Журнал изменений

Move hardcoded & and hand-built HTMX markup out of PHP: URL producers now pass a raw & URL as data, and fragments escape it once at the output boundary via {{ }}. Removes the last inconsistency where URL-bearing HTMX attributes still followed the legacy escape-at-source + markup-in-PHP pattern.

Core changes:

1. Link/tab/button fragments (templates/{lite,admin}/fragments):
2. tabs-link.html: add hx_get/hx_target/hx_swap block, URL escaped via {{ }}

3. button.html: add hx-post block (hx_post/hx_include/hx_target/hx_swap/ hx_on_click/hx_on_after), URL escaped; JS validation stays raw passthrough

4. link fragment already had is_htmx (hx-get="{{ href }}") — reused as-is
5. PHP producers now emit data, not markup:
6. core/admin.php: upload file links use is_htmx + hx_target (drops & blob)
7. admin/modules/uploads.php: upload tabs pass raw hx_get/hx_target
8. core/user.php: comment/PM submit forms pass raw hx_post + hx_* fields
9. Docs:
10. Remove docs/PROMPT_HREF_AMPERSAND.md (task complete)

Benefits:

• Single escape at the sink; & structurally impossible
• Unified hx_* field vocabulary across link/tabs-link/button fragments
• Removes duplicated URL (href + hand-built hx-get) in upload links

Technical notes:

• getSafe() = htmlspecialchars(ENT_QUOTES|ENT_SUBSTITUTE, UTF-8)
• Verified live: comment form, admin upload tabs — single &, zero &
• Additive change; legacy link_attr/input_attr passthrough kept for other uses

URLs are now treated as data: every producer emits a raw & and the template layer escapes exactly once at the output boundary via {{ href }}. This removes the previous mix of producer-side & encoding and raw {{{ }}} output and eliminates latent single/double-escape inconsistencies across the site.

Core changes:

1. URL producers to raw & (blocks, modules, admin/modules, core):
2. Front-end SEO links built via getSeoUrl() (raw &, SEO-friendly URLs under rewrite)
3. Admin afile.php?..., htmx go=...&op=... tails, absolute/redirect URLs to raw &
4. getQueryString() always emits raw & (dropped the obsolete $html parameter)
5. Template output boundaries (81 flips, lite + admin fragments/partials):
6. href/src/action/hx-get/hx-post URL attributes: {{{ x }}} to {{ x }}
7. Kept raw ({{{ }}}): _html and _attr blobs, inline-JS onclick (reset_url, reload_query)
8. Removed runtime URL pre-encoders exposed by the boundary flip:

9. $alink session-monitor URL, RSS source href, and files-admin download href no longer wrapped in htmlspecialchars() (the boundary now escapes)

10. domain() html_entity_decode()s stored referer URLs before building the link

Benefits:

• Single source of truth for escaping; no more & risk
• Redirects/Location and htmx keep a raw &; HTML output is uniformly &
• Blocks now honor rewrite / SEO-friendly URLs like the modules do

Technical notes:

• Left untouched: parser entity decoders, config/* content cache, setup legacy HTML echoes, sitemap XML content encoder

• Pre-existing/out-of-scope: _referer stores double-encoded anchor data; config.replace link URLs are stored with a bare &

• Verified: php -l (85 files), phpunit 8/8, guest + admin real-HTTP render with zero app-generated &

Add the breadcrumb variant galleries under demo/ and a task prompt for the site-wide URL escaping migration (escape at the HTML output boundary, keep getSeoUrl raw).

Rework the admin sidebar counter block into a data-driven table with a single row helper, switch to COUNT queries, wire sidebar dials, and bring helper names and comments in line with the project rules.

Core changes:

1. Sidebar counters (core/admin.php):
2. Replace the repeated per-module blocks with a grouped table and loop
3. Add getAdminCountRow() using SELECT COUNT(id) instead of materializing rows
4. Emit the unified sl-chip badge for counts
5. Remove the dead album block
6. Naming and comments (core/admin.php, admin/modules/monitor.php):
7. Rename admininfo() to getAdminInfo() and db_version() to getDbVersion()
8. Migrate call sites
9. Add missing function comments, drop in-body comments and blank lines
10. Sidebar dials (admin/index.php):
11. Build the dial action list once for both grid cards and list rows
12. Docs (docs/PERFORMANCE.md):
13. Sync the counter reference to the new function name

Benefits:

• Fewer and lighter count queries per admin render
• Less duplication and no dead code
• Naming and comments compliant with the project rules

Technical notes:

• No storage or template contract changes
• Backward compatibility is preserved

Rename lite theme size variables to semantic icon, chip, control, navigation, display, and forum tokens. The update keeps demo and error pages aligned with the theme token names.

Core changes:

1. Lite design tokens (templates/lite/assets/css/base.css, templates/lite/assets/css/theme.css):

2. Replaced generic numeric size variables with semantic token names

   • Icon sizes now use sl-size-icon-* tokens
   • Navigation and control sizes now use sl-size-nav-control and sl-size-control
   • Display and forum dimensions use dedicated semantic tokens
3. Demo and error surfaces (demo/*.html, error.html):
4. Updated embedded CSS references to the renamed semantic tokens
5. Kept layout dimensions and visual behavior equivalent

Benefits:

• Improves token readability and maintainability
• Aligns lite and demo surfaces with the admin token naming direction
• Reduces reliance on generic numeric CSS custom properties

Technical notes:

• No storage changes
• HTML structure and runtime contracts are unchanged
• Backward compatibility is preserved for rendered behavior