Журнал изменений

Журнал изменений

Фильтр и поиск

Всего: 1098 Доступных коммитов | Отфильтровано: 1098 Коммиты | Страница: 89 / 110
19.02.2026
Refactor: Remove end_chmod() and replace with checkPerms() in admin
Автор: Eduard Laas | Дата: 23:34 19.02.2026

The legacy end_chmod() helper performed chmod tests by writing a test file to config/chmod.php, which relied on a dedicated config entry and Linux-specific uname/chmod logic. It has been replaced by the modern checkPerms() function that handles permission checks uniformly.

Core changes:

  1. core/admin.php:
  2. Delete end_chmod() function (~20 lines) marked # DELETE OLD
  3. Update fav_aliste(): replace include('config/config_media.php') with $confm = $conf['media'] ?? [] (uses global $conf)

  4. admin/modules/blocks.php:
  5. Replace 3 end_chmod() calls with checkPerms() equivalents: fileadd(): end_chmod('blocks/', 777) -> checkPerms('blocks/', 1) filecode(): same for directory and per-file permission check

Benefits:

  • Removes OS-specific chmod probe that relied on config/chmod.php
  • checkPerms() provides consistent, testable permission reporting
  • Reduces dead code surface in core/admin.php

Technical notes:

  • config/chmod.php remains as an empty return [] placeholder
  • No user-facing behaviour change; only internal permission checking
Refactor: Remove direct config includes from modules and core
Автор: Eduard Laas | Дата: 23:34 19.02.2026

Replace all per-module include('config/config_*.php') and include('config/*.php') calls with global config aliases that are already populated by the unified bootstrap in core/security.php. Also update save_conf() calls to setConfigFile() with the new paths.

Core changes:

  1. All modules/*/admin/index.php (17 files):
  2. Remove top-level include('config/config_X.php')
  3. Replace end_chmod/save_conf with checkPerms/setConfigFile
  4. Update config file path arguments (config_X.php -> X.php)
  5. All modules/*/index.php (17 files) + blocks/block-auto_links.php:
  6. Remove include('config/config_X.php') — alias already set globally
  7. core/user.php:
  8. Remove include('config/config_shop.php') in navi()
  9. Remove include('config/config_forum.php') in editpost()
  10. Use $conf['shop'] and $conf['forum'] via global $conf
  11. Fix uninitialised $fstatus variable; fix $_GET isset check
  12. index.php:
  13. Update require_once paths: config_shop.php -> shop.php, config_uploads.php -> uploads.php

  14. admin/modules/privat.php:
  15. Update checkPerms() and setConfigFile() path: privat.php

Benefits:

  • Eliminates ~40 redundant file-system reads per request
  • Single source of truth: config loaded once in bootstrap
  • Consistent use of setConfigFile() for config persistence

Technical notes:

  • All config aliases ($confn, $conffo, etc.) remain set in core/security.php
  • No functional behaviour change; pure include removal
Refactor: Rename config_*.php to *.php in config/ directory
Автор: Eduard Laas | Дата: 23:33 19.02.2026

Drop the redundant config_ prefix from all module config files, aligning naming with the unified config bootstrap introduced in core/system.php. The new names match the module names directly.

Core changes:

  1. Deleted (23 files) (config/config_*.php):
  2. config_auto_links, config_comments, config_contact, config_content, config_faq, config_files, config_forum, config_global, config_help, config_jokes, config_links, config_media, config_money, config_news, config_order, config_pages, config_privat, config_rewrite, config_shop, config_templ, config_users, config_voting, config_whois

  3. Added (20 files) (config/*.php):
  4. auto_links, contact, content, faq, files, forum, help, jokes, lang, links, media, money, news, order, pages, privat, rewrite, shop, voting, whois

Benefits:

  • Simpler, predictable naming: config/{module}.php
  • Eliminates the inconsistent config_ prefix across all modules
  • lang.php added as a new first-class config file

Technical notes:

  • Git detected renames automatically (rename detection enabled)
  • config_global, config_templ, config_users, config_comments removed (merged into global config or no longer needed as separate files)

Style: Increase admin panel font sizes for readability
Автор: Eduard Laas | Дата: 18:09 19.02.2026

Bump base font sizes in the admin area to improve legibility on higher-DPI displays and modern browsers.

Core changes:

  1. CodeMirror editor (templates/admin/system.css):
  2. .CodeMirror font: 11px → 12px Verdana
  3. .CodeMirror-hints font: 11px → 12px Verdana
  4. Admin base layout (templates/admin/theme.css):
  5. body, form elements font: 12px/16px → 13px/16px Tahoma/Arial/Verdana

Benefits:

  • Better readability on HD/Retina screens
  • Consistent sizing between editor widget and surrounding UI

Technical notes:

  • Line-height left at 16px; no layout reflow expected
  • No change to colours, spacing, or other visual properties
Docs: Update code examples to use PREFIX_DB constant
Автор: Eduard Laas | Дата: 18:08 19.02.2026

Replace the deprecated \$prefix variable in all SQL snippets shown in project documentation with the PREFIX_DB constant, keeping examples consistent with the actual codebase after the refactor.

Core changes:

  1. README.md:
  2. SQL example: '.\$prefix.'_users → '.PREFIX_DB.'_users
  3. CONTRIBUTING.md (2 occurrences):
  4. SQL examples in "Correct - Safe" and function sample updated
  5. SECURITY.md:
  6. Prepared-statement example updated
  7. UPGRADING.md:
  8. Migration guide example for 6.3.x updated

Benefits:

  • Documentation reflects current coding standard
  • New contributors see the correct pattern from the start

Technical notes:

  • No functional code changed; documentation only
Fix: Strengthen .htaccess security rules
Автор: Eduard Laas | Дата: 18:08 19.02.2026

Harden the Apache rewrite rules to close several attack vectors and improve reliability across all hosting configurations.

Core changes:

  1. Block PHP execution in uploads (new rule):
  2. RewriteRule ^uploads/.*\.php$ — [F,L,NC]
  3. Prevents uploaded-file code-execution attacks
  4. Exploit-string filter (existing block):
  5. Add [NC] flag to base64_encode and GLOBALS conditions
  6. Change final RewriteRule target from index.php to — [F,L] (returns 403 instead of silently routing malicious queries)

  7. HTTP_AUTHORIZATION passthrough:
  8. Move the Authorization header rule BEFORE the front-controller rule
  9. Ensures REST/API clients receive the header when using BasicAuth
  10. Remove trailing [L] flag from original position (was unreachable)

Benefits:

  • Uploaded PHP files can no longer be executed via the web
  • Malformed query strings return 403 instead of being forwarded
  • HTTP Basic Auth works correctly in CGI/FastCGI environments

Technical notes:

  • No change to normal request routing
  • Backward-compatible with all existing URL rewrite patterns
Chore: Rename config files and remove obsolete editrewrite editor
Автор: Eduard Laas | Дата: 18:08 19.02.2026

Simplify file names in config/ by dropping the redundant config_ prefix. Remove the editrewrite admin function that was editing the now-deleted config/config_rules.php file.

Core changes:

  1. Config file renames:
  2. config/config_chmod.php → config/chmod.php
  3. config/config_header.php → config/header.php
  4. config/config_rules.php — deleted (no longer used)
  5. Security guard (config/system.php):
  6. Add FUNC_FILE guard to match style of all other config files
  7. Remove duplicate license header (already in repo root)
  8. Reference updates (core/admin.php, admin/modules/editor.php):
  9. end_chmod(): update tdir to 'config/chmod.php'
  10. editheader(): switch to CONFIG_DIR.'/header.php'
  11. htaccess(), robots(): switch to BASE_DIR-prefixed paths
  12. Remove editrewrite() function entirely
  13. Admin navigation (admin/modules/editor.php):
  14. Remove "System Rewrite" tab from editor navigation
  15. Renumber remaining tabs accordingly
  16. Documentation (admin/info/blocks-*.html, 6 languages):
  17. Update all references from config/config_header.php → config/header.php
  18. Tests (tests/ConfigValidationTest.php):
  19. Update required file list: config_global.php → global.php

Benefits:

  • Cleaner, shorter file names consistent with the rest of config/
  • Dead code (editrewrite) removed, reducing surface area
  • All paths now use constants (BASE_DIR, CONFIG_DIR) for portability

Technical notes:

  • config/chmod.php and config/header.php already existed as new files
  • Storage format unchanged; only file names differ
Refactor: Remove _REDAKTOR constant, use _EDITOR
Автор: Eduard Laas | Дата: 18:07 19.02.2026

_REDAKTOR was a legacy alias for _EDITOR. Consolidate all references to a single constant and drop the outdated definition from every language file.

Core changes:

  1. Language files (admin/language/*.php, 6 files):
  2. Remove define("_REDAKTOR", ...) from de, en, fr, pl, ru, uk
  3. Remove define("_EREW", ...) and define("_EREWN", ...) — editor rewrite labels
  4. Remove define("_EINFO3", ...) — rewrite editor info text
  5. Admin config panel (admin/modules/config.php):
  6. Replace _REDAKTOR with _EDITOR in editor-selector label
  7. Editor selector labels (core/system.php):
  8. Remove redundant _EDITOR prefix from option strings in redaktor() (e.g., _EDITOR.' SLAED BB' → 'SLAED BB')

Benefits:

  • Single constant _EDITOR used consistently everywhere
  • Removes dead constants that referenced removed functionality
  • Reduces translation maintenance overhead

Technical notes:

  • _REDAKTOR was functionally identical to _EDITOR
  • admin/modules/admins.php already updated in previous commit
Refactor: Replace \$prefix global with PREFIX_DB constant
Автор: Eduard Laas | Дата: 18:07 19.02.2026

Drop all uses of the legacy \$prefix variable in favour of the PREFIX_DB constant defined in core/security.php. This completes the migration started in earlier commits and removes the last runtime dependency on the dynamic global.

Core changes:

  1. Remove \$prefix assignment (core/security.php):
  2. Delete the \$prefix = \$conf['db']['prefix'] line
  3. PREFIX_DB constant was already defined; variable was redundant
  4. All blocks (blocks/block-*.php, 15 files):
  5. Remove \$prefix from global declarations
  6. Replace ".$prefix."_table with ".PREFIX_DB."_table in all queries
  7. All front-end modules (modules/*/index.php, 24 files):
  8. Remove \$prefix from function global declarations
  9. Replace \$prefix in every SQL query string
  10. All admin modules (admin/index.php, admin/modules/.php, modules//admin/index.php):
  11. Same substitution as front-end modules
  12. Templates (templates/admin/index.php, templates/lite/index.php, templates/lite/0index.php):
  13. Remove \$prefix from global declarations
  14. Replace \$prefix in SQL queries

Benefits:

  • Single source of truth: PREFIX_DB constant eliminates accidental overrides
  • Consistent style across the entire codebase
  • Prepares for full removal of legacy globals

Technical notes:

  • No behaviour change; queries produce identical SQL
  • Backward-compatible: PREFIX_DB was already defined before any query runs
Fix: Security and code quality improvements
Автор: Eduard Laas | Дата: 14:19 19.02.2026

Harden .htaccess and fix string quoting in setConfigFile().

Core changes:

  1. .htaccess:
  2. Added Options -Indexes (prevent directory listing)
  3. Added RewriteRule ^config/ [F,L] (block config access)
  4. Added RewriteRule ^setup/ [F,L] (block installer access)
  5. Split commented deflate/expires into separate IfModule blocks
  6. setConfigFile() (core/system.php, setup/index.php):
  7. Replaced double-quoted "\n" with PHP_EOL and single quotes
  8. '['.PHP_EOL and ','.PHP_EOL consistent with rest of function

Benefits:

  • config/ directory with DB credentials no longer web-accessible
  • setup/ installer blocked after initial setup
  • Directory listing disabled sitewide
  • String quoting consistent with Rule 17 (single quotes)

Всего: 1098 на 110 страницах по 10 на каждой странице

1 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 110
Хотите опробовать SLAED CMS в действии?
Идеи и предложения
Обратная связь
Подтверждение

Поделиться
QR-код