Журнал изменений
Render each recent error time in getDebugErrors() via date_create()->format(_TIMESTRING) instead of the raw stored string, so the debug panel shows dates in the configured system format and keeps the embedded timezone offset.
Core changes:
- Debug error list (system.php):
Parse row time with date_create() and format with _TIMESTRING
- Guard empty time values so no stray leading space is emitted
- Keep channel, message and optional URL layout unchanged
Benefits:
- Consistent, localized timestamps in the performance/debug panel
- Avoids timezone shift from re-parsing with the server default
Technical notes:
- Presentation only, no storage/format change
- Backward compatible
Lay out the four system-performance metrics like the voting result rows: label on the left, value on the right, on one line above a full-width progress bar, in both the admin and frontend themes.
Core changes:
- Debug stats fragment (templates/{admin,lite}/fragments/debug-stats.html):
- Move the value next to the label inside the <dt> header; <dd> holds only the bar
- Theme styles (templates/{admin,lite}/assets/css/theme.css):
- Replace the two-column grid with a flex header (space-between) and a full-width bar
- Drop the trailing colon after the label
Benefits:
- Clearer, consistent performance panel matching the voting result layout
Technical notes:
- Template/CSS only; no PHP change; data keys and value strings unchanged
The index.php CSRF gate read an upload_token request param that no client
ever sends (uploads, the editor and forms all use token or the
X-CSRF-Token header), so the fallback was unreachable.
Core changes:
- Entry point (index.php):
- Drop the unreachable upload_token branch from the token resolution chain
Benefits:
- Removes dead code from the security gate
Technical notes:
- Behavior-preserving: the token param and X-CSRF-Token header remain
Voting results and the debug-stats panel used two parallel bar systems: a <meter>-based .sl-vote-meter with ~135 lines of vendor pseudo-element hacks, plus orphaned --sl-progress-* variables. Unify everything on a single gradient div component .sl-progress-line and drop the meter system.
Core changes:
- Markup (lite + admin fragments):
- voting-view, debug-stats: <meter> replaced by .sl-progress-line div bars
- Styles (lite + admin base.css, theme.css):
- Add .sl-progress-line / .sl-progress-1..5 gradient rules
- Remove all .sl-vote-meter rules and --sl-vote-meter-* variables
- Component is margin-neutral; spacing scoped to .sl-vote-list / .sl-vote-result
- Lite bars thickened to 10px track / 8px fill, radius 3px; admin keeps 6/4/2
Benefits:
- One bar component instead of two; net fewer lines of CSS
- Consistent cross-browser rendering, restored gradient look
Technical notes:
- Threshold color (debug success/info/warn/danger) preserved via sl-progress-{N}
- Admin and lite themes remain independent
The vote action used hx-get without a token, so it hit the index.php CSRF gate ("Illegal file access"); htmx also does not include form fields on GET, so the chosen options were never sent. Switch the vote to an htmx POST that carries a hidden CSRF token, matching the admin token pattern.
Core changes:
- Voting view (core/system.php):
- getVotingView(): vote button uses hx-post via an is_post flag
- Pass the poll id and ajax token into the voting form
- Templates:
- comment-action-ajax: add is_post flag (hx-post instead of hx-get)
- voting-widget: hidden id and token fields inside the form
Benefits:
- Voting passes the CSRF gate and records the selected options
- Reuses the established hidden-token contract, no global shim
Technical notes:
- POST lets htmx include the enclosing form (body[] + token)
- Backward compatible: other comment-action-ajax callers stay on GET
Array form fields must be read via the name[] key suffix; getVar() never
supported a type='array' argument, so ~20 callers that passed it fell
through to the scalar path where filter_input() returns false on an array,
crashing with "count(): ... false given" (e.g. admin poll save).
Core changes:
- Input reader (core/security.php):
- Revert getVar() to detect arrays only by the key[] / key[n] syntax
- Drop the unsupported 'array' type branch
- Callers migrated to key[] (raw, indexes preserved):
- voting/admin: body[], answer[] (keeps body<->answer alignment)
- news/admin, shop/admin: associated[], id[]
- media, media/admin: links[]
- money, money/admin: intro[]
- forum, pages/admin: id[]
Benefits:
- Fixes admin poll save and other multi-value form handlers
- Single canonical way to read arrays, matching existing key[] callers
Technical notes:
- Empty filter type returns the raw array (no element stripping)
- Behavior-preserving: previously these calls returned false (broken)
Mirror the plugin analysis in Russian (identifiers, code and JSON stay English per project rules) so it matches the team's working language.
Core changes:
- Plugin analysis (docs/PLUGINS.md):
- Translate the prose to Russian; keep manifest examples and identifiers in English
Benefits:
- Documentation in the team's working language
Technical notes:
- Documentation only; no code change
Document SLAED's existing extension mechanisms and a safe direction for an admin-managed plugin layer based on the editor manifest/driver pattern.
Core changes:
- Plugin analysis (docs/PLUGINS.md):
- Survey current mechanisms (modules, editor plugins, captcha provider, vendored libs)
- Recommend generalizing the manifest + driver + registry pattern
- Propose a managing (not installing) admin page; warn against remote PHP install
Benefits:
- Shared reference for unifying SLAED's extension points
Technical notes:
- Documentation only; no code change
Style the ALTCHA captcha checkbox like the theme form controls (size, border, radius, shadow) with a green success state and a single centered check mark, in both the admin and frontend themes.
Core changes:
- Admin theme (templates/admin/assets/css/theme.css):
- Replace the earlier glyph-suppression hack with a full captcha checkbox style
18px box using --sl-color-border-strong / --sl-radius-control / --sl-shadow-input, green --sl-color-success when checked; ALTCHA's own SVG check, centered
- Frontend theme (templates/lite/assets/css/theme.css):
- Same captcha checkbox style resolved through the lite theme tokens
Benefits:
- Consistent, on-brand captcha checkbox in both themes
- Single, centered, green check mark (no double, not crooked)
Technical notes:
Scoped to .sl-captcha .altcha-checkbox; keeps ALTCHA's SVG centered by syncing --altcha-checkbox-size with the box size
The admin theme draws its own checkbox glyph via a background-image, which stacked on top of the ALTCHA widget's own SVG check mark (rendered in light DOM), so the verified captcha showed two check marks.
Core changes:
- Admin theme (templates/admin/assets/css/theme.css):
Suppress the admin checkbox background glyph on .altcha-checkbox inputs (:checked / :indeterminate), leaving only ALTCHA's own check mark
Benefits:
- Single, correct check mark in the admin login captcha
Technical notes:
- CSS only; scoped to .sl-admin-shell .altcha-checkbox; the lite theme was unaffected