Журнал изменений

Фильтр и поиск

Всего: 872 Доступных коммитов | Отфильтровано: 872 Коммиты | Страница: 66 / 88
20.02.2026
Fix: Add open_basedir-aware /proc access guard in monitor
Автор: Eduard Laas | Дата: 08:57 20.02.2026

Replaces silent error-suppressed @file_get_contents('/proc/...') calls with an explicit is_proc_readable() check that respects open_basedir restrictions. This eliminates suppressed errors and avoids undefined behavior when PHP runs with restricted filesystem access.

Core changes:

  1. Monitor module (admin/modules/monitor.php):
  2. Added is_proc_readable(string \$path): bool helper function

    • Validates path starts with /proc/
    • Checks against open_basedir entries if set
    • Returns is_readable() result only when access is permitted
  3. Replaced @file_get_contents('/proc/meminfo') with guarded call

    • Suppressor removed; function handles restriction transparently
  4. Replaced @file_get_contents('/proc/net/dev') with guarded call
  5. Replaced @file_get_contents('/proc/uptime') with guarded call
  6. Added missing ':' presence check before explode() in meminfo parser

    • Prevents "Undefined offset" warnings on empty/malformed lines

Benefits:

  • Eliminates error suppression antipattern for /proc reads
  • Correct behavior under open_basedir=restricted environments
  • Prevents PHP warnings from malformed /proc/meminfo lines

Technical notes:

  • open_basedir path separator is PATH_SEPARATOR (OS-aware)
  • Fallback: if open_basedir is empty, only is_readable() is checked
Fix: Add is_dir() guard in module file scanner
Автор: Eduard Laas | Дата: 08:56 20.02.2026

Prevents false positives when scandir() returns non-directory entries (e.g. files or symlinks) inside the modules/ directory. Without the is_dir() check, is_file() on a path like modules/file.txt/index.php could cause unexpected behavior or warnings.

Core changes:

  1. Module scanner (admin/modules/lang.php):
  2. Added is_dir() check before is_file() in the modules loop

    • Ensures only real subdirectories are treated as modules
    • Eliminates potential warnings from invalid path constructions
19.02.2026
Chore: Update docs, tooling, and tests for config restructure
Автор: Eduard Laas | Дата: 23:35 19.02.2026

Align documentation, static analysis config, and tests with the renamed config files and the \$afile variable that replaced \$aroute.

Core changes:

  1. CONTRIBUTING.md / UPGRADING.md:
  2. Replace all \$aroute references with \$afile (current variable name)
  3. .gitignore:
  4. Remove /config/lang.php exclusion (lang config is now tracked)
  5. phpstan.neon:
  6. Remove outdated ignore rule for config/config_uploads.php path
  7. templates/index.html:
  8. Update meta-refresh URL: http://www.slaed.net -> https://slaed.net
  9. tests/ConfigValidationTest.php:
  10. Rename camelCase properties/methods to snake_case (\$basePath -> \$base_path)
  11. Update scanConfigFiles -> scanconfig_files; testRequiredConfigFilesExist -> testRequiredconfig_filesExist (PSR-consistent project style)

  12. config/security.php / config/users.php:
  13. Cosmetic alignment of => operators for readability

Benefits:

  • Docs reflect the actual current variable name (\$afile)
  • PHPStan no longer reports false positives for removed paths
  • Tests use consistent naming convention with the rest of the project

Technical notes:

  • No functional changes; docs, config cosmetics, and test naming only
Refactor: Extend config aliases and improve error logging in core
Автор: Eduard Laas | Дата: 23:35 19.02.2026

Add missing global config aliases to security.php bootstrap and overhaul the PHP error log rotation to use addCompress() with the new bak fallback. Update doSitemap() to read config via return value and fix all remaining config_rewrite.php path references.

Core changes:

  1. core/security.php:
  2. Add \$confup (uploads), \$conftp (filetype), \$confla (lang) aliases so modules can rely on these without separate includes

  3. Update comment: 'set once here; include becomes a no-op' -> clearer
  4. error_reporting_log(): switch from global \$confs to \$conf['security']
  5. Log path: config/logs/error.txt -> LOGS_DIR/error_php.log
  6. Use addCompress(... true, true) for log rotation with .bak fallback
  7. Add clearstatcache() before filesize(); re-open handle after rotation
  8. core/system.php:
  9. addCompress(): add bool \$bak = false parameter; when compression unavailable and \$bak is true, rename source to .bak instead of error

  10. doSitemap(): capture return value of include('config/sitemap.php') and extract \$confma from it instead of relying on global pollution

  11. Fix empty mod check: use ($modules_raw === '') guard
  12. Replace 3x include('config/config_rewrite.php') with 'config/rewrite.php'
  13. addErrorFile(): use addCompress(... true, true) — drop inline fallback

Benefits:

  • Eliminates global variable leakage from include() in doSitemap
  • Log rotation is now atomic and compression-aware
  • Modules for uploads/filetype/lang no longer need separate includes

Technical notes:

  • addCompress() signature: (dir, src, name, mode, del, bak) — backward compat
  • .bak fallback only triggers when algo === 'none' (no compressor available)
Refactor: Remove end_chmod() and replace with checkPerms() in admin
Автор: Eduard Laas | Дата: 23:34 19.02.2026

The legacy end_chmod() helper performed chmod tests by writing a test file to config/chmod.php, which relied on a dedicated config entry and Linux-specific uname/chmod logic. It has been replaced by the modern checkPerms() function that handles permission checks uniformly.

Core changes:

  1. core/admin.php:
  2. Delete end_chmod() function (~20 lines) marked # DELETE OLD
  3. Update fav_aliste(): replace include('config/config_media.php') with $confm = $conf['media'] ?? [] (uses global $conf)

  4. admin/modules/blocks.php:
  5. Replace 3 end_chmod() calls with checkPerms() equivalents: fileadd(): end_chmod('blocks/', 777) -> checkPerms('blocks/', 1) filecode(): same for directory and per-file permission check

Benefits:

  • Removes OS-specific chmod probe that relied on config/chmod.php
  • checkPerms() provides consistent, testable permission reporting
  • Reduces dead code surface in core/admin.php

Technical notes:

  • config/chmod.php remains as an empty return [] placeholder
  • No user-facing behaviour change; only internal permission checking
Refactor: Remove direct config includes from modules and core
Автор: Eduard Laas | Дата: 23:34 19.02.2026

Replace all per-module include('config/config_*.php') and include('config/*.php') calls with global config aliases that are already populated by the unified bootstrap in core/security.php. Also update save_conf() calls to setConfigFile() with the new paths.

Core changes:

  1. All modules/*/admin/index.php (17 files):
  2. Remove top-level include('config/config_X.php')
  3. Replace end_chmod/save_conf with checkPerms/setConfigFile
  4. Update config file path arguments (config_X.php -> X.php)
  5. All modules/*/index.php (17 files) + blocks/block-auto_links.php:
  6. Remove include('config/config_X.php') — alias already set globally
  7. core/user.php:
  8. Remove include('config/config_shop.php') in navi()
  9. Remove include('config/config_forum.php') in editpost()
  10. Use $conf['shop'] and $conf['forum'] via global $conf
  11. Fix uninitialised $fstatus variable; fix $_GET isset check
  12. index.php:
  13. Update require_once paths: config_shop.php -> shop.php, config_uploads.php -> uploads.php

  14. admin/modules/privat.php:
  15. Update checkPerms() and setConfigFile() path: privat.php

Benefits:

  • Eliminates ~40 redundant file-system reads per request
  • Single source of truth: config loaded once in bootstrap
  • Consistent use of setConfigFile() for config persistence

Technical notes:

  • All config aliases ($confn, $conffo, etc.) remain set in core/security.php
  • No functional behaviour change; pure include removal
Refactor: Rename config_*.php to *.php in config/ directory
Автор: Eduard Laas | Дата: 23:33 19.02.2026

Drop the redundant config_ prefix from all module config files, aligning naming with the unified config bootstrap introduced in core/system.php. The new names match the module names directly.

Core changes:

  1. Deleted (23 files) (config/config_*.php):
  2. config_auto_links, config_comments, config_contact, config_content, config_faq, config_files, config_forum, config_global, config_help, config_jokes, config_links, config_media, config_money, config_news, config_order, config_pages, config_privat, config_rewrite, config_shop, config_templ, config_users, config_voting, config_whois

  3. Added (20 files) (config/*.php):
  4. auto_links, contact, content, faq, files, forum, help, jokes, lang, links, media, money, news, order, pages, privat, rewrite, shop, voting, whois

Benefits:

  • Simpler, predictable naming: config/{module}.php
  • Eliminates the inconsistent config_ prefix across all modules
  • lang.php added as a new first-class config file

Technical notes:

  • Git detected renames automatically (rename detection enabled)
  • config_global, config_templ, config_users, config_comments removed (merged into global config or no longer needed as separate files)

Style: Increase admin panel font sizes for readability
Автор: Eduard Laas | Дата: 18:09 19.02.2026

Bump base font sizes in the admin area to improve legibility on higher-DPI displays and modern browsers.

Core changes:

  1. CodeMirror editor (templates/admin/system.css):
  2. .CodeMirror font: 11px → 12px Verdana
  3. .CodeMirror-hints font: 11px → 12px Verdana
  4. Admin base layout (templates/admin/theme.css):
  5. body, form elements font: 12px/16px → 13px/16px Tahoma/Arial/Verdana

Benefits:

  • Better readability on HD/Retina screens
  • Consistent sizing between editor widget and surrounding UI

Technical notes:

  • Line-height left at 16px; no layout reflow expected
  • No change to colours, spacing, or other visual properties
Docs: Update code examples to use PREFIX_DB constant
Автор: Eduard Laas | Дата: 18:08 19.02.2026

Replace the deprecated \$prefix variable in all SQL snippets shown in project documentation with the PREFIX_DB constant, keeping examples consistent with the actual codebase after the refactor.

Core changes:

  1. README.md:
  2. SQL example: '.\$prefix.'_users → '.PREFIX_DB.'_users
  3. CONTRIBUTING.md (2 occurrences):
  4. SQL examples in "Correct - Safe" and function sample updated
  5. SECURITY.md:
  6. Prepared-statement example updated
  7. UPGRADING.md:
  8. Migration guide example for 6.3.x updated

Benefits:

  • Documentation reflects current coding standard
  • New contributors see the correct pattern from the start

Technical notes:

  • No functional code changed; documentation only
Fix: Strengthen .htaccess security rules
Автор: Eduard Laas | Дата: 18:08 19.02.2026

Harden the Apache rewrite rules to close several attack vectors and improve reliability across all hosting configurations.

Core changes:

  1. Block PHP execution in uploads (new rule):
  2. RewriteRule ^uploads/.*\.php$ — [F,L,NC]
  3. Prevents uploaded-file code-execution attacks
  4. Exploit-string filter (existing block):
  5. Add [NC] flag to base64_encode and GLOBALS conditions
  6. Change final RewriteRule target from index.php to — [F,L] (returns 403 instead of silently routing malicious queries)

  7. HTTP_AUTHORIZATION passthrough:
  8. Move the Authorization header rule BEFORE the front-controller rule
  9. Ensures REST/API clients receive the header when using BasicAuth
  10. Remove trailing [L] flag from original position (was unreachable)

Benefits:

  • Uploaded PHP files can no longer be executed via the web
  • Malformed query strings return 403 instead of being forwarded
  • HTTP Basic Auth works correctly in CGI/FastCGI environments

Technical notes:

  • No change to normal request routing
  • Backward-compatible with all existing URL rewrite patterns

Всего: 872 на 88 страницах по 10 на каждой странице

1 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 88

Хотите опробовать SLAED CMS в действии?

Идеи и предложения
Обратная связь