Журнал изменений

Continue the list()->[], setRedirect(), and getVar() migration across seven more admin modules. All header()+exit; redirect pairs replaced with the centralized setRedirect() helper.

Core changes:

1. favorites.php:
2. setRedirect() replaces header()+exit; pairs
3. fields.php:
4. list() → [] for sql_fetchrow() destructuring
5. setRedirect() replaces header()+exit; pairs
6. groups.php:
7. list() → [] throughout
8. setRedirect() replaces header()+exit; pairs
9. lang.php:
10. list() → [] throughout
11. setRedirect() replaces header()+exit; pairs
12. messages.php:
13. list() → [] throughout
14. setRedirect() replaces header()+exit; pairs
15. modules.php:
16. setRedirect() replaces header()+exit; pairs
17. newsletter.php:
18. list() → [] throughout
19. setRedirect() replaces header()+exit; pairs

Benefits: - Consistent redirect handling across all admin modules - Eliminates legacy list() syntax — short array syntax throughout

Technical notes: - Logic and DB queries unchanged - Backward compatible

Replace deprecated list() with short array syntax [], use setRedirect() instead of header()+exit; pairs, switch $_COOKIE reads to getVar(), and fix null-default values on getVar() calls across seven admin modules.

Core changes:

1. admins.php:
2. list() → [] for sql_fetchrow() destructuring
3. getVar('post', 'amodules[]', 'var', []) — explicit empty default
4. $_COOKIE['sl_close_9'] → getVar('cookie', 'sl_close_9', 'num', 0)
5. setRedirect() replaces header()+exit; pairs
6. del(): guard $id > 0 before DELETE query
7. blocks.php:
8. list() → [] throughout
9. setRedirect() replaces header()+exit; pairs
10. getVar defaults corrected
11. categories.php:
12. list() → [] throughout
13. setRedirect() replaces header()+exit; pairs
14. comments.php:
15. list() → [] throughout
16. setRedirect() replaces header()+exit; pairs
17. config.php:
18. setRedirect() replaces header()+exit; pairs
19. database.php:
20. setRedirect() replaces header()+exit; pairs
21. editor.php:
22. list() → [] throughout
23. setRedirect() replaces header()+exit; pairs

Benefits: - Eliminates silent header()/exit anti-pattern; redirects now centralized - Short array syntax aligns with PHP 7.1+ codebase conventions - getVar() for cookies prevents direct superglobal access

Technical notes: - Behavior preserved; no logic changes - Backward compatible with existing DB schema

Replace the ad-hoc plaintext error log with an AI-ready NDJSON schema (one JSON object per line). Inline closure helpers replace global named functions to avoid namespace pollution, and all sensitive fields are redacted before logging.

Core changes:

1. Error log engine (core/security.php):

2. New schema: timestamp, level, type, message, req_id, ip, method, url, referer, ua, context (query/post/cookie_keys/session_keys), file, line, trace, mem_mb, mem_peak_mb, duration_ms, php_version, slaed_version

3. Inline closures: \$ls (sanitize/truncate), \$lredact (mask secrets), \$lbound (cap array size), \$lctx (bounded request context), \$lreq, \$lmem, \$lwrite (atomic file append with flock)

4. HTTP error handler: logs 403/404/503 with request context + referer
5. PHP error handler: logs warnings/notices/fatals with file+line+trace
6. Exception handler: logs uncaught exceptions with full stack trace
7. Unhandled rejection: register_shutdown_function for fatal errors

Benefits: - Log entries are machine-parseable — compatible with log aggregators - Sensitive keys (pass, token, auth, secret, etc.) auto-redacted - No more log injection: \r \n \0 stripped before writing - Atomic flock()-based writes prevent concurrent log corruption

Technical notes: - Log format: NDJSON — one JSON per line, UTF-8, no BOM - Max 50 GET/POST keys per entry; string values capped at 1024 chars - Stack traces capped at 10 frames to control log size - Replaces previous plaintext format — existing log files remain valid

Extend the SEO pipeline with two new template tokens ([headline], [author]) and align core utility functions with the codebase conventions: getVar() for input, resolved absolute paths in checkPerms(), improved getImgText() with [img] BBCode support, and the renamed head()->setHead(array \$seo).

Core changes:

1. Schema.org default config (config/global.php):
2. Replace "headline": "0" with "headline": "[headline]"
3. Replace "name": "[site]" (author) with "name": "[author]"
4. System utilities (core/system.php):

5. Rename head() to setHead(array \$seo = []) — accepts optional SEO fields * New keys: title, desc, img, time, ctitle, author * Derive \$headline from \$seo['title'] (plain text, no compound suffix)

6. Add [headline] and [author] to SEO from/to replacement arrays

7. Refactor checkPerms(string \$fp, int \$id) to checkPerms(string \$fp) * Callers now pass absolute path directly; no id-based base resolution

8. Extend getImgText() with \$check=true param and [img=…][/img] BBCode * Supports and forms * \$check=false skips file_exists() for remote/virtual images

9. Fix fields_in(): explode('|', \$fieldb ?? '') — null-safe coalesce
10. Admin core (core/admin.php):
11. Replace func_get_args() in getStatistic() with getVar('get', …)
12. Fix checkPerms() calls: prepend BASE_DIR.'/' to construct absolute paths
13. Declare getStatistic(): void return type

Benefits: - Schema.org headline and author now populated with real article data - setHead() API eliminates scattered global variable mutations in modules - getImgText() handles [img] BBCode variants without regex fragility

Technical notes: - setHead() is backward-compatible when called with empty array - All old call sites of head()/foot() must migrate to setHead()/setFoot()

Update the SEO template variable reference string (_TPLVARS) in all six admin UI languages. The [title] description is also clarified to reflect the full composite SEO title (article + category + module + site).

Core changes:

1. Language files (admin/language/de.php, en.php, fr.php, pl.php, ru.php, uk.php):

2. Add [headline] variable — article headline (plain text, no suffixes) * Used in Schema.org "headline" field

3. Add [author] variable — article author display name * Used in Schema.org "author.name" field

4. Clarify [title] description to reflect full SEO composition

Benefits: - Editors can now understand all available SEO tokens at a glance - Consistent variable docs across all 6 UI languages

Technical notes: - Change is documentation only (help text); no PHP logic altered - Backward compatible — existing templates not affected

The regex used to extract table names from INSERT statements could match partial identifiers where a word character preceded the underscore prefix, producing false-positive table matches.

Core changes:

1. tests/InsertValidationTest.php:
2. Add negative lookbehind (?<!\w) before _(\w+) in INSERT pattern
3. Ensures the prefix underscore is only matched at a word boundary

Benefits: - Eliminates false-positive table name matches in test assertions - Test results more accurately reflect actual INSERT targets

Technical notes: - Pattern change is regex-only; test logic and assertions unchanged - Lookbehind is zero-width and does not affect captured groups

Two menu links pointed to deprecated HTTP URLs on old domains.

Core changes:

1. templates/lite/index.php:
2. http://www.slaed.in -> https://slaed.de (themes/templates link)
3. http://www.slaed.info -> https://slaed.info (PHP guide link)

Benefits: - Eliminates mixed-content warnings on HTTPS sites - Reflects current domain structure

Technical notes: - No logic or structural changes; text labels unchanged

Two issues in the auto_links admin add() function corrected.

Core changes:

1. auto_links/admin/index.php:
2. Add \$stop = \$stop ?? []; guard before first use to prevent undefined var

3. Remove save_text() wrapper around getVar() calls for a_sitename and a_description: input encoding should happen at save time, not on read

Benefits: - Prevents PHP notice/warning on fresh add form where \$stop is undefined - Separates input retrieval from output encoding responsibility

Technical notes: - save_text() is called correctly in the save handler; reading back raw values from getVar() is the expected pattern for form pre-population

Two consistent patterns updated across nine admin modules to reduce boilerplate and align with the new voting URL routing scheme.

Core changes:

1. Anonym author display (8 modules: faq, files, help, jokes, links, media, news, pages):

2. Replace ($user_name) ? ... : (($uname) ? $uname : ($confu['anonym'] ?? 'Anonym')) with $user_name ?: ($uname ?: $confu['anonym'])

3. Removes redundant ?? 'Anonym' fallback; $confu['anonym'] is the canonical default
4. Voting admin links (news/admin/index.php, shop/admin/index.php):
5. Update ?op=voting_add&id= to ?name=voting&op=add&id=
6. Aligns with the new op-based routing in the modernized voting admin module

Benefits: - Consistent null-coalescing style across all content admin modules - Voting edit links work correctly after voting admin module was refactored

Technical notes: - $confu['anonym'] value comes from user config; no hardcoded fallback needed - Encoding pattern for copyright fixed in affected files (faq, files, etc.)

Four admin modules used is_admin_god() as their access guard, allowing only super-admins in. Replaced with is_admin_modul() so module access can be delegated to non-god administrators via the modules config.

Core changes:

1. Access guard replacement (four files):
2. modules/account/admin/index.php: is_admin_god() -> is_admin_modul('account')
3. modules/changelog/admin/index.php: is_admin_god() -> is_admin_modul('changelog')
4. modules/rss/admin/index.php: is_admin_god() -> is_admin_modul('rss')
5. modules/sitemap/admin/index.php: is_admin_god() -> is_admin_modul('sitemap')
6. Additional fixes in the same files:
7. account: rename users() to account() to match op dispatch convention
8. changelog: remove @ suppressor from file_get_contents()
9. sitemap: remove @ suppressor from fopen(); remove BOM from file header

Benefits: - Delegated admin access works correctly for these modules - Error suppression removed; failures are now visible in error logs

Technical notes: - is_admin_modul() reads from $conf['modules'] so no DB query needed - Behavior for god-level admins is unchanged (they pass all module checks)