Журнал изменений
Makes the RSS reader safe against slow/unreachable feeds, broken charset declarations, and undefined array offsets that previously caused PHP warnings or silent failures.
Core changes:
- RSS reader (core/system.php):
Add stream context with 10-second timeout and follow_location
- Prevents blocking on unresponsive remote feeds
- Suppresses file_get_contents warnings via set/restore_error_handler
Fix charset detection and iconv call
- Regex now matches both double- and single-quoted encoding attr
- Use iconv with //IGNORE to skip unconvertible bytes gracefully
Replace parse_url() array dereference with parse_url($url, PHP_URL_HOST)
- Eliminates need to unpack ['host'] with a fallback
Use null-coalescing defaults for $rss_title, $rss_date, $rss_guid, $rss_desc
- Prevents undefined offset warnings when items lack fields
Guard strtotime() with !== false check
- Avoids passing false to date()
- Change $items[1] truthiness check to !empty()
Benefits:
- No more blocking requests for dead or slow RSS feeds
- Eliminates PHP warnings on malformed or incomplete feeds
- Safer charset conversion without data loss
Technical notes:
- Requires PHP stream wrappers to be enabled (default on all installs)
- No schema or config changes required
- Backward compatible with existing RSS block configs
Standardizes the admin file path variable name across core files, aligning with the canonical $afile identifier used throughout the rest of the system. Also trims unused global declarations.
Core changes:
- Admin utilities (core/admin.php):
Replace all $admin_file references with $afile
- getAdminTabs(): nav link generation
- admininfo(): dashboard block links
- ajax_cat(): AJAX category actions
- ajax_block(): AJAX block actions
- navi_gen() (commented-out legacy): updated for consistency
- Add $confu to fav_aliste() globals
- User utilities (core/user.php):
Replace $admin_file with $afile in setMessageShow()
- Admin edit link in the message block
- Remove unused $conf from checkuser() in setComShow() context
Benefits:
- Single canonical name for the admin file path variable
- Reduces confusion between $admin_file and $aroute variants
- Architecture alignment with module-level code
Technical notes:
- No behavioral change; pure identifier rename
- $afile is already defined in the admin bootstrap
- Backward compatible
Replaces direct superglobal access in frontend/admin modules with typed getVar() calls and adds safer update patterns in critical paths to reduce inconsistent filtering and prepare modules for stricter validation rules.
Core changes:
- Request normalization across modules (multiple modules/*/index.php):
Replaced direct $_POST/$_GET reads with getVar('post'|'get', ..., 'text'|'num'|'array').
- Standardizes input typing and fallback behavior.
- Reduces duplicated manual isset/intval/substr patterns.
- Kept existing business logic and flow while tightening data entry points.
- Safer persistence/update paths (account and selected module handlers):
- Updated write operations to use safer parameter passing where introduced.
- Preserved compatibility with current module interfaces and routing.
Benefits:
- Better reliability of request parsing.
- Improved maintainability through consistent input access patterns.
- Stronger security baseline for future hardening.
Technical notes:
- No schema/storage format changes.
- Module endpoints and operation names remain unchanged.
- Backward compatibility preserved at API and template level.
Replace deprecated WHOIS server hostnames with current IANA-registered endpoints and add proper timeout and error handling for fsockopen calls in the whois module to prevent hanging requests and PHP warnings.
Core changes:
- WHOIS server registry (modules/whois/index.php):
- ru: whois.ripn.net → whois.tcinet.ru
- com/net: whois.crsnic.net → whois.verisign-grs.com
- org: whois.publicinterestregistry.net → whois.publicinterestregistry.org
- info: whois.afilias.net → whois.nic.info
- de: whois.nic.de → whois.denic.de
- ws: whois.nic.ws → whois.website.ws
- cn: whois.cnnic.net.cn → whois.cnnic.cn
- in/co.in/firm.in/gen.in/ind.in/net.in/org.in: whois.registry.in → whois.nixiregistry.in
- Connection handling (modules/whois/index.php):
- Add 10s timeout to all fsockopen calls
- Replace @ suppression with set_error_handler/restore_error_handler
- Remove redundant double-connect retry in whois()
- Variable rename (admin/modules/admins.php):
- $aroute → $afile for consistency with codebase convention
Benefits:
- WHOIS lookups no longer fail silently due to dead server hostnames
- Requests no longer hang indefinitely on unreachable servers
- No @ error suppression in compliance with project guardrails
Update .gitignore and project structure to reflect the transition from the legacy .rules/ directory to the new .agents/ convention for storing AI-workflow configuration. The git-rules.md file is removed as its content is superseded by the updated agent knowledge base.
Core changes:
- Ignored paths (.gitignore):
Add AGENT.md to ignored files
- Prevents session-specific agent manifests from being tracked
Add .agents/ directory to ignored paths
- Covers the new convention for AI workflow files
Remove .rules/ from ignored paths
- Directory is no longer used; rule files moved to .agents/
- Removed file (.rules/git-rules.md):
Delete legacy git commit rules document
- Rules are now maintained inside the .agents/ knowledge base
Benefits:
- Consistent project layout aligning with current AI workflow conventions
- Eliminates stale .rules/ directory from the repository
- .gitignore accurately reflects the real project structure
Technical notes:
- No functional code changes; configuration and documentation only
- Backward compatibility: unaffected
Four root markdown files updated to reflect the current state of the 6.3 codebase: corrected typos, updated progress percentage, unified log file extensions to .log, and added the logging hardening changelog that was missing from SECURITY.md.
Core changes:
- README.md:
- Progress badge and text updated from ~65% to ~70%
- chmod example: storage/logs/.txt → storage/logs/.log
- Typo PREFIX_DB corrected (was REFIX_DB in SQL code example)
- CONTRIBUTING.md:
- chmod example: storage/logs/.txt → storage/logs/.log
- All code examples use $afile (current canonical variable)
- Typo PREFIX_DB corrected in SQL example
- SECURITY.md:
- Typo PREFIX_DB corrected in SQL example
- Module count corrected: "27 modules" → "23 admin modules"
Added Logging & Error Handling Hardening subsection under v6.3.0:
- set_exception_handler(), register_shutdown_function()
- Extended set_error_handler() error levels
- Log rotation fix, .txt → .log rename, addCompress() migration
- Unified log_size 10 MB and filesize() >= operator
- UPGRADING.md:
- chmod example: storage/logs/.txt → storage/logs/.log
- Status text updated from ~65% to ~70%
- Typo PREFIX_DB corrected in SQL example
Troubleshooting log paths corrected:
- storage/logs/error.log → error_php.log and error_site.log
- Renamed Files section: added all 5 log file renames (.txt → .log)
Benefits:
- Documentation is consistent with current codebase
- No misleading typos or outdated paths in public-facing docs
- Logging hardening changes are now traceable in SECURITY.md
Technical notes:
- $afile is the current canonical variable (replaces deprecated $admin_file)
- All log channels now use storage/logs/ with .log extension
The visitor counter / statistics block in head() contained several reliability bugs: unguarded file reads, magic flock numbers, broken date comparison, unsafe $con array access, and missing directory guard before monthly archive rename.
Core changes:
- File read guard (core/system.php):
file($spath.'statistic.log') → file_exists() check before file()
- Prevents PHP warning when statistic.log does not yet exist
- flock constants (core/system.php):
- Magic numbers 2 and 3 → LOCK_EX and LOCK_UN for clarity
- $con array fallbacks (core/system.php):
All $con[N] accesses guarded with ?? 0 to prevent undefined offset notices
- $con[1], $con[3], $con[4], $con[5], $con[6], $con[7]
- $guest variable fix (core/system.php):
- !empty($guest) 1 → $guest 1 (double-negation logical error corrected)
- Date comparison fix (core/system.php):
String date comparison replaced with filemtime($slog) < strtotime('today midnight')
- Correct cross-midnight detection without locale-dependent string compare
- Directory guard before monthly archive (core/system.php):
- mkdir($sdir, 0755, true) added if statistic/ subdirectory does not exist
- Guarded unlink() calls (core/system.php):
- unlink(ips.log) and unlink(user.log) wrapped in file_exists() checks
Benefits:
- No PHP warnings on first-run or missing log files
- Correct guest/session detection logic
- Safe monthly archive creation even on fresh installations
- Code intent made explicit via named constants
Technical notes:
- statistic.log format unchanged: d.m.Y|hosts|hits|allhits|engines|refers|homereqs|users
- COUNTER_DIR constant must point to storage/counter/
All 6 log functions unified and hardened: paths moved to LOGS_DIR, extensions renamed from .txt to .log, rotation logic corrected with proper fclose-before-compress pattern, and exception/fatal-error handlers added for complete error coverage.
Core changes:
- Log path and extension migration (core/security.php):
config/logs/.txt → LOGS_DIR/.log for all 6 channels
- log.log, error_site.log, error_sql.log, hack.log, warn.log, error_php.log
- Log rotation hardening (core/security.php):
zip_compress() + unlink() → addCompress(dir, src, name, 'auto', true, true)
- Proper fclose() before compression in all 6 functions
- fopen() re-check after rotation (fhandle !== false guard)
- log_size fallback unified to 10 MB (was 1 MB in log_report)
- filesize() comparison unified to >= (was inconsistent > vs >=)
- Archive timestamp format unified to Y-m-d_H-i-s
- Error handler extensions (core/security.php):
- set_exception_handler() added — catches all uncaught exceptions → error_php.log
- register_shutdown_function() added — catches E_ERROR, E_PARSE, E_CORE_ERROR, E_COMPILE_ERROR
set_error_handler() extended: cases 256 (USER_ERROR), 512 (USER_WARNING), 1024 (USER_NOTICE), 4096 (RECOVERABLE_ERROR), 16384 (USER_DEPRECATED)
- Variable shadowing fixed in error_sql_log(): $log parameter renamed to $sql
Benefits:
- Fatal errors and uncaught exceptions now logged reliably
- No file corruption from compress-while-open race condition
- All log channels use consistent paths and size limits
- Archives carry second-precision timestamps to prevent collisions
Technical notes:
- LOGS_DIR constant must point to storage/logs/
- addCompress() with $del=true handles archive and source deletion atomically
- error_php.log used for both exception handler and shutdown function
Adds explicit eol=lf rules for all relevant text file types and marks binary assets to prevent line ending conversion.
Core changes:
- .gitattributes:
- Added global fallback: * text=auto eol=lf
- Added eol=lf for html, css, js, json, sql, xml, tpl, md, txt, ini, yaml, .htaccess
Added binary markers for images, fonts, archives, pdf
- Prevents Git from treating binaries as text and corrupting them
Benefits:
- Consistent LF line endings across all editors and OS
- No CRLF creep on Windows checkouts
- Binary files protected from line ending conversion
Fixes error suppression, inconsistent comparisons and naming in the PHP error log rotation block of error_reporting_log().
Core changes:
- error_reporting_log() (core/security.php):
Removed @ from fopen() calls, replaced with explicit !== false checks
- Follows rule 2.8: never use error suppression operator
- Renamed \$path -> \$log for consistency with addErrorFile() in system.php
Moved \$cfg = \$conf['security'] ?? [] inside if (\$error_write) block
- \$cfg only needed when actually writing; skipped for NOTICE etc.
- Extracted \$max = \$cfg['log_size'] ?? 10485760 as named variable
- Changed filesize comparison > to >= (consistent with addErrorFile())
Replaced \$ts/\$rot pattern with clean \$safe via pathinfo()
- Result: error_php_2024-01-01_12-00-00.zip instead of error_php.log.20240101_120000.zip
- Updated addCompress() call to use \$bak=true for .bak fallback
Benefits:
- No error suppression antipattern
- Consistent variable naming across both log rotation functions
- Cleaner archive filenames without double extension
- .bak fallback guaranteed when no compression available
Technical notes:
- Behavior identical when fopen() succeeds and compression is available
- \$cfg scoped to write path only: minor efficiency gain on non-write errors