Журнал изменений

Portable, PHP-level redirects in core/security.php (proxy-aware via X-Forwarded-Proto, GET-only, default off):

• bare /index.php -> / (301) to kill the duplicate homepage URL
• opt-in forcessl (http->https) and forcehost (www->canonical homeurl host)

Admin config SEO tab gains forcessl/forcehost toggles (constants in all 6 languages); getPublicUrl() returns root with trailing slash; help doc admin/info/config/ru.md documents canonical behavior and the new toggles.

Move hardcoded & and hand-built HTMX markup out of PHP: URL producers now pass a raw & URL as data, and fragments escape it once at the output boundary via {{ }}. Removes the last inconsistency where URL-bearing HTMX attributes still followed the legacy escape-at-source + markup-in-PHP pattern.

Core changes:

1. Link/tab/button fragments (templates/{lite,admin}/fragments):
2. tabs-link.html: add hx_get/hx_target/hx_swap block, URL escaped via {{ }}

3. button.html: add hx-post block (hx_post/hx_include/hx_target/hx_swap/ hx_on_click/hx_on_after), URL escaped; JS validation stays raw passthrough

4. link fragment already had is_htmx (hx-get="{{ href }}") — reused as-is
5. PHP producers now emit data, not markup:
6. core/admin.php: upload file links use is_htmx + hx_target (drops & blob)
7. admin/modules/uploads.php: upload tabs pass raw hx_get/hx_target
8. core/user.php: comment/PM submit forms pass raw hx_post + hx_* fields
9. Docs:
10. Remove docs/PROMPT_HREF_AMPERSAND.md (task complete)

Benefits:

• Single escape at the sink; & structurally impossible
• Unified hx_* field vocabulary across link/tabs-link/button fragments
• Removes duplicated URL (href + hand-built hx-get) in upload links

Technical notes:

• getSafe() = htmlspecialchars(ENT_QUOTES|ENT_SUBSTITUTE, UTF-8)
• Verified live: comment form, admin upload tabs — single &, zero &
• Additive change; legacy link_attr/input_attr passthrough kept for other uses

URLs are now treated as data: every producer emits a raw & and the template layer escapes exactly once at the output boundary via {{ href }}. This removes the previous mix of producer-side & encoding and raw {{{ }}} output and eliminates latent single/double-escape inconsistencies across the site.

Core changes:

1. URL producers to raw & (blocks, modules, admin/modules, core):
2. Front-end SEO links built via getSeoUrl() (raw &, SEO-friendly URLs under rewrite)
3. Admin afile.php?..., htmx go=...&op=... tails, absolute/redirect URLs to raw &
4. getQueryString() always emits raw & (dropped the obsolete $html parameter)
5. Template output boundaries (81 flips, lite + admin fragments/partials):
6. href/src/action/hx-get/hx-post URL attributes: {{{ x }}} to {{ x }}
7. Kept raw ({{{ }}}): _html and _attr blobs, inline-JS onclick (reset_url, reload_query)
8. Removed runtime URL pre-encoders exposed by the boundary flip:

9. $alink session-monitor URL, RSS source href, and files-admin download href no longer wrapped in htmlspecialchars() (the boundary now escapes)

10. domain() html_entity_decode()s stored referer URLs before building the link

Benefits:

• Single source of truth for escaping; no more & risk
• Redirects/Location and htmx keep a raw &; HTML output is uniformly &
• Blocks now honor rewrite / SEO-friendly URLs like the modules do

Technical notes:

• Left untouched: parser entity decoders, config/* content cache, setup legacy HTML echoes, sitemap XML content encoder

• Pre-existing/out-of-scope: _referer stores double-encoded anchor data; config.replace link URLs are stored with a bare &

• Verified: php -l (85 files), phpunit 8/8, guest + admin real-HTTP render with zero app-generated &

Add the breadcrumb variant galleries under demo/ and a task prompt for the site-wide URL escaping migration (escape at the HTML output boundary, keep getSeoUrl raw).

Rework the admin sidebar counter block into a data-driven table with a single row helper, switch to COUNT queries, wire sidebar dials, and bring helper names and comments in line with the project rules.

Core changes:

1. Sidebar counters (core/admin.php):
2. Replace the repeated per-module blocks with a grouped table and loop
3. Add getAdminCountRow() using SELECT COUNT(id) instead of materializing rows
4. Emit the unified sl-chip badge for counts
5. Remove the dead album block
6. Naming and comments (core/admin.php, admin/modules/monitor.php):
7. Rename admininfo() to getAdminInfo() and db_version() to getDbVersion()
8. Migrate call sites
9. Add missing function comments, drop in-body comments and blank lines
10. Sidebar dials (admin/index.php):
11. Build the dial action list once for both grid cards and list rows
12. Docs (docs/PERFORMANCE.md):
13. Sync the counter reference to the new function name

Benefits:

• Fewer and lighter count queries per admin render
• Less duplication and no dead code
• Naming and comments compliant with the project rules

Technical notes:

• No storage or template contract changes
• Backward compatibility is preserved