Журнал изменений
All manual htmlspecialchars() calls in admin module files are replaced by the new has_content_text / content_text, has_value_text / value_text, and has_field_text / field_text template slots. Escaping now happens inside the Mustache fragments at the output boundary instead of in PHP.
Core changes:
- admins.php:
Cell content for name, title, lang columns uses has_content_text; the concatenated htmlspecialchars($name) after info-tooltip moves to a separate content_text slot with prefix_html for the tooltip
- blocks.php:
- filecode() form row for filename uses has_field_text / field_text
- database.php:
- getSqltable() cells for type, table, sql use has_content_text
dump() alert for parse error passes raw $parsed['error'] without manual escaping; the alert fragment handles output encoding
- fields.php / replace.php:
toggle_onclick replaced with toggle_target_id + is_toggle_block to wire the new button toggle; no htmlspecialchars changes (values are constants)
- groups.php:
Tooltip + badge cell splits into prefix_html (tooltip) + content_html (badge); color_attr no longer manually escaped
- scheduler.php:
- nextr, stat, priority cells switch to has_content_text / content_text
- Title cell: info-tooltip moves to prefix_html, title text to content_text
- security.php:
- banlist() tooltip items for IP_CIDR and BANN_REAS use has_value_text
- Ban reason cell uses has_content_text
- config() textarea value_text for dump_skip loses manual htmlspecialchars
Benefits:
- Removes ~20 htmlspecialchars() calls from PHP business logic
- Escaping is now consistently enforced at template render time
- Callers read cleaner: no ENT_QUOTES / ENT_SUBSTITUTE flags in PHP
Technical notes:
Template fragments updated in the preceding commit handle escaping via Mustache {{ }} (auto-escaped) vs {{{ }}} (raw HTML) distinction
Admin stylesheet receives a broad visual consistency pass: icon sizes are unified, form element hover states are added, and new component styles are introduced for the voting widget and the toggle-form-block button.
Core changes:
- base.css:
- Global .bi rule sets font-size: 18px for all Bootstrap Icons
Input/textarea/select get a :hover state: white background, blue-tinted border, subtle box-shadow; disabled inputs excluded
- Focus rule adds explicit border-color alongside the existing box-shadow
- theme.css — icon size unification (16px → 18px):
sl-plus, sl-tip, sl-date/cat/views pseudo-elements, sl-monitor-head, sl-status-compact-left, sl-overview-icon-arr all updated to 18px
- theme.css — toggle-form-block button:
New sl-toggle-form-block-toggle: inline-flex button, green when closed, red when open (.sl-is-open state); scales on hover/focus
- sl-toggle-form-block-title: flexbox layout with gap; title color updated
- sl-toggle-form-block-label: cursor:default, matching line-height
- Label colon suppressed inside toggle-form-block via :not() selector
- theme.css — row-actions trigger:
New sl-row-actions-trigger: 18px inline-flex icon button, purple color, scale transform on hover; .bi inside inherits 18px
- theme.css — table layout:
- sl-col-status width reduced 64px → 52px; sl-col-actions 102px → 72px
- New fixed widths: sl-col-lang 58px, sl-col-module 88px
- th.sl-col-status / th.sl-col-actions padding tightened to 4px
- theme.css — voting widget (sl-vote-*):
Full set of voting result styles: sl-vote-view, sl-vote-title, sl-vote-list, sl-vote-result, sl-vote-result-head, sl-vote-answer, sl-vote-result-meta, sl-vote-meter, sl-vote-progress
- Colour variants 1–5 via sl-vote-meter-N / sl-vote-progress-N
- theme.css — sl-tip refinement:
- Width/height 16px → 18px; font-size 15px → 18px; hover scale 1.08 → 1.12
- Inner div font-size: 14px / line-height: 16px for consistent tooltip text
- sl-plus open state shows minus icon via ::before content override
Benefits:
- Visual consistency: all icons at 18px regardless of component context
- Input hover feedback matches the rest of the SLAED UI pattern
- Voting widget fully styleable without inline CSS
Technical notes:
.bi global rule in base.css takes precedence only where no component rule overrides; component rules that already set font-size are unchanged
Six new template fragments are introduced to support the voting admin redesign and to provide reusable list and AJAX-action primitives.
Core changes:
- comment-action-ajax.html (fragment):
- HTMX-powered action link with hx-get, hx-target, hx-swap attributes
Supports class variants: is_favorite, is_button_blue, is_cart_plus, is_cart_minus; used as the Vote submit button in voting widget
- editor-action-menu.html (fragment):
Alternative row-actions variant using bi icon as trigger span directly without the wrapper nav structure; kept for editor-specific contexts
- list-item.html (fragment):
- Minimal <li> wrapper supporting content_html and nested children_html
- list.html (fragment):
Renders <ul> or <ol> with conditional class variants: sl-list, sl-sublist, sl-sublist-two, login-top (with logged state)
- voting-view.html (fragment):
Single poll answer row: answer text, percentage, vote count, and a <meter> progress bar with colour variant class sl-vote-meter-N
- voting-widget.html (partial):
Full voting widget section: title header, answer list, admin links, submit button, vote/comment footer links; wraps optional <form> tag
Benefits:
- Voting result display fully template-driven, no HTML generation in PHP
- List and action fragments reduce ad-hoc HTML in module files
Technical notes:
voting-widget.html replaces the HTML previously assembled in getVotingView() inside core/system.php
- CSS for sl-vote-* classes is added in the accompanying style commit
Two admin UI patterns are updated to use semantically correct, accessible interactive elements and the new data-attribute toggle API.
Core changes:
- row-actions.html:
Trigger element changes from <span class="sl-but-red">text</span> to <span class="sl-row-actions-trigger" role="button" tabindex="0"> wrapping a Bootstrap icon <i class="bi bi-menu-button-wide-fill">
- Label text moves to title and aria-label attributes for screen readers
- Visual label is now the icon only; text is available on hover/focus
- toggle-form-block.html:
Block element gains data-sl-toggle and data-sl-toggle-default when is_toggle_block is true, enabling JS state tracking
New toggle_target_id path: renders a <button class="sl-plus sl-toggle-form-block-toggle"> with data-sl-toggle-control pointing to the next block, replacing the previous toggle_onclick link pattern
- Existing toggle_onclick link path is preserved as legacy fallback
Label is now wrapped in a <span class="sl-toggle-form-block-label"> for independent styling
Benefits:
- Row action trigger is keyboard-navigable without inline onclick
- Toggle button communicates expand/collapse semantics to assistive tech
- Removes final toggle_onclick usages from active code paths
Technical notes:
toggle_onclick attribute still accepted but only for legacy callers; new callers must use toggle_target_id + is_toggle_block
CSS for sl-row-actions-trigger and sl-toggle-form-block-toggle added in the accompanying style commit
Admin data-display fragments gain a safe-text rendering path so callers can pass raw PHP strings and let the template apply htmlspecialchars, instead of calling htmlspecialchars in PHP before passing content_html. This makes escaping responsibility explicit and template-side.
Core changes:
- table-cells.html:
- Add is_col_title class flag → outputs sl-col-title on th and td
- Add prefix_html slot rendered before content in each cell
Add has_content_text / content_text: auto-escaped text path replacing manual htmlspecialchars in PHP callers
- th.html:
- Mirror is_col_title class support to header cells
- label.html:
- Add prefix_html slot (renders before label content)
- Add has_content_text / content_text safe-text path
- Existing content_html path preserved as fallback
- info-tooltip.html:
Add has_value_text / value_text on tooltip items, escaping value server-side in template instead of in PHP
- div-row.html:
Add has_field_text / field_text path for form rows that display plain text values; applies to both wrapped and unwrapped field variants
Benefits:
Removes htmlspecialchars() from PHP call sites; escaping is done once in the template layer at the correct output boundary
- prefix_html enables tooltip + text combos without wrapper <span>
Technical notes:
- All existing content_html paths remain fully backward-compatible
- is_col_title maps to a new CSS class added in the accompanying style update
Every inline OnClick="HideShow(...)" handler is removed from all Mustache templates (admin, default, lite, simple) and replaced with the declarative data-sl-toggle-control / data-sl-toggle-effect / data-sl-toggle-duration attributes consumed by slaed.js. No behaviour changes — only the binding mechanism moves from inline JS to data attributes.
Core changes:
- Admin partials (session-summary, block-sidebar, dashboard-panel):
- Replace all OnClick HideShow() with data-sl-toggle-control + effect attrs
- Admin fragment (image-preview):
- href changed from 'javascript: void(0);' to '#'
- toggle_onclick removed; data-sl-toggle-control/effect/duration added
- Popup span gains data-sl-toggle and data-sl-toggle-default="closed"
- Frontend templates (default / lite / simple):
- comment, forum-post, image-preview: same OnClick → data attribute migration
- account-profile, contact-block, login-nav, session-summary: same migration
- voting-home: span OnClick replaced with data-sl-toggle-control
- index.html (commented code): updated in place for consistency
Benefits:
- Eliminates all inline JavaScript from template markup
- Consistent toggle behaviour across admin and frontend themes
- Works with htmx afterSwap hook added in the JS refactor
Technical notes:
- toggle_onclick template variable is no longer consumed in image-preview
- data-sl-toggle-default="closed" controls initial hidden state without JS
The legacy window.HideShow() function is removed in favour of a data-attribute-driven toggle API that keeps behaviour and animation effects fully declarative. Callers set data-sl-toggle-effect and data-sl-toggle-duration on the trigger element; the JS reads these on every event instead of relying on positional arguments baked into HTML.
Core changes:
- setToggleBlockState / setToggleBlock (slaed.js):
Accept effect and duration as parameters instead of ignoring animation
- 'slide' delegates to setSlideMotion(); 'puff' to setFadeScale()
- plain toggle falls back to hidden/display as before
- event.preventDefault() now called on non-checkbox click triggers
- Toggle block initialisation (slaed.js):
Read data-sl-toggle-default attribute ('open'/'closed') for initial state when no saved state is present
- window.HideShow removal (slaed.js):
- Global shim deleted; all call sites migrated to data-sl-toggle-control
- htmx afterSwap hook (slaed.js):
setToggleBlocks() called after every HTMX content swap so dynamically injected toggle blocks are wired automatically
Benefits:
- No inline JS in HTML required for animated toggles
- Animation type is declarative and visible in markup, not hidden in PHP
- Eliminates the last globally-scoped legacy function from slaed.js
Technical notes:
Backward compatibility: window.HideShow no longer exists; all call sites must be updated to data-sl-toggle-* attributes
- No changes to the public toggle-state API (getToggleState/setToggleState)
Visual updates to admin theme styles and a new template fragment for the debug stats panel.
base.css
Soften default input/textarea/select look: lighter background (#fcfeff), softer border (#d6e2ea), updated text color (#59697a). Add transition for background, border and box-shadow on focus/hover
theme.css
Add .sl-debug-stats grid styling with .sl-debug-value tone variants (success/warn/danger) for the new debug-stats fragment
Restyle .sl-warn / .sl-info callouts: larger icon area (32px, vertically centered via transform), wider left padding (60px), min-height 40px
Replace the single 2px progress bar in .sl-alert-flash-bar with a top+bottom hairline pattern using currentColor; warn flash uses orange (#d68a2d), default success uses green (#37a957)
- Add gradient hairline under the admin login header (was a flat #e3edf3 line)
templates/admin/fragments/debug-stats.html
New fragment that renders the system debug summary as a definition list (CPU load, memory use, timestamp), replacing the previous ad-hoc inline markup. Driven by tone flags (cpu_is_/mem_is_) consistent with the rest of the admin template vocabulary
Routine config update reflecting changed site settings and a refreshed base fingerprint after template and asset changes in this sprint.
Core changes:
- config/global.php:
- Updated sitekey to new value
- Updated variables bitmask
- config/local.php:
- Updated base_fingerprint hash
Benefits:
- Config state reflects current codebase revision
- Fingerprint ensures cache invalidation for changed assets
Technical notes:
- base_fingerprint is auto-derived from asset checksums
- variables bitmask controls enabled site feature flags