Журнал изменений
Rewrites the auto_links admin module to follow current SLAED architecture: standard function naming, getVar() input handling, prepared SQL statements, and modern template calls. SQL injection in the stats query is eliminated. Copyright year updated to 2026.
Core changes:
- Auto-links admin (modules/auto_links/admin/index.php):
- Replace auto_links_navi() with navi() using getAdminTabs()
Rename all functions to short canonical names:
- auto_links_stat() -> stats()
- auto_links_add() -> add()
- auto_links_save() -> save()
- auto_links_delete() -> del()
- auto_links_conf() -> conf()
- auto_links_conf_save() -> confsave()
- auto_links_info() -> info()
- nullhits() and noindel() extracted from switch as named functions
- Replace all raw $_POST/$_GET with getVar()
- Fix SQL injection in stats(): prepared statement with :lid placeholder
- Replace tpl_eval()/tpl_warn() with setTemplateBasic()/setTemplateWarning()
- Replace $admin_file/$aroute with $afile throughout
- Use $conf['auto_links'] sub-array instead of $confal
- Rewrite switch to compact form with named cases
- Remove closing ?>
- Update copyright year to 2026
Benefits:
- SQL injection in stats query eliminated
- Input validated through getVar() at all entry points
- Consistent naming convention with other modernized modules
- Maintainability improved by short, readable function names
Technical notes:
- op= route values changed to match new function names
- $confal replaced by $conf['auto_links'] sub-array
- Routing layer must map new op names
Aligns the account admin and frontend module with the canonical $afile variable, and removes unused globals from checkuser() and view().
Core changes:
- Account admin (modules/account/admin/index.php):
Replace $aroute with $afile in navi(), users(), add(), addsave(), newuser(), nullpoints(), nullsave(), conf(), save(), newdel(), del()
- Fix navi() call spacing: navi(0,0,0,0) -> navi(0, 0, 0, 0)
- Account frontend (modules/account/index.php):
- Replace $admin_file with $afile in view()
- Remove unused $conf from checkuser() globals
Benefits:
- Consistent $afile usage across frontend and admin sides
- Eliminates unnecessary global imports
- Architecture alignment with modernized modules
Technical notes:
- No behavioral change; pure identifier rename
- Backward compatible
Eliminates the legacy $aroute variable from all four admin panel modules, replacing it with the canonical $afile identifier. Also removes the pwd field from admin list and edit queries to avoid exposing password hashes unnecessarily in list views.
Core changes:
- Admins manager (admin/modules/admins.php):
- Replace $aroute with $afile in admins(), add(), save(), del()
- Remove pwd column from SELECT in admins() list query
- Remove pwd from SELECT and list() destructuring in add()
- Blocks manager (admin/modules/blocks.php):
Replace $aroute with $afile in all functions
- add(), fileadd(), fileedit(), fix(), addsave(), filecode()
- filecodesave(), edit(), editsave(), change(), del()
- Config manager (admin/modules/config.php):
- Replace $aroute with $afile in config(), save()
- Modules manager (admin/modules/modules.php):
- Replace $aroute with $afile in navi(), modules(), edit(), status(), save()
Benefits:
- Consistent use of $afile across the entire admin panel
- Removing pwd from queries reduces attack surface in list views
- Simpler global declarations in each function
Technical notes:
- No behavioral change beyond the variable rename
- $afile is injected by the admin bootstrap
- Backward compatible
Makes the RSS reader safe against slow/unreachable feeds, broken charset declarations, and undefined array offsets that previously caused PHP warnings or silent failures.
Core changes:
- RSS reader (core/system.php):
Add stream context with 10-second timeout and follow_location
- Prevents blocking on unresponsive remote feeds
- Suppresses file_get_contents warnings via set/restore_error_handler
Fix charset detection and iconv call
- Regex now matches both double- and single-quoted encoding attr
- Use iconv with //IGNORE to skip unconvertible bytes gracefully
Replace parse_url() array dereference with parse_url($url, PHP_URL_HOST)
- Eliminates need to unpack ['host'] with a fallback
Use null-coalescing defaults for $rss_title, $rss_date, $rss_guid, $rss_desc
- Prevents undefined offset warnings when items lack fields
Guard strtotime() with !== false check
- Avoids passing false to date()
- Change $items[1] truthiness check to !empty()
Benefits:
- No more blocking requests for dead or slow RSS feeds
- Eliminates PHP warnings on malformed or incomplete feeds
- Safer charset conversion without data loss
Technical notes:
- Requires PHP stream wrappers to be enabled (default on all installs)
- No schema or config changes required
- Backward compatible with existing RSS block configs
Standardizes the admin file path variable name across core files, aligning with the canonical $afile identifier used throughout the rest of the system. Also trims unused global declarations.
Core changes:
- Admin utilities (core/admin.php):
Replace all $admin_file references with $afile
- getAdminTabs(): nav link generation
- admininfo(): dashboard block links
- ajax_cat(): AJAX category actions
- ajax_block(): AJAX block actions
- navi_gen() (commented-out legacy): updated for consistency
- Add $confu to fav_aliste() globals
- User utilities (core/user.php):
Replace $admin_file with $afile in setMessageShow()
- Admin edit link in the message block
- Remove unused $conf from checkuser() in setComShow() context
Benefits:
- Single canonical name for the admin file path variable
- Reduces confusion between $admin_file and $aroute variants
- Architecture alignment with module-level code
Technical notes:
- No behavioral change; pure identifier rename
- $afile is already defined in the admin bootstrap
- Backward compatible
Replaces direct superglobal access in frontend/admin modules with typed getVar() calls and adds safer update patterns in critical paths to reduce inconsistent filtering and prepare modules for stricter validation rules.
Core changes:
- Request normalization across modules (multiple modules/*/index.php):
Replaced direct $_POST/$_GET reads with getVar('post'|'get', ..., 'text'|'num'|'array').
- Standardizes input typing and fallback behavior.
- Reduces duplicated manual isset/intval/substr patterns.
- Kept existing business logic and flow while tightening data entry points.
- Safer persistence/update paths (account and selected module handlers):
- Updated write operations to use safer parameter passing where introduced.
- Preserved compatibility with current module interfaces and routing.
Benefits:
- Better reliability of request parsing.
- Improved maintainability through consistent input access patterns.
- Stronger security baseline for future hardening.
Technical notes:
- No schema/storage format changes.
- Module endpoints and operation names remain unchanged.
- Backward compatibility preserved at API and template level.
Replace deprecated WHOIS server hostnames with current IANA-registered endpoints and add proper timeout and error handling for fsockopen calls in the whois module to prevent hanging requests and PHP warnings.
Core changes:
- WHOIS server registry (modules/whois/index.php):
- ru: whois.ripn.net → whois.tcinet.ru
- com/net: whois.crsnic.net → whois.verisign-grs.com
- org: whois.publicinterestregistry.net → whois.publicinterestregistry.org
- info: whois.afilias.net → whois.nic.info
- de: whois.nic.de → whois.denic.de
- ws: whois.nic.ws → whois.website.ws
- cn: whois.cnnic.net.cn → whois.cnnic.cn
- in/co.in/firm.in/gen.in/ind.in/net.in/org.in: whois.registry.in → whois.nixiregistry.in
- Connection handling (modules/whois/index.php):
- Add 10s timeout to all fsockopen calls
- Replace @ suppression with set_error_handler/restore_error_handler
- Remove redundant double-connect retry in whois()
- Variable rename (admin/modules/admins.php):
- $aroute → $afile for consistency with codebase convention
Benefits:
- WHOIS lookups no longer fail silently due to dead server hostnames
- Requests no longer hang indefinitely on unreachable servers
- No @ error suppression in compliance with project guardrails
Update .gitignore and project structure to reflect the transition from the legacy .rules/ directory to the new .agents/ convention for storing AI-workflow configuration. The git-rules.md file is removed as its content is superseded by the updated agent knowledge base.
Core changes:
- Ignored paths (.gitignore):
Add AGENT.md to ignored files
- Prevents session-specific agent manifests from being tracked
Add .agents/ directory to ignored paths
- Covers the new convention for AI workflow files
Remove .rules/ from ignored paths
- Directory is no longer used; rule files moved to .agents/
- Removed file (.rules/git-rules.md):
Delete legacy git commit rules document
- Rules are now maintained inside the .agents/ knowledge base
Benefits:
- Consistent project layout aligning with current AI workflow conventions
- Eliminates stale .rules/ directory from the repository
- .gitignore accurately reflects the real project structure
Technical notes:
- No functional code changes; configuration and documentation only
- Backward compatibility: unaffected
Four root markdown files updated to reflect the current state of the 6.3 codebase: corrected typos, updated progress percentage, unified log file extensions to .log, and added the logging hardening changelog that was missing from SECURITY.md.
Core changes:
- README.md:
- Progress badge and text updated from ~65% to ~70%
- chmod example: storage/logs/.txt → storage/logs/.log
- Typo PREFIX_DB corrected (was REFIX_DB in SQL code example)
- CONTRIBUTING.md:
- chmod example: storage/logs/.txt → storage/logs/.log
- All code examples use $afile (current canonical variable)
- Typo PREFIX_DB corrected in SQL example
- SECURITY.md:
- Typo PREFIX_DB corrected in SQL example
- Module count corrected: "27 modules" → "23 admin modules"
Added Logging & Error Handling Hardening subsection under v6.3.0:
- set_exception_handler(), register_shutdown_function()
- Extended set_error_handler() error levels
- Log rotation fix, .txt → .log rename, addCompress() migration
- Unified log_size 10 MB and filesize() >= operator
- UPGRADING.md:
- chmod example: storage/logs/.txt → storage/logs/.log
- Status text updated from ~65% to ~70%
- Typo PREFIX_DB corrected in SQL example
Troubleshooting log paths corrected:
- storage/logs/error.log → error_php.log and error_site.log
- Renamed Files section: added all 5 log file renames (.txt → .log)
Benefits:
- Documentation is consistent with current codebase
- No misleading typos or outdated paths in public-facing docs
- Logging hardening changes are now traceable in SECURITY.md
Technical notes:
- $afile is the current canonical variable (replaces deprecated $admin_file)
- All log channels now use storage/logs/ with .log extension
The visitor counter / statistics block in head() contained several reliability bugs: unguarded file reads, magic flock numbers, broken date comparison, unsafe $con array access, and missing directory guard before monthly archive rename.
Core changes:
- File read guard (core/system.php):
file($spath.'statistic.log') → file_exists() check before file()
- Prevents PHP warning when statistic.log does not yet exist
- flock constants (core/system.php):
- Magic numbers 2 and 3 → LOCK_EX and LOCK_UN for clarity
- $con array fallbacks (core/system.php):
All $con[N] accesses guarded with ?? 0 to prevent undefined offset notices
- $con[1], $con[3], $con[4], $con[5], $con[6], $con[7]
- $guest variable fix (core/system.php):
- !empty($guest) 1 → $guest 1 (double-negation logical error corrected)
- Date comparison fix (core/system.php):
String date comparison replaced with filemtime($slog) < strtotime('today midnight')
- Correct cross-midnight detection without locale-dependent string compare
- Directory guard before monthly archive (core/system.php):
- mkdir($sdir, 0755, true) added if statistic/ subdirectory does not exist
- Guarded unlink() calls (core/system.php):
- unlink(ips.log) and unlink(user.log) wrapped in file_exists() checks
Benefits:
- No PHP warnings on first-run or missing log files
- Correct guest/session detection logic
- Safe monthly archive creation even on fresh installations
- Code intent made explicit via named constants
Technical notes:
- statistic.log format unchanged: d.m.Y|hosts|hits|allhits|engines|refers|homereqs|users
- COUNTER_DIR constant must point to storage/counter/