Журнал изменений

Harden authentication, SQL queries, and input handling across admin and modules; migrate Bootstrap 5 and HTMX to plugins/ with proper structure.

Core changes:

1. Authentication fixes (core/security.php, core/system.php, admin/index.php):

• isAdmin(): remove substr() truncation on bcrypt hash (was 72 chars, now full)
• is_user(): replace loose == with hash_equals() for timing-safe comparison
• check_admin(), add_admin(): header('Location:') replaced with setRedirect()
• logout(): raw SQL concatenation replaced with prepared statement + setRedirect()
• changeeditor(): raw SQL replaced with prepared statement; $_POST → getVar()
• login(): raw $_POST['aname'], $_POST['aemail'] → getVar()

2. SQL hardening — LIKE prepared statements (8 modules):

• modules/news, media, files, links, faq, pages, shop: $let interpolation replaced with :let placeholder + ['let' => $let.'%'] params
• modules/help: $let and $uid both replaced with named placeholders
• news: removed redundant addslashes() on $let

3. Security headers (core/system.php):

• Added X-Content-Type-Options: nosniff
• Added X-Frame-Options: SAMEORIGIN
• Added Referrer-Policy: strict-origin-when-cross-origin

4. Frontend plugin structure (plugins/, config/global.php):

• Bootstrap 5 (CSS + JS bundle + Icons) moved to plugins/bootstrap/
• HTMX moved from templates/admin/js/ to plugins/htmx/
• bootstrap-icons.css, fonts/ removed from templates/admin/
• script_f and css_f updated to reflect new paths

5. Scheduler module (admin/modules/scheduler.php, config/scheduler.php):

• Full scheduler module implementation with cron-based job execution

6. Newsletter module (admin/modules/newsletter.php, config/newsletter.php):

• Newsletter configuration and admin module updates

Benefits:

• Timing-safe password comparison prevents brute-force timing attacks
• Prepared statements on LIKE queries eliminate SQL injection vectors
• Security headers protect against MIME sniffing, clickjacking, referrer leakage
• Centralised plugin paths simplify future library updates

Technical notes:

• bcrypt hashes are 60 chars; old 40-char substr caused login failure after migration
• setRedirect() calls exit internally; explicit exit after header() no longer needed
• params array passed as 10th arg to setArticleNumbers() — already supported

Expands the security statistics panel to cover all files in storage/logs/, replacing the .log-only filter with a label-based allowlist approach. Removes hardcoded .log extension throughout; .json files (dump_map, monitor) are now handled via an $ext exception map.

Core changes:

1. Security module (admin/modules/security.php):

• $labels array extended: database, dump, dump_log, dump_map, error_file, error_php, error_site, error_sql, hack, log, log_admin, log_user, monitor, warn
• $ext map: ['dump_map' => 'json', 'monitor' => 'json']
• security(): replaced preg_match('.log') with skip-list + isset($labels)
• fileview(), down(), del(): use $ext[$file] ?? 'log' for path and filename
• confsave(): persists sess_d, sess_b, log_b, log_d; dump_skip field added

2. Info pages (admin/info/security/*.html — all 6):

• Reference to hardcoded interval setting replaced with Scheduler module link

3. Config (config/security.php):

• dump_skip default removed (now managed via Scheduler/confsave)
• log_d default adjusted

Benefits:

• .json log files (dump_map, monitor) now visible and downloadable in UI
• No unknown files shown: only keys present in $labels are rendered
• .htaccess and index.html automatically skipped

Technical notes:

• filterVar strips dots, so file extensions cannot be passed via URL
• Extension is derived server-side from $ext map with 'log' fallback

Integrate the preserved local work back into master after fast-forwarding the branch to the latest origin/master state. This keeps the remote updates and the local language, configuration, setup, and test changes together without any history rewrite.

Core changes:

1. Remote synchronization (master):

• Fast-forward local master to origin/master
• Keep upstream changes from the latest GitHub state

2. Local work integration (config, language, setup, tests):

• Merge the backup branch with the preserved local changes
• Resolve the config/global.php conflict in favor of the saved local sitekey

Benefits:

• Leaves master up to date with GitHub and your local work intact
• Provides a recoverable backup branch and commit history
• Avoids destructive Git operations and force-based workflows

Technical notes:

• Merge commit created after fast-forward sync
• No rebase and no history rewrite
• Working tree should be clean after commit

Three bug fixes identified via error log analysis (2517 entries, period 2026-03-13 to 2026-03-15). Closes the dominant error (2504 occurrences) and hardens input validation against encoded path traversal probes.

Core changes:

1. Search module (modules/search/index.php):

• Guard $conf['search'] with is_array() before accessing ['mods']
  • $conf['search'] is a string when config is scalar, causing TypeError
  • Affected every bot crawling ?name=search (Bing, Google, Baidu, etc.)

2. Monitor (admin/modules/monitor.php):

• Check open_basedir before calling is_dir() on extension_dir
  • Used array_reduce over PATH_SEPARATOR-split paths
  • Avoids E_WARNING when ext dir is outside allowed open_basedir paths

3. Security (core/security.php):

• Extend $quote pattern in checkGet: '../' → '..[/%]'
  • Now catches ../ (direct), ..\ (Windows), ..% (URL-encoded: ..%2F etc.)
  • Blocks double-encoded path traversal (e.g. %252F) after PHP auto-decode

Benefits:

• Eliminates 2504 TypeError entries from error_php.log
• Removes 9 recurring open_basedir warnings in monitor
• Path traversal attempts now logged to hack.log via addHackReport()

Technical notes:

• No config or schema changes
• Backward compatible