Журнал изменений

Update security.php, database.php, and modules/content/admin/index.php to use the canonical input/label-hint/table/edit-tip fragments and add CSRF token verification to all mutating operations in the security module.

Core changes:

1. Security module CSRF hardening (admin/modules/security.php):

• bansave(), passsave(), configsave(), delete(): add checkSiteToken() guard at function entry; render _TOKENMISS alert and return early on failure
• All delete action URLs now include &token=getSiteToken() query parameter
• banlist() ban-add form: hidden token field added via getTplHiddenInput()
• passwd() form: hidden token field added
• config() configsave form: hidden array now passed to config-div.html loop

2. Fragment migration (admin/modules/security.php):

• getTplAdminHintLabel() → $tpl->getHtmlFrag('label-hint', [...]) for IP/CIDR, admin file, and dump-skip labels
• getTplTextInput() → $tpl->getHtmlFrag('input', [...]) for blocker_cookie and afile text inputs

3. Database module (admin/modules/database.php):

• getHtmlFrag('admin-input', [...]) → getHtmlFrag('input', [...]) for both submit buttons in dump()

4. Content module (modules/content/admin/index.php):

• content(): list view migrated from getTplAdminTableHead/getTplAdminTableRow to $tpl->getHtmlFrag('table', [...]) with head array of column descriptors
• Row rendering migrated to getHtmlFrag('table-row') + getHtmlFrag('table-row-content')
• Action menu migrated to getHtmlFrag('edit-tip', [...]) with CSRF token on delete URL
• Title cell migrated to getHtmlFrag('title-tip', ['items' => [...]]) + cutstr()
• add(): form rows converted to array-based descriptor format; input/label-hint fragments used for title and RSS URL fields; getTplRefreshTimeSelect() for refresh select; getTplAddDateTime() for date picker; fields_in() replaced by getTplAddFieldRows(); body preview replaced by getTplPreviewContent()
• Field input normalised: getVar('post', 'field[]', 'raw') + filterFields()

Benefits:

• CSRF coverage extended to all mutating security module operations
• Consistent fragment usage eliminates module-specific HTML builders
• content/add form now uses the same add-div layout as other modules

Technical notes:

• checkSiteToken() added to bansave (ids 1/2/3), passsave, configsave, delete
• config-div.html hidden loop expects array of ['nameattr', 'valueattr'] maps
• field[] input now read as raw array and normalised via filterFields()

Introduce six reusable helper functions that build admin and frontend HTML from prepared data structures and canonical fragments, replacing inline HTML construction scattered across modules.

Core changes:

1. getTplAddFieldRows() (core/helpers.php):

• Parses module field definitions from $conf['fields'][$mod]
• Returns array of ['label_html', 'field_html'] rows for add-div layout
• Dispatches to add-field fragment for text(1), textarea(2), select(3)
• Delegates to getTplAddDateTime() for date(5) and datetime(4) types

2. getTplAddDateTime() (core/helpers.php):

• Renders a date/datetime-local picker paired with a hidden canonical value field
• Uses static counter for unique IDs across multiple instances on one page
• Returns add-datetime fragment HTML

3. getTplRefreshTimeSelect() (core/helpers.php):

• Renders a fixed-interval <select> (15m/30m/1h/5h/10h/24h)
• Uses refresh-select-time fragment; defaults to 3600 when value is empty/zero

4. getTplViewFieldRows() (core/helpers.php):

• Renders read-only labelled rows from field string + module field definitions
• Applies filterMarkdown+filterReplaceText for textarea(2) type fields
• Returns view-field fragment HTML per visible field

5. getTplPreviewContent() (core/helpers.php):

• Assembles full preview block: title, body_a, body_b, field rows
• Uses getHtmlPart('preview-content') for page-level layout
• Returns empty string when all inputs are blank

6. getTplSaveAction() (core/helpers.php):

• Renders save/delete/preview <select> + hidden op + submit button
• Accepts name, valu, op, noprev keys; conditionally includes delete/preview options
• Uses save-action + save-action-item fragments

Benefits:

• Centralises HTML assembly logic; modules only supply data arrays
• Eliminates repeated inline HTML for date pickers, field loops, and save controls
• Consistent escaping and fragment usage across all call sites

Technical notes:

• getTplAddFieldRows() uses filterFields() to normalise array field input
• getTplAddDateTime() relies on add-datetime fragment with hidden_id/picker_id pair
• getTplSaveAction() replaces the ad_save() inline HTML builder in core/system.php

Rename legacy admin helper functions to follow the getTpl* naming convention across core/admin.php, completing the function-rename pass started in previous refactor commits. Remove ~210 frontend fragment files that were erroneously tracked under templates/admin/fragments/.

Core changes:

1. Function renames (core/admin.php):

• adminFlagBox() → getTplAdminFlagBox()
• adminDeleteAction() → getTplDeleteAction()
• adminLinkAction() → getTplLinkAction()
• adminAjaxAction() → getTplAdminAjaxAction()
• adminTitleTip() → getTplAdminTitleTip()
• adminTitleTipLabel() → getTplAdminTipLabel()
• adminNoteLabel() → getTplAdminNoteLabel()
• adminMoveControls() → getTplAdminMoveControls()
• adminMenuItems() → getTplAdminActionMenu()
• adminCategoryRow/Table → getTplAdminCategoryRow/Table()
• adminBlockRow/Table → getTplAdminBlockRow/Table()
• adminFilesRow/Table → getTplAdminFilesRow/Table()
• adminFilePreview() → getTplAdminFilePreview()
• adminDangerText() → getTplAdminDangerText()

2. Module fix (admin/modules/newsletter.php):

• Added missing $token to global declaration

3. Fragment cleanup (templates/admin/fragments/):

• Removed ~210 frontend fragments (account/, forum/, shop/, voting/, editor/, media/, whois/*, etc.) that do not belong in admin/fragments/
• Modified link-btn.html (minor tweak)

Benefits:

• All admin rendering helpers now share the getTpl* prefix — consistent API
• Removes dead template files that were never loaded by the admin layer
• Reduces template directory noise by ~210 files

Technical notes:

• All call sites in core/admin.php updated atomically — no external callers
• Deleted fragments were not referenced by admin code; frontend uses its own template directories

Remove manual CSRF token passing from all admin module actions and forms now that checkSiteToken() auto-reads the token from the request context. Update getHtmlFrag() calls to use renamed fragments and canonical variable keys.

Core changes:

1. CSRF token removal from forms and action guards (admin/modules/*.php):

• Removed getSiteToken() calls and hidden token inputs from all module forms
• Removed explicit checkSiteToken(getVar(...)) guards from save/delete handlers
  • Token validation still occurs inside checkSiteToken() via getRequestToken()
• Affected modules: admins, categories, comments, database, favorites, fields, groups, lang, messages, modules, newsletter, privat, referers, replace, scheduler, statistic, template, uploads

2. Fragment name updates (admin/modules/*.php, core/admin.php):

• admin-action-link → comment-action-link
• admin-action-ajax → comment-action-ajax (via getTplAdminAjaxAction)
• Added required class/target keys for comment-action-link calls

3. Core admin updates (core/admin.php):

• getAdminBlockList(): add optional $token string param (unused, reserved)
• getAdminInfo(): remove manual token check; remove token hidden input from form

4. System bootstrap (core/system.php):

• Minor alignment/cleanup with no behavioral change

Benefits:

• Eliminates 30+ boilerplate token-extract-and-check blocks across modules
• CSRF protection remains active via centralized getRequestToken()
• Consistent fragment naming across all call sites

Technical notes:

• Implicit CSRF validation: token must arrive via header or POST/GET param
• No change to token generation or scope logic
• admin/index.php: CRLF→LF line ending normalization only

Extend the CSRF layer with a dedicated token-reader and a smarter checkSiteToken() that auto-resolves the token from the request context, eliminating the need for callers to pass the token explicitly.

Core changes:

1. CSRF token reader (core/security.php):

• Add getRequestToken(): reads token from X-CSRF-Token header, X-XSRF-Token header, POST param, GET param, $_REQUEST fallback
  • Priority: header > POST > GET > $_REQUEST
  • Trims whitespace, returns empty string when absent

2. CSRF validator (core/security.php):

• Change checkSiteToken() signature: $tok defaults to '' (auto-read)
  • If $tok is empty, calls getRequestToken() automatically
  • Adds cross-scope fallback: non-ajax scopes also accept global 'ajax' token

Benefits:

• Callers no longer need to extract and pass the token manually
• HTMX / fetch requests sending X-CSRF-Token header work out of the box
• One central place for all token extraction logic

Technical notes:

• Backward compatible: callers that still pass $tok explicitly continue to work
• Scope fallback is one-way: ajax-scoped checks do not accept scope-specific tokens