html (fragment):

• Minimal <li> wrapper supporting content_html and nested children_html

4. list.html (fragment):

• Renders <ul> or <ol> with conditional class variants: sl-list, sl-sublist, sl-sublist-two, login-top (with logged state)

5. voting-view.html (fragment):

• Single poll answer row: answer text, percentage, vote count, and a <meter> progress bar with colour variant class sl-vote-meter-N

6. voting-widget.html (partial):

• Full voting widget section: title header, answer list, admin links, submit button, vote/comment footer links; wraps optional <form> tag

Benefits:

• Voting result display fully template-driven, no HTML generation in PHP
• List and action fragments reduce ad-hoc HTML in module files

Technical notes:

• voting-widget.html replaces the HTML previously assembled in getVotingView() inside core/system.php
• CSS for sl-vote-* classes is added in the accompanying style commit

Admin data-display fragments gain a safe-text rendering path so callers can pass raw PHP strings and let the template apply htmlspecialchars, instead of calling htmlspecialchars in PHP before passing content_html. This makes escaping responsibility explicit and template-side.

Core changes:

1. table-cells.html:

• Add is_col_title class flag → outputs sl-col-title on th and td
• Add prefix_html slot rendered before content in each cell
• Add has_content_text / content_text: auto-escaped text path replacing manual htmlspecialchars in PHP callers

2. th.html:

• Mirror is_col_title class support to header cells

3. label.html:

• Add prefix_html slot (renders before label content)
• Add has_content_text / content_text safe-text path
• Existing content_html path preserved as fallback

4. info-tooltip.html:

• Add has_value_text / value_text on tooltip items, escaping value server-side in template instead of in PHP

5. div-row.html:

• Add has_field_text / field_text path for form rows that display plain text values; applies to both wrapped and unwrapped field variants

Benefits:

• Removes htmlspecialchars() from PHP call sites; escaping is done once in the template layer at the correct output boundary
• prefix_html enables tooltip + text combos without wrapper <span>

Technical notes:

• All existing content_html paths remain fully backward-compatible
• is_col_title maps to a new CSS class added in the accompanying style update