Журнал изменений
Bump base font sizes in the admin area to improve legibility on higher-DPI displays and modern browsers.
Core changes:
- CodeMirror editor (templates/admin/system.css):
- .CodeMirror font: 11px → 12px Verdana
- .CodeMirror-hints font: 11px → 12px Verdana
- Admin base layout (templates/admin/theme.css):
- body, form elements font: 12px/16px → 13px/16px Tahoma/Arial/Verdana
Benefits:
- Better readability on HD/Retina screens
- Consistent sizing between editor widget and surrounding UI
Technical notes:
- Line-height left at 16px; no layout reflow expected
- No change to colours, spacing, or other visual properties
Replace the deprecated \$prefix variable in all SQL snippets shown in project documentation with the PREFIX_DB constant, keeping examples consistent with the actual codebase after the refactor.
Core changes:
- README.md:
- SQL example: '.\$prefix.'_users → '.PREFIX_DB.'_users
- CONTRIBUTING.md (2 occurrences):
- SQL examples in "Correct - Safe" and function sample updated
- SECURITY.md:
- Prepared-statement example updated
- UPGRADING.md:
- Migration guide example for 6.3.x updated
Benefits:
- Documentation reflects current coding standard
- New contributors see the correct pattern from the start
Technical notes:
- No functional code changed; documentation only
Harden the Apache rewrite rules to close several attack vectors and improve reliability across all hosting configurations.
Core changes:
- Block PHP execution in uploads (new rule):
- RewriteRule ^uploads/.*\.php$ — [F,L,NC]
- Prevents uploaded-file code-execution attacks
- Exploit-string filter (existing block):
- Add [NC] flag to base64_encode and GLOBALS conditions
Change final RewriteRule target from index.php to — [F,L] (returns 403 instead of silently routing malicious queries)
- HTTP_AUTHORIZATION passthrough:
- Move the Authorization header rule BEFORE the front-controller rule
- Ensures REST/API clients receive the header when using BasicAuth
- Remove trailing [L] flag from original position (was unreachable)
Benefits:
- Uploaded PHP files can no longer be executed via the web
- Malformed query strings return 403 instead of being forwarded
- HTTP Basic Auth works correctly in CGI/FastCGI environments
Technical notes:
- No change to normal request routing
- Backward-compatible with all existing URL rewrite patterns
Simplify file names in config/ by dropping the redundant config_ prefix. Remove the editrewrite admin function that was editing the now-deleted config/config_rules.php file.
Core changes:
- Config file renames:
- config/config_chmod.php → config/chmod.php
- config/config_header.php → config/header.php
- config/config_rules.php — deleted (no longer used)
- Security guard (config/system.php):
- Add FUNC_FILE guard to match style of all other config files
- Remove duplicate license header (already in repo root)
- Reference updates (core/admin.php, admin/modules/editor.php):
- end_chmod(): update tdir to 'config/chmod.php'
- editheader(): switch to CONFIG_DIR.'/header.php'
- htaccess(), robots(): switch to BASE_DIR-prefixed paths
- Remove editrewrite() function entirely
- Admin navigation (admin/modules/editor.php):
- Remove "System Rewrite" tab from editor navigation
- Renumber remaining tabs accordingly
- Documentation (admin/info/blocks-*.html, 6 languages):
- Update all references from config/config_header.php → config/header.php
- Tests (tests/ConfigValidationTest.php):
- Update required file list: config_global.php → global.php
Benefits:
- Cleaner, shorter file names consistent with the rest of config/
- Dead code (editrewrite) removed, reducing surface area
- All paths now use constants (BASE_DIR, CONFIG_DIR) for portability
Technical notes:
- config/chmod.php and config/header.php already existed as new files
- Storage format unchanged; only file names differ
_REDAKTOR was a legacy alias for _EDITOR. Consolidate all references to a single constant and drop the outdated definition from every language file.
Core changes:
- Language files (admin/language/*.php, 6 files):
- Remove define("_REDAKTOR", ...) from de, en, fr, pl, ru, uk
- Remove define("_EREW", ...) and define("_EREWN", ...) — editor rewrite labels
- Remove define("_EINFO3", ...) — rewrite editor info text
- Admin config panel (admin/modules/config.php):
- Replace _REDAKTOR with _EDITOR in editor-selector label
- Editor selector labels (core/system.php):
Remove redundant _EDITOR prefix from option strings in redaktor() (e.g., _EDITOR.' SLAED BB' → 'SLAED BB')
Benefits:
- Single constant _EDITOR used consistently everywhere
- Removes dead constants that referenced removed functionality
- Reduces translation maintenance overhead
Technical notes:
- _REDAKTOR was functionally identical to _EDITOR
- admin/modules/admins.php already updated in previous commit
Drop all uses of the legacy \$prefix variable in favour of the PREFIX_DB constant defined in core/security.php. This completes the migration started in earlier commits and removes the last runtime dependency on the dynamic global.
Core changes:
- Remove \$prefix assignment (core/security.php):
- Delete the \$prefix = \$conf['db']['prefix'] line
- PREFIX_DB constant was already defined; variable was redundant
- All blocks (blocks/block-*.php, 15 files):
- Remove \$prefix from global declarations
- Replace ".$prefix."_table with ".PREFIX_DB."_table in all queries
- All front-end modules (modules/*/index.php, 24 files):
- Remove \$prefix from function global declarations
- Replace \$prefix in every SQL query string
- All admin modules (admin/index.php, admin/modules/.php, modules//admin/index.php):
- Same substitution as front-end modules
- Templates (templates/admin/index.php, templates/lite/index.php, templates/lite/0index.php):
- Remove \$prefix from global declarations
- Replace \$prefix in SQL queries
Benefits:
- Single source of truth: PREFIX_DB constant eliminates accidental overrides
- Consistent style across the entire codebase
- Prepares for full removal of legacy globals
Technical notes:
- No behaviour change; queries produce identical SQL
- Backward-compatible: PREFIX_DB was already defined before any query runs
Harden .htaccess and fix string quoting in setConfigFile().
Core changes:
- .htaccess:
- Added Options -Indexes (prevent directory listing)
- Added RewriteRule ^config/ [F,L] (block config access)
- Added RewriteRule ^setup/ [F,L] (block installer access)
- Split commented deflate/expires into separate IfModule blocks
- setConfigFile() (core/system.php, setup/index.php):
- Replaced double-quoted "\n" with PHP_EOL and single quotes
- '['.PHP_EOL and ','.PHP_EOL consistent with rest of function
Benefits:
- config/ directory with DB credentials no longer web-accessible
- setup/ installer blocked after initial setup
- Directory listing disabled sitewide
- String quoting consistent with Rule 17 (single quotes)
Rename single-letter and over-length variables to comply with SLAED coding rules (Rule 6: prefer 4-8 chars, no camelCase).
Core changes:
- setConfigFile() (core/system.php, setup/index.php):
- \$normalize (9 chars) → \$norm
- \$exp closure: \$a→\$arr, \$d→\$dep, \$p→\$pad, \$i→\$ind, \$s→\$out
- Loop vars: \$k→\$key, \$v→\$val throughout the function
Benefits:
- Compliant with Rule 6 (4-8 char variable names)
- No functional changes
Expose the existing dev_mode flag in the admin interface so it can be toggled without manually editing config files or local.php.
Core changes:
- admin/modules/config.php:
- Added radio_form row for dev_mode (after site close toggle)
- Added 'dev_mode' => getVar('post', 'dev_mode', 'num') to save \$cont
- admin/language/*.php (6 files):
Added _DEVMODE constant after _DEAKTIVE (alphabetical order) ru: «Режим разработки» en: «Developer Mode» de: «Entwicklermodus» fr: «Mode développeur» pl: «Tryb deweloperski» uk: «Режим розробника»
- config/global.php:
- Added 'dev_mode' => false as explicit default
Benefits:
- dev_mode can be enabled/disabled without file editing
- Config fingerprint tracking active when dev_mode is on
- Consistent with all other boolean toggles in general preferences
Technical notes:
- getConfig() already provides $conf['dev_mode'] ??= false fallback
- normalize() converts false → '0', true → '1' on save
- String '0' is falsy in PHP, behavior unchanged
Replace var_export() with a recursive closure that produces modern PHP short-array syntax ([]) consistent with all config/*.php files.
Core changes:
- setConfigFile() (core/system.php, setup/index.php):
- Added $exp closure: renders arrays as [...] with 4-space indent
- Replaced var_export($data, true) with $exp($data)
- Output format now matches manually-converted config files
Benefits:
- Config files saved by admin panel are readable and consistent
- No more array() vs [] style mismatch after save
- Multi-level arrays (ratings, modules) properly indented
Technical notes:
- $exp recurses for nested arrays using depth counter
- Scalar values still use var_export() for correct quoting
- Both system.php and setup/index.php versions kept in sync