Журнал изменений
Introduce a complete set of shared, reusable admin fragments that replace the old module-specific ones, and rename preview pages to preview-content across all four themes to align with the new getTplPreviewContent() API.
Core changes:
- New admin fragments (templates/admin/fragments/):
- input.html — generic <input> with optional maxlength, placeholder, required
- label-hint.html — label with inline hint text
- edit-tip.html — action menu with view/edit/delete links (replaces inline action builders)
- table.html — full <table> wrapper with optional head array or raw head_html
- table-row.html — <tr> wrapper with optional class/attr
- table-row-content.html — content module table row cells (id, title, date, reads, status, actions)
- title-tip-item.html — single item inside a sl_tip nav tooltip
- view-field.html — labelled read-only field for preview pane
- add-field.html — dynamic form field (text, textarea, select) for module field definitions
- add-div.html, add-div-row.html, add-div-item.html, add-div-hidden.html — add-form layout
- add-datetime.html — date/datetime picker with hidden canonical value field
- refresh-select-time.html — interval select (15m…24h)
- save-action.html, save-action-item.html — save/delete/preview select + submit button
- navi-tabs-wrap.html, config-div-hidden.html — supporting layout helpers
- Updated fragments:
- config-div.html — hidden inputs now rendered via {% for item in hidden %} loop
- title-tip.html — supports content_html, content, items array, and label_text modes
- Deleted legacy fragments:
- admin-input.html, admin-hint-label.html — replaced by input.html, label-hint.html
- admin-table.html, admin-table-row.html — replaced by table.html, table-row.html
- admin-content-add-rows.html, admin-content-list-row.html — replaced by generic equivalents
- Preview pages/partials renamed across all themes (admin, default, lite, simple):
- preview.html → preview-content.html (page + partial)
- CSS additions (system.css for admin/default/lite, theme.css for simple):
- Add .sl-preview-, .sl-add-, .sl-save-action styling for new fragment layouts
Benefits:
- Eliminates module-specific fragment duplication across admin and content modules
- Uniform fragment API (array-based data) matches PHP helper function signatures
- preview-content name now matches getTplPreviewContent() and getHtmlPart() call sites
Technical notes:
- Deleted fragments had no remaining callers after prior refactor commits
- config-div.html hidden loop requires array of ['nameattr', 'valueattr'] maps
- title-tip.html is backward-compatible: all four variable modes are supported
Rename legacy admin helper functions to follow the getTpl* naming convention across core/admin.php, completing the function-rename pass started in previous refactor commits. Remove ~210 frontend fragment files that were erroneously tracked under templates/admin/fragments/.
Core changes:
- Function renames (core/admin.php):
- adminFlagBox() → getTplAdminFlagBox()
- adminDeleteAction() → getTplDeleteAction()
- adminLinkAction() → getTplLinkAction()
- adminAjaxAction() → getTplAdminAjaxAction()
- adminTitleTip() → getTplAdminTitleTip()
- adminTitleTipLabel() → getTplAdminTipLabel()
- adminNoteLabel() → getTplAdminNoteLabel()
- adminMoveControls() → getTplAdminMoveControls()
- adminMenuItems() → getTplAdminActionMenu()
- adminCategoryRow/Table → getTplAdminCategoryRow/Table()
- adminBlockRow/Table → getTplAdminBlockRow/Table()
- adminFilesRow/Table → getTplAdminFilesRow/Table()
- adminFilePreview() → getTplAdminFilePreview()
- adminDangerText() → getTplAdminDangerText()
- Module fix (admin/modules/newsletter.php):
- Added missing $token to global declaration
- Fragment cleanup (templates/admin/fragments/):
Removed ~210 frontend fragments (account/, forum/, shop/, voting/, editor/, media/, whois/*, etc.) that do not belong in admin/fragments/
- Modified link-btn.html (minor tweak)
Benefits:
- All admin rendering helpers now share the getTpl* prefix — consistent API
- Removes dead template files that were never loaded by the admin layer
- Reduces template directory noise by ~210 files
Technical notes:
- All call sites in core/admin.php updated atomically — no external callers
Deleted fragments were not referenced by admin code; frontend uses its own template directories
Replace string-concatenation pattern ($rows .= getTplAdminFormRow(...)) with array descriptors ($rows[] = ['label_html' => ..., 'field_html' => ...]) across all 18 admin modules; getTplAdminRowsTable() now renders arrays internally, eliminating per-module fragment rendering calls.
Core changes:
- Row rendering (core/helpers.php):
getTplAdminRowsTable() extended to accept array|string
- array items dispatched to admin-form-row / admin-form-wide / raw_html
- string path preserved for backward compat
- Admin modules (admin/modules/*.php):
- All 18 modules converted: $rows string → $rows[] array descriptors
- adminInfoRow() call sites renamed to getTplAdminInfoRow() (core/admin.php)
- Fragments (templates/admin/fragments/):
- Added: config-div, config-div-row, config-div-item, config-div-content
- Added: admin-menu-item, admin-lang-switch-item, bootstrap-icon
Removed: 24 obsolete per-module inline fragments (security, database, messages, newsletter, referers, scheduler, lang, uploads, form-conf, etc.)
- CSS (templates/admin/assets/css/system.css):
- +96 lines of admin UI styles supporting new fragment layout
Benefits:
- Removes ~330 lines of net HTML/PHP, centralises row rendering in one helper
- Obsolete one-off fragments eliminated, reducing template surface area
- Consistent data-driven API for admin form construction across all modules
Technical notes:
- getTplAdminRowsTable() remains backward compatible with string input
- Deleted fragments were not referenced anywhere outside their own modules
- No changes to public-facing templates or user-facing logic
Remove manual CSRF token passing from all admin module actions and forms now that checkSiteToken() auto-reads the token from the request context. Update getHtmlFrag() calls to use renamed fragments and canonical variable keys.
Core changes:
- CSRF token removal from forms and action guards (admin/modules/*.php):
- Removed getSiteToken() calls and hidden token inputs from all module forms
Removed explicit checkSiteToken(getVar(...)) guards from save/delete handlers
- Token validation still occurs inside checkSiteToken() via getRequestToken()
Affected modules: admins, categories, comments, database, favorites, fields, groups, lang, messages, modules, newsletter, privat, referers, replace, scheduler, statistic, template, uploads
- Fragment name updates (admin/modules/*.php, core/admin.php):
- admin-action-link → comment-action-link
- admin-action-ajax → comment-action-ajax (via getTplAdminAjaxAction)
- Added required class/target keys for comment-action-link calls
- Core admin updates (core/admin.php):
- getAdminBlockList(): add optional $token string param (unused, reserved)
- getAdminInfo(): remove manual token check; remove token hidden input from form
- System bootstrap (core/system.php):
- Minor alignment/cleanup with no behavioral change
Benefits:
- Eliminates 30+ boilerplate token-extract-and-check blocks across modules
- CSRF protection remains active via centralized getRequestToken()
- Consistent fragment naming across all call sites
Technical notes:
- Implicit CSRF validation: token must arrive via header or POST/GET param
- No change to token generation or scope logic
- admin/index.php: CRLF→LF line ending normalization only
Rename all template variable keys in helper functions to canonical single-word names and eliminate redundant fragment files by merging them into existing general-purpose fragments with conditional params.
Core changes:
- Helper variable key renames (core/helpers.php):
- getTplAdminFlagBox: css_class→class, label_text→label
- getTplAdminNoteLabel: switches to span-btn fragment; label_text→label, title_attr→title
- getTplAdminTitleTip: switches to title-tip fragment (was admin-title-tip)
- getTplAdminAjaxAction: switches to comment-action-ajax fragment (was admin-action-ajax)
- getTplAdminTabOpen: list_class→class, list_id→id
- getTplAdminTabLink: is_selected→selected, attrs removed (unused)
- getTplAdminInfoCount: count_text→count, css_class→class
- getTplAdminTableHead: th-nosort merged into th with nosort=true param
- Fragment deletions (all four themes: admin, default, lite, simple):
- Deleted: admin-action-ajax.html (replaced by comment-action-ajax)
- Deleted: admin-action-link.html (replaced by comment-action-link)
- Deleted: admin-note-label.html (replaced by span-btn)
- Deleted: admin-title-tip.html (replaced by title-tip)
- Deleted: th-nosort.html (merged into th with nosort flag)
- Updated: th.html to handle nosort conditional rendering
- Updated: admin-security-*.html to match new variable key names
Benefits:
- Fewer fragment files to maintain across themes
- Consistent single-word key naming convention throughout helpers
- th fragment handles both sort and no-sort columns via one template
Technical notes:
- Fragment renames are breaking changes for any direct getHtmlFrag() callers
- All call sites in admin modules updated in the following commit
- No functional HTML output changes
Extend the CSRF layer with a dedicated token-reader and a smarter checkSiteToken() that auto-resolves the token from the request context, eliminating the need for callers to pass the token explicitly.
Core changes:
- CSRF token reader (core/security.php):
Add getRequestToken(): reads token from X-CSRF-Token header, X-XSRF-Token header, POST param, GET param, $_REQUEST fallback
- Priority: header > POST > GET > $_REQUEST
- Trims whitespace, returns empty string when absent
- CSRF validator (core/security.php):
Change checkSiteToken() signature: $tok defaults to '' (auto-read)
- If $tok is empty, calls getRequestToken() automatically
- Adds cross-scope fallback: non-ajax scopes also accept global 'ajax' token
Benefits:
- Callers no longer need to extract and pass the token manually
- HTMX / fetch requests sending X-CSRF-Token header work out of the box
- One central place for all token extraction logic
Technical notes:
- Backward compatible: callers that still pass $tok explicitly continue to work
- Scope fallback is one-way: ajax-scoped checks do not accept scope-specific tokens
The shared/ fallback mechanism was reverted in the previous session. Physical files were already deleted; this commit syncs git tracking to match the filesystem state.
Remove 52 dead/duplicate fragments from all 3 frontend themes (default, lite, simple) and replace direct getHtmlFrag() calls with canonical helpers where they already exist.
Core changes:
- Dead fragments removed (templates/default|lite|simple/fragments/):
49 fragments with 0 frontend callers (admin-*, block wrappers, comment-action-delete, editor-files-, navi-tabs-, pager-, rating-, voting-close/open/stat-text, td-check, form-checkall, spoiler, etc.)
- 2 lite-specific dead fragments: lite-faq-random-link, lite-head-banner
- 1 duplicate resolved: admin-title-tip (canonical: title-tip)
- Duplicate fragments resolved:
recommend-mail-link → files-external-link (identical content) modules/recommend/index.php updated
contact-admin-option → getTplSelectOption() migration modules/contact/index.php updated
- Direct getHtmlFrag('form-option') → getTplSelectOption() (10 calls):
- modules/forum/index.php (2 calls, $sel variable removed)
- modules/pages, files, media, faq, links, news, jokes, help/index.php
Benefits:
- Fragment count: 388 → 336 per theme (-52 default/simple, -54 lite)
- All direct form-option calls now route through canonical helper
- Frontend and admin themes now have consistent, non-overlapping fragment sets
Technical notes:
- block-* fragments in blocks/ system kept intact (indirect callers)
- files-external-link kept as canonical for generic target=_blank links
- form-option fragment kept (still used by getTplSelectOption())
Eliminate duplicate, dead and module-specific admin fragments by migrating all list-head patterns to getTplAdminTableHead() and fixing shared helper canonical fragment references.
Core changes:
- Admin helpers (core/helpers.php):
- getTplAdminTableHead(): use th/th-nosort fragments, not inline HTML
- getTplAdminTableCells(): use td fragment, not inline HTML
- getTplAdminSection(): use admin-section-heading fragment
- getTplAdminTabClose(): use admin-tab-list-close fragment
- getTplAjaxAction(): fix canonical back to comment-action-ajax
- getTplDeleteAction(): fix canonical to action-delete
- Admin modules (21 files):
- Replace getHtmlFrag('admin-*-list-head') with getTplAdminTableHead([])
- admin/modules/: groups, messages, modules, newsletter, referers, security
modules/*/admin/index.php: account, auto_links, clients, content, faq, files, help, jokes, links, media, money, news, order, pages, search, voting
- Admin fragments (templates/admin/fragments/):
- Delete 83 dead fragments (list-head, account-*, orphans)
Restore incorrectly removed: td, th, th-nosort, admin-section-heading, admin-tab-list-close, admin-admins-permission-empty, comment-action-ajax
Benefits:
- Admin fragment count: 569 → 486 (-83)
- Single canonical path for all table headers via getTplAdminTableHead()
- Shared helpers use correct fragment names for all theme contexts
Technical notes:
- comment-action-ajax stays canonical for getTplAjaxAction() (shared, used in frontend)
- action-delete is canonical for getTplDeleteAction() (all themes)
- admin-whois-list-head.html kept (colspan=2, needs getTplAdminTableHead() extension)
Reverts Phase 2: themes (lite, default, simple, admin) are self-contained and must not depend on a shared/ fallback directory.
Core changes:
- templates/shared/: deleted
- templates/lite/, default/, simple/: all 388 files restored
- templates/admin/fragments/: 113 files restored
core/classes/template.php: removed $shared property, shared fallback in getFile(), and shared path check in checkFile()
Benefits:
- Each theme is fully portable and independent
- No hidden cross-theme dependencies