Журнал изменений

Expands the security statistics panel to cover all files in storage/logs/, replacing the .log-only filter with a label-based allowlist approach. Removes hardcoded .log extension throughout; .json files (dump_map, monitor) are now handled via an $ext exception map.

Core changes:

1. Security module (admin/modules/security.php):

2. $labels array extended: database, dump, dump_log, dump_map, error_file, error_php, error_site, error_sql, hack, log, log_admin, log_user, monitor, warn

3. $ext map: ['dump_map' => 'json', 'monitor' => 'json']
4. security(): replaced preg_match('.log') with skip-list + isset($labels)
5. fileview(), down(), del(): use $ext[$file] ?? 'log' for path and filename
6. confsave(): persists sess_d, sess_b, log_b, log_d; dump_skip field added
7. Info pages (admin/info/security/*.html — all 6):
8. Reference to hardcoded interval setting replaced with Scheduler module link
9. Config (config/security.php):
10. dump_skip default removed (now managed via Scheduler/confsave)
11. log_d default adjusted

Benefits:

• .json log files (dump_map, monitor) now visible and downloadable in UI
• No unknown files shown: only keys present in $labels are rendered
• .htaccess and index.html automatically skipped

Technical notes:

• filterVar strips dots, so file extensions cannot be passed via URL
• Extension is derived server-side from $ext map with 'log' fallback

Integrate the preserved local work back into master after fast-forwarding the branch to the latest origin/master state. This keeps the remote updates and the local language, configuration, setup, and test changes together without any history rewrite.

Core changes:

1. Remote synchronization (master):
2. Fast-forward local master to origin/master
3. Keep upstream changes from the latest GitHub state
4. Local work integration (config, language, setup, tests):
5. Merge the backup branch with the preserved local changes
6. Resolve the config/global.php conflict in favor of the saved local sitekey

Benefits:

• Leaves master up to date with GitHub and your local work intact
• Provides a recoverable backup branch and commit history
• Avoids destructive Git operations and force-based workflows

Technical notes:

• Merge commit created after fast-forward sync
• No rebase and no history rewrite
• Working tree should be clean after commit

Three bug fixes identified via error log analysis (2517 entries, period 2026-03-13 to 2026-03-15). Closes the dominant error (2504 occurrences) and hardens input validation against encoded path traversal probes.

Core changes:

1. Search module (modules/search/index.php):

2. Guard $conf['search'] with is_array() before accessing ['mods']

   • $conf['search'] is a string when config is scalar, causing TypeError
   • Affected every bot crawling ?name=search (Bing, Google, Baidu, etc.)
3. Monitor (admin/modules/monitor.php):

4. Check open_basedir before calling is_dir() on extension_dir

   • Used array_reduce over PATH_SEPARATOR-split paths
   • Avoids E_WARNING when ext dir is outside allowed open_basedir paths
5. Security (core/security.php):

6. Extend $quote pattern in checkGet: '../' → '..[/\%]'

   • Now catches ../ (direct), ..\ (Windows), ..% (URL-encoded: ..%2F etc.)
   • Blocks double-encoded path traversal (e.g. %252F) after PHP auto-decode

Benefits:

• Eliminates 2504 TypeError entries from error_php.log
• Removes 9 recurring open_basedir warnings in monitor
• Path traversal attempts now logged to hack.log via addHackReport()

Technical notes:

• No config or schema changes
• Backward compatible

Comprehensive fix and cleanup across the codebase following DB schema update that renamed the lastip column to ip in _users table, plus runtime bug fixes found during load testing.

Core changes:

1. Column rename lastip → ip (core/system.php, modules/account/index.php, modules/account/admin/index.php, admin/index.php, modules/users/index.php, modules/money/index.php, modules/search/index.php, modules/links/index.php):

   • All SQL queries updated: SELECT ip, UPDATE SET ip, WHERE ip LIKE
   • Template references updated: $userinfo['ip'], edithome display

2. Bug fix: savehome() cookie rebuild (modules/account/index.php):

   • Replace getUserInfo() (could return null → TypeError on array access)

 with direct variables from earlier SELECT already in scope

• Eliminates "Trying to access array offset on null" at setCookies call

1. Bug fix: PM TypeError (core/user.php addPmMsg, setPmSaved, deletePmMsg):

   • $stop[] array passed as string $stop to getPmView() → TypeError
   • Fix: implode('<br>', (array)$stop) before call
   • Initialize $stop/$info as '' in setPmSaved to avoid undefined vars
   • Replace literal 0 with '' for typed string params

2. Bug fix: SQL HY093 in help module (modules/help/index.php):

   • Duplicate named param :postid used twice in INSERT (uid and aid cols)
   • PDO with ATTR_EMULATE_PREPARES=false rejects duplicate named params
   • Fix: rename to :uid/:aid with separate keys in params array

3. Monitor: direct APCu calls (admin/modules/monitor.php):

   • Replace call_user_func('apcu_fetch/store', ...) with direct calls
   • Cleaner, faster, phpstan-friendly

4. Newsletter: column rename mail → email (admin/modules/newsletter.php):

   • SELECT email FROM _money (was: mail)

5. system.php show_files() guards:

   • Initialize $files, $contents, $a before conditional block
   • Division by zero protection: ($a > 0) ? ceil($a/$connum) : 0
   • isset() → !empty() for $contents[$i] check

6. SQL schema cleanup (setup/sql/):

   • table.sql: lastip → ip column definition
   • table_update6_3.sql: migration updated
   • Remove batch_migrate.sql and table_update6_3_finalize_local.sql

Benefits:

• Eliminates all load-test-discovered TypeErrors and SQL errors
• Schema consistency: ip column name uniform across code and DB
• No more null-guard needed on getUserInfo() return path