Журнал изменений

Three independent bugs fixed in the forum public module: duplicate named placeholders in WHERE clauses, reused placeholders in INSERT (l_uid/l_name/ l_time sharing names with earlier params), and a missing head()/foot() pair when a category has no topics.

Core changes:

1. Unique WHERE placeholders (modules/forum/index.php):
2. category query: :id → :parentid / :cid (used twice in OR condition)
3. move(): :val → :id_val / :pid_val in UPDATE SET catid query
4. INSERT named params fix (modules/forum/index.php):

5. l_uid, l_name, l_time now bound as :l_uid / :l_name / :l_time

   • Previously reused :postid / :postname / :time — caused rebind errors
6. Empty-category guard (modules/forum/index.php):

7. Added else branch: renders head() + setTemplateWarning(_NO_INFO)

   • Prevents blank page when forum category contains no threads
   • 5-second redirect back to forum root

Benefits:

• Eliminates PDO named-parameter rebind errors in forum queries
• Proper HTTP response (head/foot wrapper) for empty forum categories
• INSERT now correctly stores l_uid / l_name / l_time independently

Technical notes:

• All bound values remain identical; only parameter names changed
• No schema or API changes; backward compatible

Extends getVar() with a new 'defis' filter type that URL-encodes string input while leaving pre-encoded defaults untouched; also normalises all filter key lookups to lowercase so callers may use any casing.

Core changes:

1. New filter type (core/security.php):

2. Add 'defis' => urlencode(trim($v)) to the filters map

   • Returns '' (not false) for blank strings
   • Skips encoding when the value comes from $default
3. Case-insensitive dispatch (core/security.php):

4. All $filters[$type] lookups replaced with $filters[strtolower($type)]

   • Covers both the array-branch and the scalar-branch paths
   • Prevents silent no-ops when callers pass mixed-case type strings
5. Special defis path (core/security.php):

6. Dedicated early-return block for 'defis' type

   • Falls back to $default as-is (already encoded)
   • Returns false only when both value and default are empty

Benefits:

• Enables safe URL-segment encoding via getVar() without raw urlencode() calls
• Eliminates filter-miss bugs caused by type-string casing differences
• Consistent fallback semantics across all filter types

Technical notes:

• No change to existing filter behaviour or function signature
• Backward compatible: callers using lowercase types are unaffected
• 'defis' default is passed through unchanged (expected to be pre-encoded)

Rewrites the files admin module using standard SLAED conventions: canonical function names, getVar() input handling, prepared SQL statements, and modern template calls. Copyright year updated to 2026.

Core changes:

1. Files admin (modules/files/admin/index.php):
2. Replace files_navi() with navi() using getAdminTabs()

3. Rename functions to short canonical names

   • files_add() -> add(), files_delete() -> del(), etc.
4. Replace all raw $_POST/$_GET with getVar()
5. Use prepared SQL statements with named placeholders throughout
6. Replace tpl_eval()/tpl_warn() with setTemplateBasic()/setTemplateWarning()
7. Replace $admin_file with $afile throughout
8. Update op= route names to match new function names
9. Switch to single-quoted strings consistently
10. Update copyright year to 2026

Benefits:

• SQL injection eliminated throughout the module
• Input validated at entry points via getVar()
• Consistent architecture with other modernized admin modules
• Maintainability improved by short canonical function names

Technical notes:

• op= route values changed to match new function names
• Backward compatible with the database schema

Rewrites the auto_links admin module to follow current SLAED architecture: standard function naming, getVar() input handling, prepared SQL statements, and modern template calls. SQL injection in the stats query is eliminated. Copyright year updated to 2026.

Core changes:

1. Auto-links admin (modules/auto_links/admin/index.php):
2. Replace auto_links_navi() with navi() using getAdminTabs()

3. Rename all functions to short canonical names:

   • auto_links_stat() -> stats()
   • auto_links_add() -> add()
   • auto_links_save() -> save()
   • auto_links_delete() -> del()
   • auto_links_conf() -> conf()
   • auto_links_conf_save() -> confsave()
   • auto_links_info() -> info()
   • nullhits() and noindel() extracted from switch as named functions
4. Replace all raw $_POST/$_GET with getVar()
5. Fix SQL injection in stats(): prepared statement with :lid placeholder
6. Replace tpl_eval()/tpl_warn() with setTemplateBasic()/setTemplateWarning()
7. Replace $admin_file/$aroute with $afile throughout
8. Use $conf['auto_links'] sub-array instead of $confal
9. Rewrite switch to compact form with named cases
10. Remove closing ?>
11. Update copyright year to 2026

Benefits:

• SQL injection in stats query eliminated
• Input validated through getVar() at all entry points
• Consistent naming convention with other modernized modules
• Maintainability improved by short, readable function names

Technical notes:

• op= route values changed to match new function names
• $confal replaced by $conf['auto_links'] sub-array
• Routing layer must map new op names

Eliminates the legacy $aroute variable from all four admin panel modules, replacing it with the canonical $afile identifier. Also removes the pwd field from admin list and edit queries to avoid exposing password hashes unnecessarily in list views.

Core changes:

1. Admins manager (admin/modules/admins.php):
2. Replace $aroute with $afile in admins(), add(), save(), del()
3. Remove pwd column from SELECT in admins() list query
4. Remove pwd from SELECT and list() destructuring in add()
5. Blocks manager (admin/modules/blocks.php):

6. Replace $aroute with $afile in all functions

   • add(), fileadd(), fileedit(), fix(), addsave(), filecode()
   • filecodesave(), edit(), editsave(), change(), del()
7. Config manager (admin/modules/config.php):
8. Replace $aroute with $afile in config(), save()
9. Modules manager (admin/modules/modules.php):
10. Replace $aroute with $afile in navi(), modules(), edit(), status(), save()

Benefits:

• Consistent use of $afile across the entire admin panel
• Removing pwd from queries reduces attack surface in list views
• Simpler global declarations in each function

Technical notes:

• No behavioral change beyond the variable rename
• $afile is injected by the admin bootstrap
• Backward compatible