Eliminate all func_get_args() usage and replace every raw $_GET/$_POST/$_REQUEST access with getVar(); add filterMarkdown() Markdown parser and bb_decode() as a unified text-processing orchestrator; harden SQL with prepared statements.

Core changes:

1. func_get_args() removal (core/system.php):

2. getcat(), catlink(), catids(), catmids() — explicit typed parameters

   • catlink($id, $mod, $cat) replaces variadic signature
3. getVoting(), num_ajax(), ad_save(), rss_select(), addBackupDb()
4. setPageNumbers(), preview(), get_user_search(), url_types()
5. addmail(), textarea(), cat_modul(), ashowcom(), numcom(), update_points()
6. Superglobals → getVar() (core/system.php):
7. goto_url(): $_REQUEST → isset($_GET[..]) || isset($_POST[..]) (presence-only)
8. getThemeFile(): $_GET['cat'] → getVar('get', 'cat', 'num', 0)
9. save_datetime(): dynamic key → getVar('post'/$name, 'raw', '')
10. add_kasse() / del_kasse(): $_GET['id'] → getVar('get', 'id', 'num', 0)
11. show_files(): 4 superglobals → getVar() with appropriate types
12. fields_in(): $_POST['field'] → getVar('post', 'field', 'raw', '')
13. get_user(): $_GET['term'] → getVar('get', 'term', 'text', '')
14. ajax_rating(): 5 superglobals (id, typ, mod, rate, stl) → getVar()
15. upload(): $_POST['token'], $_POST['sitefile'] → getVar(); $_FILES unchanged

16. editcom() / closecom() / avoting_save(): redundant isset() → getVar()

    • avoting_save(): $_POST['questions'] (array) handled with isset+is_array guard
17. SQL prepared statements (core/system.php):

18. setCategories(): $mod/$locale/$id → named placeholders :mod/:loc/:pid

    • catid IN clause now uses dynamic :c0/:c1/... placeholders
19. New functions added (core/system.php):

20. filterMarkdown(string $src, bool $safe, string $mod): string

    • Safe Markdown→HTML parser; $safe=true blocks dangerous constructs
21. bb_decode(): updated to delegate inline processing to filterMarkdown()

22. setRedirect(string $url, bool $refer, int $code): never

    • Auto-upgrades 302→303 on POST; replaces inline header()+exit patterns
23. Theme boot sequence moved to system.php:
24. getTheme() + template require_once added to core boot (removed from callers)
25. Deprecated functions removed:
26. checkConfigFingerprint() — unused after fingerprint refactor
27. isCompare(), isDate() — unused legacy helpers

Benefits:

• All superglobal access in core/system.php eliminated (getVar guardrail)
• func_get_args() fully removed — PHP 8.4 typed parameters throughout
• SQL injection prevented in setCategories() and catid IN clause
• filterMarkdown() and bb_decode() provide unified safe text pipeline

Technical notes:

• $_FILES not replaced — getVar() has no file-upload equivalent
• $_POST['questions'] (array) remains direct access with is_array() guard
• setRedirect() auto-detects POST → sends 303 instead of 302
• filterMarkdown($src, $safe, $mod): $mod reserved for future bb/md/mixed modes

Two new design documents capturing the planned Markdown parser and the architectural decisions for integrating it with bb_decode().

Core changes:

1. Design spec (docs/PARSE.md):
2. Full self-contained implementation of filterMarkdown(string $src, bool $safe)
3. Anonymous class with 15 private methods (filterBlocks, filterInlines, etc.)

4. Covers: ATX/Setext headings, blockquotes, lists, GFM tables, fenced/indented code, inline code, bold/italic/strike/highlight, links, images, auto-links

5. Safe mode: filterText() + filterUrl() for XSS prevention
6. Stash-salt mechanism for token collision prevention
7. All method and variable names comply with SLAED §5 naming conventions
8. Architecture discussion (docs/DISCUS.md):
9. Records session decisions on unified bb_decode/filterMarkdown pipeline
10. Three-stage pipeline: server-side BB tags → filterMarkdown() → stash restore
11. Three modes: bb (legacy), md (markdown), mixed (both)
12. Five pre-implementation decisions documented and agreed

Benefits:

• Preserved design rationale for future contributors
• Clear migration path from legacy bb_decode() to unified parser
• All XSS concerns, mode semantics, and stash protocols specified

Technical notes:

• filterMarkdown() is a pure function: no DB, no config, no side-effects
• bb_decode() remains the orchestrator; [attach]/[usephp] stay outside parser

Replace raw superglobal access with getVar(), add full SEO metadata to view() via setHead(), and fix a raw SQL concatenation in status query. No behavioral changes to listing or form logic.

Core changes:

1. Input handling (modules/forum/index.php):
2. $_GET['num'] -> getVar('req', 'num', 'num') in forum() and view()
3. $_GET['id'] -> getVar('req', 'id', 'num') in view()
4. $_GET['word'] -> text_filter(getVar('req', 'word', 'text')) in view()
5. $b initialized as int 0 instead of string ''
6. SEO metadata — view() (modules/forum/index.php):

7. setHead() now receives full structured data:

   • title: topic title, ctitle: category title
   • desc: bb_decode + strip_tags + cutstr(160)
   • img: first image from hometext via getImgText()
   • time: topic timestamp, author: user_name or sitename fallback
8. SQL security (modules/forum/index.php):

9. Status query in view() replaced raw $id concat with named param :id

   • 'WHERE id = :id' with ['id' => $id]

Benefits:

• XSS-safe input handling via getVar() type enforcement
• Unique per-topic <title> and og:* meta for SEO
• SQL injection eliminated in status fetch query

Technical notes:

• Backward compatibility: full — no template or DB schema changes

Rename all non-compliant local variables to lowercase-no-underscore format per refactoring-standards.md §5, and expand $lctx closure to add cookie/session key truncation with explicit truncation flags.

Core changes:

1. $lctx closure (core/security.php):

2. Expanded with per-key truncation: $ck, $cktr, $sk, $sktr, $ctx

   • Limits cookie/session key arrays to 50 entries
   • Adds cookie_keys_truncated / session_keys_truncated flags when cut
3. Renamed: query/post use $q/$p; empty arrays become stdClass for JSON
4. HTTP error handler (core/security.php):
5. $http_msg -> $httpmsg
6. error_reporting_log() parameters and locals (core/security.php):
7. $error_num -> $errno, $error_var -> $errmsg
8. $error_file -> $errfile, $error_line -> $errline
9. $level_map -> $levelmap, $php_err -> $phperr
10. error_sql_log() locals (core/security.php):
11. $sql_orig -> $sqlorig, $sql_bytes -> $sqlbytes
12. $sql_hash -> $sqlhash, $sql_safe -> $sqlsafe

Benefits:

• Consistent naming across entire security layer
• No behavior change — pure rename refactor

Technical notes:

• All renamed variables are local scope only; no public API change
• Backward compatibility: full

Synchronize all project docs with the current state of SLAED CMS 6.3. Five files updated: README, UPGRADING, CONTRIBUTING, SECURITY, TEMPLATES.

Core changes:

1. README.md:
2. Update migration badge from 70% to 75%
3. Remove "Frontend modules ~35% remaining" (all 26 modules complete)
4. UPGRADING.md:

5. Add Breaking Changes: config/rewrite.php removed, $confu['anonym'] removed, setConfigFile() reserved guard, getConfig() skip list

6. Update Version History status to ~75%, add three new Major Changes items
7. CONTRIBUTING.md:

8. Expand language constants [!IMPORTANT] block with placement rule (language/.php for public, admin/language/.php for admin-only)

9. Add "Config Files -> Reserved Config Files" section with table
10. SECURITY.md:
11. Add NDJSON format note to Logging & Error Handling section
12. Add "Config Write Protection" block (setConfigFile guard + getConfig skip)
13. docs/TEMPLATES.md:

14. Add "SEO Placeholder Variables" section documenting all 14 setHead() placeholders ([homeurl], [site], [logo], [loc], [time], [mtime], [title], [desc], [img], [ctitle], [type], [url], [headline], [author])

Benefits:

• Documentation accurately reflects the current codebase
• Contributors have clear guidance on language constant placement
• Reserved config file rules are documented

Technical notes:

• docs/TESTS.md and CODE_OF_CONDUCT.md required no changes