Журнал изменений
Add a neutral captcha service (core/classes/captcha.php) with Null and ALTCHA providers plus a dependency-free verifier (SHA-256 proof-of-work + HMAC). Captcha settings move into the security config (name=security&op=config) under $conf['security']['captcha']; legacy gfx_chk/capkey/capsec/quality are removed.
A single CSPRNG master secret in config/security.php is derived per purpose via getSecret() for CSRF tokens, ALTCHA signatures and field-name obfuscation, replacing the weak mt_rand 'sitekey'. getPass() is renamed to getRandomString() and hardened to random_int().
Adds honeypot, minimum form time, rate limiting and login captcha after failed attempts; serves a token-free JSON challenge at index.php?go=captcha. The file store (replay markers + counters) lives in storage/captcha/.
Resolve a page-cache path bug and an htmx XPath corruption in the JS minifier, fix the lite theme YouTube link, and drop the tracked prompt copy that now lives locally.
Core changes:
- Page cache and JS minifier (core/system.php):
Append the missing slash to the cache directory base path
- Page-cache writes now match the read path instead of landing in the storage root
- Stops filemtime()/unlink() warnings from the cache cleanup loop
Skip non-files in the cache cleanup sweep
- Guards against unlink() on cache subdirectories such as view and templates
Fix the JS minifier bracket regex (\] -> \))
- Preserves the htmx XPath literal and fixes the createExpression SyntaxError in the console
- Lite theme social links (templates/lite/layouts/app.html, home.html):
- Point the YouTube link to the @SLAED-CMS channel handle
- Docs cleanup (docs/LITE_THEME_CSS_SIMPLIFICATION_PROMPT.md):
- Remove the tracked prompt copy; it now lives in the local .prompts directory
Benefits:
- Working page cache and a clean PHP error log
- htmx interactions no longer break on invalid XPath
- Correct outbound social link
Technical notes:
- With $conf['cache'] enabled, page caching becomes functional (was effectively a no-op before)
- No backward-incompatible changes
Round comment/forum avatars (shared sl-com-ava ring), forum author link, 2/3-column forum legends, comment rating order (down-score-up), related thumbnails (new 60x60 logo), and reuse sl-card-id badge for comment/forum post numbers. Map forum/topic state icons to Bootstrap Icons (record-circle, exclamation-fill, x-circle-fill, chat bubbles, play-circle-fill, clock-history, box-arrow-in-right) with etalon color coding, and size forum category images via --sl-size-64. Replace the Editor/admin menu text trigger with a system-wide gear-icon button (sl-card-id style) placed left of the post number.
Move <img> markup out of the parser into a new parser-image.html fragment (lite + admin), with supporting base/theme CSS. Remove unused legacy images (no-image.png, big-icons.png, asc/bg/desc.gif, misc/index.html) and relocate head-bg.jpg to images/seasons. Parser fixtures test updated.
Replace the legacy raster sprite with Bootstrap Icons glyphs in markup (<i class="bi">) for meta, forum/topic, message, cart, pager, slider, alert, favourite, like and carousel icons. Render the rating as bi half-stars (getRatingStars helper) and unify icon color/size via base.css tokens. Remove all dead sprite CSS and delete sprite.png; theme.css drops from ~5564 to 4731 lines.
Merge 9 identical clearfix :after rules into one group, drop redundant button box-shadow/text-shadow already provided by the base group, unify identical sl-but-navi/sl-but-read, and group matching sprite dimensions (date/card-date, message/topic twins). No visual changes; theme.css 5283 to 5211 lines.
Merge identical declaration blocks (table heads/bodies, menus, card/cart id, idea/feedback tabs, sprite icon base and dimensions), replace hard-coded shadows and colors with existing base.css tokens, and remove dead selectors (sl-list-head/row, legacy fmenu/demo-line-title/ava-min aliases, sl-heading2, cart/forum head variants). No visual changes; reduces theme.css from 5564 to 5283 lines.
Always emit sl-table-head for table/forum/cart heads and use sl-heading instead of sl-heading2, since their styling is identical. Enables removing the redundant CSS selectors.
Follow-up to the semantic HTML commit: switches section labelling from aria-labelledby + IDs to plain aria-label, removes the now-redundant id="upper" from the wordmark anchor, and collapses the double-div foot-menu wrapper now that the CSS handles full-bleed directly.
Core changes:
- app.html / home.html:
section#demo-line: aria-labelledby → aria-label; drop id="demo-line-title" from h2 (ID was only needed for the labelledby reference)
- footer .sl-upper-wordmark: remove id="upper" (CSS now targets .sl-upper-wordmark)
- section Технологии / Контакты: aria-labelledby → aria-label; drop IDs from h2
Remove div#foot-menu + inner div.sl-wrp wrapper; nav.sl-fmenu is now a direct child of footer via div.sl-wrp.sl-clrfix (full-bleed handled in CSS)
Benefits:
- Cleaner HTML: fewer IDs, shallower nesting in the footer
- ARIA labels still present; labelledby pattern not needed when label text is static