Журнал изменений

Full rewrite of admin/modules/config.php UI layer to use the canonical fragment API. Tabs now persist across page loads via URL ?tab=N parameter, and the INFO link always reflects the currently active tab.

Core changes:

1. config() function:

• Replace getTplAdminNavi() with getTplAdminTabs() and new/tabs fragment
• All 7 tab panels rebuilt using new/tabs-panel fragments
• All form inputs migrated: getTplTextInput/Textarea/Select → getHtmlFrag
  • input: text, url, email, number types with is_config, maxlength, placeholder
  • textarea: with is_config, is_required, cols_num, rows_num
  • select/select-option fragments replace getTplSelect/getTplOption
• Tabs rendered with init_attr="data-sl-tabs-index=N" for JS state sync
• INFO link rendered with data-sl-tab-info-link="config" for URL sync
• Form rebuilt via new/form fragment (hidden tokens, content_html slot)

2. save() function:

• Add CSRF token check at entry; render alert on failure and return early
• Fix: getVar('req' → 'post') for startdate field
• Fix: $xhomeurl trailing-slash strip guarded against empty string

3. info() function:

• Complete rewrite: replaces setAdminInfoPage() with inline rendering
• Tab nav built with new/tabs fragment (plain links, INFO tab is_active)
• Reads locale-specific .md/.html file from admin/info/config/
• Editable via new/form fragment when $conf['adminfo'] is set
• CSRF token checked on save_info POST; alert shown on failure

Benefits:

• Tab state survives reload via ?tab=N without sessionStorage conflicts
• Consistent API across all admin modules
• CSRF check in save() closes gap that existed in original implementation

Technical notes:

• getTplAdminNavi/getTplAdminTabContent/getTplAdminTabsSetup calls removed
• Backward-compatible: config keys and save logic unchanged

Two enhancements to tab state management in the admin UI, both needed for the config module where tabs are URL-persistent (tab=N param).

Core changes:

1. Support data-sl-tabs-index on root tab container:

• Before restoring from sessionStorage, check data-sl-tabs-index attr
  • PHP sets this attribute to the server-known active tab index
  • Takes priority over sessionStorage to ensure correct initial state

2. Sync info-link href when user switches tabs:

• On tab click, find all [data-sl-tab-info-link="group"] anchors
• Update their href's ?tab= param to match the newly active tab index
  • Ensures the INFO link always opens the info page on the correct tab

Benefits:

• Tab state survives page reloads without sessionStorage inconsistency
• INFO navigation link stays in sync with visible tab across all switches

Technical notes:

• Uses URL/searchParams API with try/catch for IE11 safety
• data-sl-tab-info-link is scoped to a tab group name to avoid conflicts

Previously admin info pages required callers to pass 'tab' explicitly to select the active tab (e.g. 'tab' => 3). This was brittle: adding or reordering tabs broke the highlight silently.

Core changes:

1. Fix default tab selection (core/helpers.php):

• setTplAdminInfoPage: if 'tab' not provided, default to last tab index
  • Was: $tab = (int)($data['tab'] ?? 0) — always selected first tab
  • Now: auto-selects last tab ($tabs ? count($tabs) - 1 : 0)

2. Remove hardcoded 'tab' from admin modules:

• admins.php: remove 'tab' => 2 from info()
• blocks.php: remove 'tab' => 5 from info(); expand inline call to multiline
• comments.php: remove 'tab' => 3 from info()
• content/admin/index.php: remove 'tab' => 3 and inline $ops variable

Benefits:

• Info tab auto-highlights without manual index tracking
• Immune to tab reordering: callers no longer need to count tabs

Technical notes:

• 'tab' key still accepted if caller needs to override default
• blocks.php inline expanded to multiline for readability only

Continues the systematic migration of admin modules to the canonical new/* fragment layer, replacing all legacy helper functions and old fragment names with the new unified API. Adds CSRF token protection to all state-changing operations and introduces new template fragments for comments and pagination.

Core changes:

1. Admin module — admins (admin/modules/admins.php):

• Replace getTplAdminNavi() → getTplAdminTabs() throughout
• Migrate all form fields to new/input, new/checkbox, new/select, new/textarea
• Inline getAdminself() and getAdminmods() into call sites; remove dead functions
• Add checkSiteToken() guard to save() and delete()
• Switch delete() from POST aid to GET req with token validation
• Migrate table head to array format for new/table fragment

2. Admin module — blocks (admin/modules/blocks.php):

• Replace all getTplAdminNavi() → getTplAdminTabs()
• Migrate all form rows to new/form with row array structure
• Add checkSiteToken() guard to addsave() and filecode()
• Validate bfile via regex before use; sanitize filenames in filecode()
• Fix block-file code extraction regex (cleaner preg_replace approach)
• Pass getSiteToken() into getAdminBlockList()

3. Admin module — categories (admin/modules/categories.php):

• Same API migration pattern as admins/blocks

4. Admin module — comments (admin/modules/comments.php):

• Same API migration pattern; new comment and bulk-action fragments

5. System layer (core/system.php):

• Supporting changes for new fragment API helpers

6. New template fragments:

• templates/admin/fragments/comment-bulk-actions.html
• templates/admin/fragments/comment.html
• templates/admin/fragments/new/label-item.html
• templates/admin/fragments/pagenum.html
• templates/admin/fragments/pager-link.html

7. Updated fragments:

• admin-admins-delete-form.html — adapted to new API shape
• admin-admins-permission-cell.html — adapted to new API shape
• templates/admin/assets/css/new.css — style adjustments

Benefits:

• CSRF protection on all mutating admin operations
• Uniform new/* fragment API across all migrated modules
• Input validation tightened (bfile, lang filters)

Technical notes:

• getAdminself() and getAdminmods() removed; logic inlined at call sites
• delete() now reads aid from req (GET) instead of POST
• Backward compatibility with old fragment names dropped intentionally

Establishes the canonical new/* fragment base layer for the admin panel and migrates modules/content and admin/modules/security to the new API. Also consolidates core/helpers.php by removing legacy helper functions.

Core changes:

1. New fragment base layer (templates/admin/fragments/new/):

• Added 30+ structural fragments: form, div-row, div, input, textarea, select, checkbox, radio, button, submit, hidden, label-hint, title-tip, alert, edit-tip, pager, pager-link, pager-dots, table, table-row, table-row-content, th, tabs, tabs-link, tabs-panel, module-head, user-search, row-actions, radio-group, div-collapse
• Added new.css with full sl-* class definitions for all new fragments
• Added box.html partial as canonical content box wrapper

2. Content module (modules/content/admin/index.php):

• Migrated all functions to new fragment API
• Replaced setArticleNumbers() with getTplPager() helper
• rows passed as arrays, not string concatenation
• Prepared SQL with named placeholders throughout

3. Security module (admin/modules/security.php):

• Further alignment with new fragment contracts
• Updated language constants across all 6 lang files

4. Core consolidation (core/helpers.php, core/system.php):

• Removed legacy helper functions migrated to fragments
• Reduced helpers.php by ~1200 lines

Benefits:

• Unified admin output through neutral structural fragment contracts
• sl-* CSS naming convention enforced throughout new layer
• Legacy sl_* calls replaced in migrated modules

Technical notes:

• system.css pruned of styles now covered by new.css
• tabs.js updated to data-* runtime contract
• getTplPager() replaces setArticleNumbers() for admin pagination