Журнал изменений

Add PHPUnit test to prevent require/include statements from being placed inside functions, which causes silent failures with require_once.

Core changes:

1. testNoIncludesInsideFunctions (SecurityValidationTest.php):

2. Uses PHP tokenizer (token_get_all) for accurate detection

   • Tracks brace depth to determine function scope
   • Detects T_REQUIRE, T_REQUIRE_ONCE, T_INCLUDE, T_INCLUDE_ONCE
3. Reports file path, line number, and function name on failure
4. Scans all project PHP files (excludes vendor, tests, setup)

Benefits:

• Prevents recurring require_once-inside-function bugs
• Catches issues at test time before they reach production
• Accurate scope detection via PHP tokenizer vs regex

Technical notes:

• Tokenizer approach handles edge cases (comments, strings)
• Test integrates with existing SecurityValidationTest file scanner
• No false positives for top-level includes or class method bodies

Fix multiple deprecated/warning errors caused by passing null values to string functions when users are not authenticated (bots, guests).

Core changes:

1. Null-safe $admin[3] access (security.php, system.php):

2. Fix checkPost() substr() null deprecation

   • Add is_array() check with null coalescing for $admin[3]

3. Fix save_text() substr() null deprecation

   • Same pattern applied consistently

4. Fix replace_break() substr() null deprecation

   • Prevent crash when $admin is not initialized
5. Config includes refactoring (system.php):

6. Move fields.php, statistic.php, rss.php to global scope

   • Prevents require_once failure on repeated function calls

7. Fix fields_out() to use global $conffi instead of require

   • require_once inside function only loads file on first call
8. Update head() global declarations for $confrs, $confst
9. Restore config_seo.php external config file
10. Null-safe $user[3] access (account/index.php):

11. Fix last() function undefined array key warning

    • Add null coalescing for $user[3] in user_news() call

Benefits:

• Eliminates PHP 8.1+ deprecation warnings for guest/bot visitors
• Prevents silent failures from require_once inside functions
• Consistent null-safety pattern across all $admin[3] usages

Technical notes:

• Pattern used: $flag = is_array($x) ? ($x[n] ?? '') : ''
• No behavioral changes for authenticated users
• Backward compatible with PHP 7.4+

Enhanced the modules admin panel with type-based filtering and automatic detection of new or removed modules in the filesystem.

Core changes:

1. Module type filter (modules.php):

2. Added dropdown filter to show All/Users/Admins module types

   • Filter persists in navigation links

3. Modules now sorted by type (Admin=0, User=1) then alphabetically

   • Uses uksort with natural case-insensitive comparison
4. Added Bootstrap Icons for module type indication (tools/people-fill)
5. Added database status icons (bi-database-fill-gear, fill-dash, fill-add)
6. New/Deleted module notifications (modules.php):
7. Detect and display newly found modules not yet in config

8. Detect and notify about modules removed from filesystem

   • Automatically cleans up config for removed modules
9. Language constants (language/*.php):
10. Added _MODULES_NEW for new module detection messages

11. Added _MODULES_DELETED for removed module notification

    • Translations in all 6 languages (de, en, fr, pl, ru, uk)

Benefits:

• Easier module management with type-based filtering
• Instant visibility of filesystem changes via notifications
• Better visual distinction between admin and user modules

Added development tooling configuration and testing documentation.

Core changes:

1. PHP CS Fixer configuration (.php-cs-fixer.dist.php):
2. Code style rules for automated formatting
3. PSR-12 compatible configuration
4. Test documentation (docs/TESTS.md):
5. PHPUnit testing guidelines
6. Test structure documentation

Benefits:

• Consistent code formatting across project
• Clear testing guidelines for contributors

Move module configuration/visibility to config-based sources and update admin permissions to use module names, aligning admin assets/tests with the current module layout.

Core changes:

1. Module config & access (core/system.php, core/user.php, index.php, admin/modules/*.php, setup/index.php):

2. Switch runtime module state to config modules

   • Use $confmd instead of _modules reads
   • Migrate admin module lists to name-based storage
3. Update admin screens and block listing to use config modules
4. Module/admin structure & assets (modules/, admin/info/, templates/admin/basic-changelog.html):
5. Refresh admin info pages and module admin layouts
6. Reorganize rss/sitemap/account/changelog admin assets
7. Tests (tests/ModuleStructureTest.php):
8. Drop obsolete links.php requirement

Benefits:

• Consistent, file-based module configuration
• Admin permissions now human-readable and stable
• Tests reflect current admin structure

Technical notes:

• config/modules.php is the single source of module metadata
• admins.modules stores module names
• No runtime dependency on _modules (migration in setup only)