Журнал изменений
Move admin panel help HTML files from flat naming convention (module-lang.html) to per-module subdirectory layout (module/lang.html), improving organization and making locale additions straightforward.
Core changes:
- Admin info pages (admin/info/):
Renamed all flat module-lang.html files to module/lang.html layout
- Pattern: admins-ru.html → admins/ru.html
- 22 modules × 6 locales (de, en, fr, pl, ru, uk) reorganized
Benefits:
- Cleaner directory structure per module
- Easier to add new locales without polluting the flat namespace
- Consistent with standard i18n subdirectory conventions
Synchronize all project docs with the current state of SLAED CMS 6.3. Five files updated: README, UPGRADING, CONTRIBUTING, SECURITY, TEMPLATES.
Core changes:
- README.md:
- Update migration badge from 70% to 75%
- Remove "Frontend modules ~35% remaining" (all 26 modules complete)
- UPGRADING.md:
Add Breaking Changes: config/rewrite.php removed, $confu['anonym'] removed, setConfigFile() reserved guard, getConfig() skip list
- Update Version History status to ~75%, add three new Major Changes items
- CONTRIBUTING.md:
Expand language constants [!IMPORTANT] block with placement rule (language/.php for public, admin/language/.php for admin-only)
- Add "Config Files -> Reserved Config Files" section with table
- SECURITY.md:
- Add NDJSON format note to Logging & Error Handling section
- Add "Config Write Protection" block (setConfigFile guard + getConfig skip)
- docs/TEMPLATES.md:
Add "SEO Placeholder Variables" section documenting all 14 setHead() placeholders ([homeurl], [site], [logo], [loc], [time], [mtime], [title], [desc], [img], [ctitle], [type], [url], [headline], [author])
Benefits:
- Documentation accurately reflects the current codebase
- Contributors have clear guidance on language constant placement
- Reserved config file rules are documented
Technical notes:
- docs/TESTS.md and CODE_OF_CONDUCT.md required no changes
The plans directory was moved under docs/ to better organize project planning files alongside other documentation.
Core changes:
- .gitignore:
- Change 'plans/' to 'docs/plans/'
Technical notes:
- No functional change to the codebase
The three reserved config stubs (system.php, header.php, chmod.php) previously returned null to signal they are not config arrays. Replace with an explicit die() guard consistent with other protected system files, and add the standard SLAED copyright header.
Core changes:
- config/system.php, config/header.php, config/chmod.php:
- Add copyright header (Author, Copyright, License, Website)
- Replace 'return null' with: if (!defined('FUNC_FILE')) die('Illegal file access')
Benefits:
- Consistent access protection across all restricted files
- Standard SLAED file header present in all config stubs
Technical notes:
- Files remain excluded from getConfig() merge via skip list in core/system.php
- die() guard prevents direct HTTP access if .htaccess rules are misconfigured
Rename admin info HTML files in modules/content/admin/info/ from full language names to 2-letter locale codes, matching the convention used in other modules (news, pages, etc.).
Core changes:
- modules/content/admin/info/ (6 renames):
- english.html -> en.html
- french.html -> fr.html
- german.html -> de.html
- polish.html -> pl.html
- russian.html -> ru.html
- ukrainian.html -> uk.html
Benefits:
- Consistent file naming across all module admin info directories
- Aligns with the 2-letter locale code convention (en, de, fr, pl, ru, uk)
Technical notes:
- File contents are preserved as-is
- Admin panel loads info files by locale code; old names were unused
The rewrite.php file contained regex-based URL transformation rules managed through the admin editor. This functionality has been superseded: URL rewriting is now controlled exclusively by $conf['rewrite'] and server-level .htaccess rules. All include() calls and the rewrite() function were removed from the codebase in a prior cleanup.
Core changes:
- config/rewrite.php:
- File deleted (122 lines of legacy regex rewrite rules)
- admin/info/editor-*.html (6 language files):
- Remove "System SEF" tab description (referencing config/rewrite.php)
- Rename "Server SEF" tab to "Apache rules" for clarity
Benefits:
- Removes dead code with no callers
- Admin editor UI reflects the actual available tabs
- Reduces confusion between PHP-level and server-level URL rewriting
Technical notes:
- $conf['rewrite'] config key is preserved; controls mod_rewrite behavior
- .htaccess-based rewriting remains fully functional
Protect reserved config files from being merged into $conf via getConfig() or accidentally overwritten via setConfigFile(). Three files serve system injection purposes (not config arrays) and must be excluded from glob merge.
Core changes:
- getConfig() (core/system.php):
- Replace single local.php check with explicit $skip array
- Skip list: local.php, system.php, header.php, chmod.php
- setConfigFile() (core/system.php):
- Add static $reserved guard at function entry point
- Reserved: system.php, header.php, chmod.php, local.php
- Calls with reserved filenames return silently without writing
Benefits:
- Prevents accidental overwrite of system injection files
- Eliminates false config merges from null-returning reserved files
- Explicit skip list is self-documenting
Technical notes:
- config/system.php, header.php, chmod.php return null by design
- config/local.php provides per-environment overrides, must not be merged
- Backward compatible: existing callers are unaffected
Remove the configurable anonymous user name ($confu['anonym']) and replace it with the static language constant _ANONYM defined in all six root language files. This eliminates a config option that had no practical need for per-site customization.
Core changes:
- Language files (language/*.php — 6 files):
Add define("_ANONYM", "...") between _AND and _ANSWER in all 6 languages
- en: "Guest", ru: "Гость", de: "Gast", fr: "Invité", pl: "Gość", uk: "Гість"
- Admin language files (admin/language/*.php — 6 files):
- Remove define("_ANONYMOUSNAME", "...") from all 6 files
- Config and core (config/users.php, core/admin.php, core/security.php, core/user.php):
- Remove 'anonym' key from config/users.php
- Replace all $confu['anonym'] with _ANONYM
- Admin modules (modules/*/admin/index.php — 10 modules + account):
- Remove anonym form field from modules/account/admin/index.php
- Replace $confu['anonym'] with _ANONYM in 10 module admin files
- Block (blocks/block-user_info.php):
- Replace $confu['anonym'] with _ANONYM
Benefits:
- Simplifies configuration (removes non-essential option)
- Consistent anonymous name via i18n constant system
- _ANONYM resides in language/*.php (globally loaded, not admin-only)
Technical notes:
- _ANONYM is defined in language/.php, not admin/language/.php
- core/security.php: collapsed $anon initialization into substr(_ANONYM, 0, 25)
Apply full PHP 8.4 modernization across all 26 front-end modules. Each module receives type-safe function signatures, setHead() for SEO metadata, prepared SQL with named placeholders, getVar() for all user input, and setFoot() replacing legacy foot() calls.
Core changes:
- SEO and head output (all modules):
- Replace head($conf['defis'].' '._MODULE) with setHead(['title' => _MODULE])
- Replace foot() with setFoot()
- SQL queries (all modules):
- Convert string-concatenated queries to prepared statements
- Add PREFIX_DB constant to all table references
- Input handling (all modules):
- Replace $_GET/$_POST direct access with getVar()
- Add type hints to all function parameters and return types
- Template variables (all modules):
- Fix placeholder syntax: 'title' => ... to '{%title%}' => ...
- Use setTemplateBasic() / setTemplateWarning() exclusively
Anonymous user display (faq, files, forum, help, jokes, links, media, news, pages, search, shop, whois, account):
- Replace $confu['anonym'] with _ANONYM constant
Benefits:
- Full PHP 8.4 compatibility across all public-facing modules
- Eliminates SQL injection attack surface in 26 modules
- Consistent anonymous user display via _ANONYM constant
- Uniform SEO metadata via setHead()
Technical notes:
- modules/forum/index.php: largest single-module change (~1469 lines)
- modules/news/index.php: second largest (~566 lines)
- All 26 front-end modules now fully modernized (100% complete)
Complete the head()/foot() → setHead()/setFoot() migration for the last nine front-end modules, and update both basic.html templates to render the article title as <h1> when in single-view mode and <h3> in list mode.
Core changes:
- pages/index.php → setHead(seo); setFoot()
- recommend/index.php → setHead(); setFoot()
- rss/index.php → setHead(); setFoot()
- search/index.php → setHead(); setFoot()
shop/index.php → setHead(seo); setFoot()
- Pass title, desc, img, time, ctitle, author
- sitemap/index.php → setHead(); setFoot()
- users/index.php → setHead(); setFoot()
- voting/index.php → setHead(seo); setFoot()
- whois/index.php → setHead(); setFoot()
- templates/default/basic.html and templates/lite/basic.html:
Wrap title in {%if is_view%}<h1>…</h1>{%else%}<h3>…</h3>{%endif%}
- Single-article view uses semantically correct <h1> for SEO
- List views retain <h3> for visual hierarchy
Benefits:
- All front-end modules now use the unified SEO-aware setHead() API
Templates emit correct heading hierarchy — <h1> on detail pages improves Schema.org headline alignment and core-web-vitals LCP
Technical notes:
- head()/foot() aliases can be removed in a future cleanup pass
- {%if is_view%} is evaluated by the template engine; no PHP changes needed
- Backward compatible: basic.html change is purely additive