Журнал изменений
Rewrites the changelog admin config form to use the new/form rows array and new/* fragment components, adds CSRF token validation on configsave, and updates chlogRenderCommitStats() in common.php to render file lists and stats with inline HTML when running in the admin context (ADMIN_FILE defined) instead of depending on deprecated changelog-file-row and changelog-stats fragments; removes three legacy HTML fragment files.
Core changes:
- Config form (modules/changelog/admin/index.php):
- Replaced getTplAdminNavi with getTplAdminTabs in changelog() and config()
- Replaced new/alert frag key 'alert' with 'new/alert' for consistency
- Config form rebuilt as new/form with rows array: source select with new/label-hint, GitHub fields with conditional row_class, numeric inputs, and radio groups via getTplRadioGroup
- configsave() now validates CSRF token via checkSiteToken('changelog')
- Main changelog view wraps content in getHtmlPart('box') with checkPerms()
- Dual-context rendering (modules/changelog/common.php):
- chlogRenderCommitStats(): when ADMIN_FILE is defined, renders file list and stats as raw inline HTML instead of calling legacy fragment functions
- Frontend path unchanged: continues using changelog-file-row / changelog-stats
- Template cleanup (templates/admin/fragments/):
- Removed: admin-chlog-config-rows.html, admin-chlog-config-script.html, admin-chlog-source-select.html
Benefits:
- Config form no longer depends on legacy HTML fragments
- Admin file-stats rendering decoupled from frontend fragment contract
- CSRF-safe config saves with named token scope
Technical notes:
- Frontend template fragments (changelog-file-row, changelog-stats) unchanged
- No schema, URL, or stored-data changes
Rewrites the auto_links admin module to use the new unified fragment API and strengthens security by adding CSRF token validation on all state-mutating actions (delete, hitreset, zerodel, configsave); removes six legacy HTML fragment files that were replaced by inline new/* fragment calls.
Core changes:
- List and stats views (modules/auto_links/admin/index.php):
- Replaced getTplAdminNavi with getTplAdminTabs; added getSiteToken() to hitreset and zerodel tab URLs
- Rewrote row rendering with new/table-row, new/table-cells, new/row-actions
- Config form rebuilt using new/form rows array and new/select, new/input
- Replaced getTplAdminForm / getTplBox with new/form + getHtmlPart('box')
- Stats view: table head and rows migrated to new/table + new/table-row
- CSRF hardening (modules/auto_links/admin/index.php):
- delete(), hitreset(), zerodel() now check checkSiteToken(); skip mutation and redirect with _TOKENMISS warning on failure
- add() save path checks checkSiteToken() before INSERT/UPDATE
- Template cleanup (templates/admin/fragments/):
- Removed: admin-auto-links-add-rows.html, admin-auto-links-config-rows.html, admin-auto-links-list-row.html, admin-auto-links-stats-head.html, admin-auto-links-stats-row.html, admin-auto-links-stats-search.html
Benefits:
- CSRF-safe: all write operations require a valid site token
- Legacy fragment files eliminated; rendering fully handled in PHP
- Config form uses structured rows array for consistency with other modules
Technical notes:
- Prepared statements were already in use; no SQL API changes
- No schema, URL, or session-API changes
Rewrites the account admin module to align with the new unified admin fragment API introduced across all admin modules: replaces legacy getTplAdminNavi, getTplAdminTableHead, getTplAdminActionMenu, getTplBox, and radio_form calls with new/table, new/row-actions, new/form, new/alert, and getTplAdminTabs; extracts getAccountSearch() as a standalone function and adds proper CSRF token guards and getSiteToken() on all state-changing actions.
Core changes:
- Account list (modules/account/admin/index.php):
- Replaced getTplAdminNavi with getTplAdminTabs and subtitle_html parameter
- Rewrote row rendering: new/table-row, new/table-cells, new/row-actions, new/title-tip
- Added filterTextHighlight() for search term highlighting in all relevant columns
- Extracted getAccountSearch() as named function; moved search form to subtitle_html slot
- Replaced getTplPager with inline pagination using new/pager-link and new/pager-dots
- Account config (modules/account/admin/index.php):
- Replaced getTplBox + form-conf fragment with new/form rows array
- Replaced radio_form() / getTplSelect() with getTplRadioGroup / new/select
- Added CSRF token hidden field to config form via getSiteToken()
- Replaced getTplCodeEditor call with updated signature pattern
Benefits:
- Consistent admin UI: all controls rendered via unified new/* fragment API
- CSRF-safe: all state-mutating actions guarded with getSiteToken()
- Search now highlights matched text in ID, name, IP, and email columns
- Config form no longer depends on legacy form-conf HTML fragment
Technical notes:
- getAccountSearch() is module-private; not exported or shared
- Pagination logic moved from getTplPager to inline loop with new/pager-link
- No schema, URL, or session-API changes
The previous commit normalized copyright to ASCII (c) in config files, but setConfigFile() in core/system.php uses © as the canonical template for generated configs. Restoring © everywhere keeps generated and hand-authored files consistent.
Core changes:
- Config generator (core/system.php):
- Restore '# Copyright © 2005 - Y SLAED' in setConfigFile() template
- Was changed to (c) in the previous chore commit
- Config files (config/referers.php, config/replace.php, config/scheduler.php, config/security.php, config/statistic.php):
- Revert copyright line from (c) back to ©
- These files are generated or maintained by setConfigFile(); must match
Benefits:
- Generated and static config files share identical copyright format
- No divergence between setConfigFile() output and repository state
Technical notes:
- config/referers.php was not touched in the previous commit; corrected here
- Encoding rule exception: © is required here as the project copyright symbol
Replace legacy template helpers (getTplOption, getTplSelect, getTplAdminNavi, getTplAdminSearchBox, admin-*-form fragments) with the unified new/ fragment API across five admin modules, improving consistency and removing deprecated paths.
Core changes:
- Scheduler (admin/modules/scheduler.php):
- Replace getTplAdminNavi with getTplAdminTabs
- Replace getTplAdminTipLine string concatenation with structured $tips array
- Replace custom action form+link HTML with $acts arrays using row-actions-item fragments
- Use token-carrying GET links for run/unlock/delete actions instead of POST forms
- run action now gated behind job[manual] === 1 flag
- Replace old alert() fragments with new/alert fragments
- Security / bansave (admin/modules/security.php):
- Refactor bansave(): move all logic under if (!$warn) guard using $warn pattern
- Remove manual opcache_invalidate and file re-include for config reload
- Use $conf['security'] directly instead of re-reading security.php
- Migrate token-error path to setRedirect flash instead of inline echo
- Statistic (admin/modules/statistic.php):
- Replace getTplOption/getTplSelect with new/select-option + new/select fragments
- Replace getTplAdminSearchBox + admin-statistic-search-form with new/form + searchbox part
- Replace getTplAdminNavi with getTplAdminTabs using subtitle_html for search bar
- Replace admin-statistic-image with new/image-preview fragment
- Template (admin/modules/template.php):
- Add getTemplateFiles(), getTemplateHtmlFiles(), getTemplateCssFiles() helpers
- Use RecursiveIteratorIterator instead of manual scandir loops
- Add getTemplateTabsOps() for consistent tab URL generation
- Migrate getTemplateSearch() to new/select-option + new/form + searchbox part
- Remove preg_match('/./', $file) guard; replace with is_dir() check
- Uploads (admin/modules/uploads.php):
- Migrate getUploadsSearch() to new/select-option + new/form + searchbox part
- Migrate upload form to new/form with structured rows and hidden arrays
- Replace admin-uploads-upload-rows fragment with inline new/input fields
- Replace old alert() with new/alert fragments
Benefits:
- Eliminates six deprecated template helpers from admin module code paths
- Scheduler run/unlock/delete no longer require hidden POST forms per row
- Security bansave is simpler and does not perform redundant config file re-reads
Technical notes:
- Scheduler manual flag (job[manual]) gates the Run action; built-in jobs are not manually runnable
- Template RecursiveIteratorIterator replaces nested scandir and covers subdirectories
- No changes to config keys, DB schema, or public-facing URLs
Minor targeted fixes across four admin modules, each addressing a distinct correctness or style issue found during review.
Core changes:
- Security fix (admin/modules/blocks.php):
- Replace filter_input(INPUT_POST, 'blocktext', FILTER_UNSAFE_RAW) with getVar('post', 'blocktext', 'raw', '')
- Aligns with project security baseline requiring getVar for all user input
- Fix tab index in add(): change active tab from 1 to 3 (Add new block tab)
- Comment config form (admin/modules/comments.php):
- Replace deprecated com_access() helper with explicit $tpl->getHtmlFrag('new/select', ...) call
- Uses standard select-option fragments with three anonpost values: 0, 1, 2
- Indentation (admin/modules/config.php):
- Fix save() function body: indent $protect/$kprotect block and $cont array
- Code was at column 0 inside the if (!$warn) block
- Replace module (admin/modules/replace.php):
- Remove is_required => true from two field fragment calls
- Fields allow empty values; required constraint was incorrect
Benefits:
- All user input in blocks.php now goes through the getVar security layer
- Consistent indentation in config.php save() matches surrounding style
Technical notes:
- No behavior change in config.php or replace.php; purely cosmetic corrections
- com_access() is no longer referenced in comments.php
Extend two helper functions to support new use cases introduced by the admin module migration to the new template fragment API.
Core changes:
- setTplAdminInfoPage / getTplAdminTabs (core/helpers.php):
- Pass subtitle_html from data array through to getTplAdminTabs call
- Allows info-page callers to inject a search or filter bar below tabs
- getTplCodeEditor (core/helpers.php):
- Add optional height parameter support
- When height is set, emit inline script to call editor.setSize(null, height)
- Targets the specific editor instance by textarea id to avoid conflicts
- getAdminCategoryList (core/admin.php):
- Reduce cutstr title length from 50 to 45 characters
- Prevents overflow in tip-label cells at standard column widths
Benefits:
- Admin modules using setTplAdminInfoPage can now pass subtitle search bars
- Code editors in full-width rows respect explicit height constraints
Technical notes:
- getHtmlScriptInline is used for the inline height script (existing helper)
- subtitle_html defaults to empty string when not provided
Two unrelated visual fixes in the admin stylesheet plus a new layout rule for full-width code editor fields inside sl-div-item-full containers.
Core changes:
- Table sort last-column header (new.css, system.css):
- Change text-align from right to left for consistency with other headers
- Restore padding-right from 8px to 16px to match standard header padding
- Sort icon pseudo-element (system.css):
- Add width: 10px and text-align: center to the ::after arrow indicator
- Reduce padding-right from 18px to 16px on .sl_sort* cells
- CodeMirror full-width in sl-div-item-full (new.css):
- Add rule: .sl-div-item-full .sl-div-field .sl_form and .CodeMirror
- width: 100%, max-width: 100%, box-sizing: border-box
- Prevents code editor overflow in full-width layout rows
Benefits:
- Sort icons are properly centered and do not overflow cell padding
- Code editor fields render flush to the container in full-width rows
Technical notes:
- Both .sl_table_list_sort (system.css) and .sl-table-list-sort (new.css) updated
- No changes to HTML structure required
Update the display name for the search-bot settings section from the vague 'Search bots' / 'Поисковые боты' phrasing to the more precise technical term 'Crawlers' / 'Краулеры' across all six language files.
Core changes:
- Language constant _BOTSOPT (admin/lang/*.php):
- en.php: 'Search bots' → 'Crawlers'
- ru.php: 'Поисковые боты' → 'Краулеры'
- de.php, fr.php, pl.php, uk.php: equivalent rename applied
Benefits:
- Consistent terminology with industry-standard crawler terminology
- Cleaner distinction between bots (generic) and crawlers (indexing agents)
Technical notes:
- Constant key _BOTSOPT is unchanged; only the display string updated
- No impact on logic or config keys
Normalize config files to align with code style rules and bring runtime data up to date after recent admin module refactoring.
Core changes:
- Copyright header (config/filetype.php, config/replace.php, config/statistic.php, config/uploads.php):
- Replace Unicode © with ASCII (c) for encoding consistency
- Alignment padding (config/replace.php, config/statistic.php, config/uploads.php):
- Remove extra spaces used to align array key-value pairs
- Upload thumbnail sizes (config/uploads.php):
- Unify thumbnail max-width to 150px across all upload contexts
- Was inconsistent: 250, 260, 220 for different modules
- Security dump_skip (config/security.php):
- Swap order: vendor/ before tests/ in dump exclusion list
- Base fingerprint (config/local.php):
- Update to reflect current config state
Benefits:
- ASCII-only headers are portable across all editors and terminals
- Uniform thumbnail limit simplifies upload behaviour expectations
- Consistent padding style matches global.md alignment rules
Technical notes:
- No behavioral changes beyond thumbnail size normalization
- CRLF line endings in config/scheduler.php normalized to LF
- config/local.php fingerprint is a runtime artifact updated automatically