Журнал изменений

The rewrite.php file contained regex-based URL transformation rules managed through the admin editor. This functionality has been superseded: URL rewriting is now controlled exclusively by $conf['rewrite'] and server-level .htaccess rules. All include() calls and the rewrite() function were removed from the codebase in a prior cleanup.

Core changes:

1. config/rewrite.php:
2. File deleted (122 lines of legacy regex rewrite rules)
3. admin/info/editor-*.html (6 language files):
4. Remove "System SEF" tab description (referencing config/rewrite.php)
5. Rename "Server SEF" tab to "Apache rules" for clarity

Benefits: - Removes dead code with no callers - Admin editor UI reflects the actual available tabs - Reduces confusion between PHP-level and server-level URL rewriting

Technical notes: - $conf['rewrite'] config key is preserved; controls mod_rewrite behavior - .htaccess-based rewriting remains fully functional

Protect reserved config files from being merged into $conf via getConfig() or accidentally overwritten via setConfigFile(). Three files serve system injection purposes (not config arrays) and must be excluded from glob merge.

Core changes:

1. getConfig() (core/system.php):
2. Replace single local.php check with explicit $skip array
3. Skip list: local.php, system.php, header.php, chmod.php
4. setConfigFile() (core/system.php):
5. Add static $reserved guard at function entry point
6. Reserved: system.php, header.php, chmod.php, local.php
7. Calls with reserved filenames return silently without writing

Benefits: - Prevents accidental overwrite of system injection files - Eliminates false config merges from null-returning reserved files - Explicit skip list is self-documenting

Technical notes: - config/system.php, header.php, chmod.php return null by design - config/local.php provides per-environment overrides, must not be merged - Backward compatible: existing callers are unaffected

Remove the configurable anonymous user name ($confu['anonym']) and replace it with the static language constant _ANONYM defined in all six root language files. This eliminates a config option that had no practical need for per-site customization.

Core changes:

1. Language files (language/*.php — 6 files):

2. Add define("_ANONYM", "...") between _AND and _ANSWER in all 6 languages * en: "Guest", ru: "Гость", de: "Gast", fr: "Invité", pl: "Gość", uk: "Гість"

3. Admin language files (admin/language/*.php — 6 files):
4. Remove define("_ANONYMOUSNAME", "...") from all 6 files
5. Config and core (config/users.php, core/admin.php, core/security.php, core/user.php):
6. Remove 'anonym' key from config/users.php
7. Replace all $confu['anonym'] with _ANONYM
8. Admin modules (modules/*/admin/index.php — 10 modules + account):
9. Remove anonym form field from modules/account/admin/index.php
10. Replace $confu['anonym'] with _ANONYM in 10 module admin files
11. Block (blocks/block-user_info.php):
12. Replace $confu['anonym'] with _ANONYM

Benefits: - Simplifies configuration (removes non-essential option) - Consistent anonymous name via i18n constant system - _ANONYM resides in language/*.php (globally loaded, not admin-only)

Technical notes: - _ANONYM is defined in language/.php, not admin/language/.php - core/security.php: collapsed $anon initialization into substr(_ANONYM, 0, 25)

Apply full PHP 8.4 modernization across all 26 front-end modules. Each module receives type-safe function signatures, setHead() for SEO metadata, prepared SQL with named placeholders, getVar() for all user input, and setFoot() replacing legacy foot() calls.

Core changes:

1. SEO and head output (all modules):
2. Replace head($conf['defis'].' '._MODULE) with setHead(['title' => _MODULE])
3. Replace foot() with setFoot()
4. SQL queries (all modules):
5. Convert string-concatenated queries to prepared statements
6. Add PREFIX_DB constant to all table references
7. Input handling (all modules):
8. Replace $_GET/$_POST direct access with getVar()
9. Add type hints to all function parameters and return types
10. Template variables (all modules):
11. Fix placeholder syntax: 'title' => ... to '{%title%}' => ...
12. Use setTemplateBasic() / setTemplateWarning() exclusively

13. Anonymous user display (faq, files, forum, help, jokes, links, media, news, pages, search, shop, whois, account):

14. Replace $confu['anonym'] with _ANONYM constant

Benefits: - Full PHP 8.4 compatibility across all public-facing modules - Eliminates SQL injection attack surface in 26 modules - Consistent anonymous user display via _ANONYM constant - Uniform SEO metadata via setHead()

Technical notes: - modules/forum/index.php: largest single-module change (~1469 lines) - modules/news/index.php: second largest (~566 lines) - All 26 front-end modules now fully modernized (100% complete)

Complete the head()/foot() → setHead()/setFoot() migration for the last nine front-end modules, and update both basic.html templates to render the article title as <h1> when in single-view mode and <h3> in list mode.

Core changes:

1. pages/index.php → setHead(seo); setFoot()
2. recommend/index.php → setHead(); setFoot()
3. rss/index.php → setHead(); setFoot()
4. search/index.php → setHead(); setFoot()

5. shop/index.php → setHead(seo); setFoot() - Pass title, desc, img, time, ctitle, author

6. sitemap/index.php → setHead(); setFoot()
7. users/index.php → setHead(); setFoot()
8. voting/index.php → setHead(seo); setFoot()
9. whois/index.php → setHead(); setFoot()
10. templates/default/basic.html and templates/lite/basic.html:

11. Wrap title in {%if is_view%}<h1>…</h1>{%else%}<h3>…</h3>{%endif%} * Single-article view uses semantically correct <h1> for SEO * List views retain <h3> for visual hierarchy

Benefits: - All front-end modules now use the unified SEO-aware setHead() API - Templates emit correct heading hierarchy — <h1> on detail pages improves Schema.org headline alignment and core-web-vitals LCP

Technical notes: - head()/foot() aliases can be removed in a future cleanup pass - {%if is_view%} is evaluated by the template engine; no PHP changes needed - Backward compatible: basic.html change is purely additive

Migrate nine front-end modules (forum, help, jokes, links, main, media, money, news, order) from head()/foot() to setHead()/setFoot(), pass SEO metadata via the new API, and fix remaining raw SQL interpolation with named placeholders.

Core changes:

1. forum/index.php:
2. head() → setHead(seo); foot() → setFoot()
3. Pass title, desc, img, time, ctitle, author to setHead()
4. help/index.php:
5. head() → setHead(seo); foot() → setFoot()
6. jokes/index.php:
7. head() → setHead(seo); foot() → setFoot()
8. links/index.php:
9. head() → setHead(seo); foot() → setFoot()
10. main/index.php:
11. head() → setHead(); foot() → setFoot()
12. Remove unused \$confn / \$confrs locals
13. media/index.php:
14. head() → setHead(seo); foot() → setFoot()
15. money/index.php:
16. head() → setHead(); foot() → setFoot()
17. news/index.php:
18. head() → setHead(seo); foot() → setFoot()
19. SQL: category WHERE clause uses named placeholders (:ncat1, :ncat_re, :ncat2)
20. catid IN() list uses intval() cast to prevent injection
21. \$admin_file → \$afile global alignment
22. order/index.php:
23. head() → setHead(seo); foot() → setFoot()

Benefits: - SEO data (title, author, img, time) flows cleanly through setHead() API - Eliminates remaining raw SQL string interpolation in news category queries - Consistent global naming (\$afile) across module layer

Technical notes: - news/index.php catid IN() uses intval() map — safe for any array content - Functional behavior preserved in all nine modules

Migrate eight front-end module index files from head()/foot() to setHead()/setFoot(), use \$conf['users'] instead of the \$confu alias, and fix raw SQL string interpolation to use prepared statements with named placeholders where applicable.

Core changes:

1. account/index.php:
2. head() → setHead(); foot() → setFoot()
3. \$confu['…'] → \$conf['users']['…'] throughout
4. SQL queries for user_name/user_email use named placeholders
5. Remove unused \$confn/\$confrs globals
6. auto_links/index.php:
7. head() → setHead(); foot() → setFoot()
8. Minor getVar() and SQL cleanup
9. changelog/index.php:
10. head() → setHead(); foot() → setFoot()
11. clients/index.php:
12. head() → setHead(); foot() → setFoot()
13. Prepared statements for client queries
14. contact/index.php:
15. head() → setHead(); foot() → setFoot()
16. content/index.php:
17. head() → setHead(); foot() → setFoot()
18. Pass SEO fields (title, desc, img, time, ctitle, author) to setHead()
19. faq/index.php:
20. head() → setHead(); foot() → setFoot()
21. files/index.php:
22. head() → setHead(); foot() → setFoot()

Benefits: - Modules now pass structured SEO data to setHead() instead of setting globals - Prepared statements eliminate raw string interpolation in SQL - Removed dependency on legacy \$confu alias

Technical notes: - \$conf['users'] array was always available; \$confu was an alias - setHead() / setFoot() are backward compatible with empty-array calls

Apply uniform refactoring to all 22 module admin index files: replace header()+exit; redirect pairs with setRedirect(), and replace list() destructuring with short array syntax [].

Core changes:

1. All modules/*/admin/index.php (22 files):

2. setRedirect() replaces header('Location: …')+exit; patterns * account, auto_links, changelog, clients, contact, content, faq,

files, forum, help, jokes, links, media, money, news, order,
pages, rss, shop, sitemap, voting, whois

• list() → [] for sql_fetchrow() and array destructuring
• Minor getVar() default corrections where applicable

Benefits: - All admin entry points now use centralized redirect helper - Consistent array destructuring syntax across entire admin layer

Technical notes: - Functional behavior unchanged - No DB schema or API contract changes

Complete the admin module migration: list()->[], setRedirect(), getVar() for all remaining admin panel modules. Includes security.php IP/ban management and statistic/uploads modules.

Core changes:

1. privat.php:
2. setRedirect() replaces header()+exit; pairs
3. ratings.php:
4. list() → [] for sql_fetchrow() destructuring
5. setRedirect() replaces header()+exit; pairs
6. referers.php:
7. list() → [] throughout
8. setRedirect() replaces header()+exit; pairs
9. replace.php:
10. setRedirect() replaces header()+exit; pairs
11. security.php (admin module):
12. list() → [] throughout
13. setRedirect() replaces header()+exit; pairs
14. statistic.php:
15. list() → [] throughout
16. setRedirect() replaces header()+exit; pairs
17. template.php:
18. list() → [] throughout
19. setRedirect() replaces header()+exit; pairs
20. uploads.php:
21. list() → [] throughout
22. setRedirect() replaces header()+exit; pairs

Benefits: - All 22 admin modules now use uniform redirect and array destructuring - No direct superglobal header() calls remain in admin module layer

Technical notes: - Purely syntactic/convention migration; zero logic changes - Backward compatible with existing sessions and DB state

Continue the list()->[], setRedirect(), and getVar() migration across seven more admin modules. All header()+exit; redirect pairs replaced with the centralized setRedirect() helper.

Core changes:

1. favorites.php:
2. setRedirect() replaces header()+exit; pairs
3. fields.php:
4. list() → [] for sql_fetchrow() destructuring
5. setRedirect() replaces header()+exit; pairs
6. groups.php:
7. list() → [] throughout
8. setRedirect() replaces header()+exit; pairs
9. lang.php:
10. list() → [] throughout
11. setRedirect() replaces header()+exit; pairs
12. messages.php:
13. list() → [] throughout
14. setRedirect() replaces header()+exit; pairs
15. modules.php:
16. setRedirect() replaces header()+exit; pairs
17. newsletter.php:
18. list() → [] throughout
19. setRedirect() replaces header()+exit; pairs

Benefits: - Consistent redirect handling across all admin modules - Eliminates legacy list() syntax — short array syntax throughout

Technical notes: - Logic and DB queries unchanged - Backward compatible