Журнал изменений

Migrate nine front-end modules (forum, help, jokes, links, main, media, money, news, order) from head()/foot() to setHead()/setFoot(), pass SEO metadata via the new API, and fix remaining raw SQL interpolation with named placeholders.

Core changes:

1. forum/index.php:
2. head() → setHead(seo); foot() → setFoot()
3. Pass title, desc, img, time, ctitle, author to setHead()
4. help/index.php:
5. head() → setHead(seo); foot() → setFoot()
6. jokes/index.php:
7. head() → setHead(seo); foot() → setFoot()
8. links/index.php:
9. head() → setHead(seo); foot() → setFoot()
10. main/index.php:
11. head() → setHead(); foot() → setFoot()
12. Remove unused \$confn / \$confrs locals
13. media/index.php:
14. head() → setHead(seo); foot() → setFoot()
15. money/index.php:
16. head() → setHead(); foot() → setFoot()
17. news/index.php:
18. head() → setHead(seo); foot() → setFoot()
19. SQL: category WHERE clause uses named placeholders (:ncat1, :ncat_re, :ncat2)
20. catid IN() list uses intval() cast to prevent injection
21. \$admin_file → \$afile global alignment
22. order/index.php:
23. head() → setHead(seo); foot() → setFoot()

Benefits: - SEO data (title, author, img, time) flows cleanly through setHead() API - Eliminates remaining raw SQL string interpolation in news category queries - Consistent global naming (\$afile) across module layer

Technical notes: - news/index.php catid IN() uses intval() map — safe for any array content - Functional behavior preserved in all nine modules

Migrate eight front-end module index files from head()/foot() to setHead()/setFoot(), use \$conf['users'] instead of the \$confu alias, and fix raw SQL string interpolation to use prepared statements with named placeholders where applicable.

Core changes:

1. account/index.php:
2. head() → setHead(); foot() → setFoot()
3. \$confu['…'] → \$conf['users']['…'] throughout
4. SQL queries for user_name/user_email use named placeholders
5. Remove unused \$confn/\$confrs globals
6. auto_links/index.php:
7. head() → setHead(); foot() → setFoot()
8. Minor getVar() and SQL cleanup
9. changelog/index.php:
10. head() → setHead(); foot() → setFoot()
11. clients/index.php:
12. head() → setHead(); foot() → setFoot()
13. Prepared statements for client queries
14. contact/index.php:
15. head() → setHead(); foot() → setFoot()
16. content/index.php:
17. head() → setHead(); foot() → setFoot()
18. Pass SEO fields (title, desc, img, time, ctitle, author) to setHead()
19. faq/index.php:
20. head() → setHead(); foot() → setFoot()
21. files/index.php:
22. head() → setHead(); foot() → setFoot()

Benefits: - Modules now pass structured SEO data to setHead() instead of setting globals - Prepared statements eliminate raw string interpolation in SQL - Removed dependency on legacy \$confu alias

Technical notes: - \$conf['users'] array was always available; \$confu was an alias - setHead() / setFoot() are backward compatible with empty-array calls

Apply uniform refactoring to all 22 module admin index files: replace header()+exit; redirect pairs with setRedirect(), and replace list() destructuring with short array syntax [].

Core changes:

1. All modules/*/admin/index.php (22 files):

2. setRedirect() replaces header('Location: …')+exit; patterns * account, auto_links, changelog, clients, contact, content, faq,

files, forum, help, jokes, links, media, money, news, order,
pages, rss, shop, sitemap, voting, whois

• list() → [] for sql_fetchrow() and array destructuring
• Minor getVar() default corrections where applicable

Benefits: - All admin entry points now use centralized redirect helper - Consistent array destructuring syntax across entire admin layer

Technical notes: - Functional behavior unchanged - No DB schema or API contract changes

Complete the admin module migration: list()->[], setRedirect(), getVar() for all remaining admin panel modules. Includes security.php IP/ban management and statistic/uploads modules.

Core changes:

1. privat.php:
2. setRedirect() replaces header()+exit; pairs
3. ratings.php:
4. list() → [] for sql_fetchrow() destructuring
5. setRedirect() replaces header()+exit; pairs
6. referers.php:
7. list() → [] throughout
8. setRedirect() replaces header()+exit; pairs
9. replace.php:
10. setRedirect() replaces header()+exit; pairs
11. security.php (admin module):
12. list() → [] throughout
13. setRedirect() replaces header()+exit; pairs
14. statistic.php:
15. list() → [] throughout
16. setRedirect() replaces header()+exit; pairs
17. template.php:
18. list() → [] throughout
19. setRedirect() replaces header()+exit; pairs
20. uploads.php:
21. list() → [] throughout
22. setRedirect() replaces header()+exit; pairs

Benefits: - All 22 admin modules now use uniform redirect and array destructuring - No direct superglobal header() calls remain in admin module layer

Technical notes: - Purely syntactic/convention migration; zero logic changes - Backward compatible with existing sessions and DB state

Continue the list()->[], setRedirect(), and getVar() migration across seven more admin modules. All header()+exit; redirect pairs replaced with the centralized setRedirect() helper.

Core changes:

1. favorites.php:
2. setRedirect() replaces header()+exit; pairs
3. fields.php:
4. list() → [] for sql_fetchrow() destructuring
5. setRedirect() replaces header()+exit; pairs
6. groups.php:
7. list() → [] throughout
8. setRedirect() replaces header()+exit; pairs
9. lang.php:
10. list() → [] throughout
11. setRedirect() replaces header()+exit; pairs
12. messages.php:
13. list() → [] throughout
14. setRedirect() replaces header()+exit; pairs
15. modules.php:
16. setRedirect() replaces header()+exit; pairs
17. newsletter.php:
18. list() → [] throughout
19. setRedirect() replaces header()+exit; pairs

Benefits: - Consistent redirect handling across all admin modules - Eliminates legacy list() syntax — short array syntax throughout

Technical notes: - Logic and DB queries unchanged - Backward compatible

Replace deprecated list() with short array syntax [], use setRedirect() instead of header()+exit; pairs, switch $_COOKIE reads to getVar(), and fix null-default values on getVar() calls across seven admin modules.

Core changes:

1. admins.php:
2. list() → [] for sql_fetchrow() destructuring
3. getVar('post', 'amodules[]', 'var', []) — explicit empty default
4. $_COOKIE['sl_close_9'] → getVar('cookie', 'sl_close_9', 'num', 0)
5. setRedirect() replaces header()+exit; pairs
6. del(): guard $id > 0 before DELETE query
7. blocks.php:
8. list() → [] throughout
9. setRedirect() replaces header()+exit; pairs
10. getVar defaults corrected
11. categories.php:
12. list() → [] throughout
13. setRedirect() replaces header()+exit; pairs
14. comments.php:
15. list() → [] throughout
16. setRedirect() replaces header()+exit; pairs
17. config.php:
18. setRedirect() replaces header()+exit; pairs
19. database.php:
20. setRedirect() replaces header()+exit; pairs
21. editor.php:
22. list() → [] throughout
23. setRedirect() replaces header()+exit; pairs

Benefits: - Eliminates silent header()/exit anti-pattern; redirects now centralized - Short array syntax aligns with PHP 7.1+ codebase conventions - getVar() for cookies prevents direct superglobal access

Technical notes: - Behavior preserved; no logic changes - Backward compatible with existing DB schema

Replace the ad-hoc plaintext error log with an AI-ready NDJSON schema (one JSON object per line). Inline closure helpers replace global named functions to avoid namespace pollution, and all sensitive fields are redacted before logging.

Core changes:

1. Error log engine (core/security.php):

2. New schema: timestamp, level, type, message, req_id, ip, method, url, referer, ua, context (query/post/cookie_keys/session_keys), file, line, trace, mem_mb, mem_peak_mb, duration_ms, php_version, slaed_version

3. Inline closures: \$ls (sanitize/truncate), \$lredact (mask secrets), \$lbound (cap array size), \$lctx (bounded request context), \$lreq, \$lmem, \$lwrite (atomic file append with flock)

4. HTTP error handler: logs 403/404/503 with request context + referer
5. PHP error handler: logs warnings/notices/fatals with file+line+trace
6. Exception handler: logs uncaught exceptions with full stack trace
7. Unhandled rejection: register_shutdown_function for fatal errors

Benefits: - Log entries are machine-parseable — compatible with log aggregators - Sensitive keys (pass, token, auth, secret, etc.) auto-redacted - No more log injection: \r \n \0 stripped before writing - Atomic flock()-based writes prevent concurrent log corruption

Technical notes: - Log format: NDJSON — one JSON per line, UTF-8, no BOM - Max 50 GET/POST keys per entry; string values capped at 1024 chars - Stack traces capped at 10 frames to control log size - Replaces previous plaintext format — existing log files remain valid

Extend the SEO pipeline with two new template tokens ([headline], [author]) and align core utility functions with the codebase conventions: getVar() for input, resolved absolute paths in checkPerms(), improved getImgText() with [img] BBCode support, and the renamed head()->setHead(array \$seo).

Core changes:

1. Schema.org default config (config/global.php):
2. Replace "headline": "0" with "headline": "[headline]"
3. Replace "name": "[site]" (author) with "name": "[author]"
4. System utilities (core/system.php):

5. Rename head() to setHead(array \$seo = []) — accepts optional SEO fields * New keys: title, desc, img, time, ctitle, author * Derive \$headline from \$seo['title'] (plain text, no compound suffix)

6. Add [headline] and [author] to SEO from/to replacement arrays

7. Refactor checkPerms(string \$fp, int \$id) to checkPerms(string \$fp) * Callers now pass absolute path directly; no id-based base resolution

8. Extend getImgText() with \$check=true param and [img=…][/img] BBCode * Supports and forms * \$check=false skips file_exists() for remote/virtual images

9. Fix fields_in(): explode('|', \$fieldb ?? '') — null-safe coalesce
10. Admin core (core/admin.php):
11. Replace func_get_args() in getStatistic() with getVar('get', …)
12. Fix checkPerms() calls: prepend BASE_DIR.'/' to construct absolute paths
13. Declare getStatistic(): void return type

Benefits: - Schema.org headline and author now populated with real article data - setHead() API eliminates scattered global variable mutations in modules - getImgText() handles [img] BBCode variants without regex fragility

Technical notes: - setHead() is backward-compatible when called with empty array - All old call sites of head()/foot() must migrate to setHead()/setFoot()

Update the SEO template variable reference string (_TPLVARS) in all six admin UI languages. The [title] description is also clarified to reflect the full composite SEO title (article + category + module + site).

Core changes:

1. Language files (admin/language/de.php, en.php, fr.php, pl.php, ru.php, uk.php):

2. Add [headline] variable — article headline (plain text, no suffixes) * Used in Schema.org "headline" field

3. Add [author] variable — article author display name * Used in Schema.org "author.name" field

4. Clarify [title] description to reflect full SEO composition

Benefits: - Editors can now understand all available SEO tokens at a glance - Consistent variable docs across all 6 UI languages

Technical notes: - Change is documentation only (help text); no PHP logic altered - Backward compatible — existing templates not affected

The regex used to extract table names from INSERT statements could match partial identifiers where a word character preceded the underscore prefix, producing false-positive table matches.

Core changes:

1. tests/InsertValidationTest.php:
2. Add negative lookbehind (?<!\w) before _(\w+) in INSERT pattern
3. Ensures the prefix underscore is only matched at a word boundary

Benefits: - Eliminates false-positive table name matches in test assertions - Test results more accurately reflect actual INSERT targets

Technical notes: - Pattern change is regex-only; test logic and assertions unchanged - Lookbehind is zero-width and does not affect captured groups