История коммитов

The language button of the panel opened the dialog of the language module of the site through a copy of its modal script, and the copy posted for the dialog without a token: the panel got 403 and an endless spinner. It also broke with the language module switched off.

The button opens a dropdown of the languages on offer instead, each a link with ?setlng=, which the core reads on any page: no module of the site, no request behind the scenes, no script needed. language-menu.js keeps the rest of the query of the page and takes setlng out of the address afterwards. The copy of modals.js and the empty ajax modal of the admin layouts are removed.

The top bar named the current language as lng_list[locale], and a locale missing from the list took the whole page of the panel down with it. The bare configuration of the repository is such a case — Russian the default, English the only language offered — and CI runs on it: the language page and the cookie banner failed there while passing on a site whose list holds every language. The top bar falls back to the code of the language, as the menu of the site already does, and the two tests set the languages they rely on instead of taking them from the machine.

The whois page opened port 43 to four registries in turn: over ten seconds a lookup with no limit on reading an answer, the answers of registries the address does not belong to printed in full, nothing at all where the hosting closes the port, and hardcoded English. RdapIpRegistry asks the one registry the address belongs to, found by the bootstrap files of IANA kept for a week and by rdap.org without them, over HTTPS with a limit of eight seconds.

The page shows a card of the network, its range, holder, country, abuse contact and dates, with the full answer a link away and the members seen with the address a button away, and says why when there is nothing to show. It moves to the Users section next to the search by IP; the Security section, left empty, is gone.

The ban by IP knew IPv4 only: a visitor on IPv6 is read as 127.0.0.1, so he passed any ban, and banning that address would have shut out every IPv6 visitor at once. An address is shared by whole mobile networks and changed by a VPN in seconds, the registration ban was never implemented, and the check cost a query on every request.

The check in the bootstrap, the /admin/ip-bans pages and everything behind them are removed, and a migration drops cms_ban_ip. Accounts are stopped by their ban, floods by the antiflood; addresses are better blocked before PHP. The changelog tells of this and of the file integrity check removed before it.

The Anti-Spyware page compared the CRC of script files with a snapshot kept in the cache. It reported only files that were in the snapshot and changed, so a new file — the usual web shell — passed as all consistent; it counted the compiled cache of data/ as changes, skipped vendor/ and public/index.php, and its snapshot was cleared with the cache and writable by whoever changed the files. A check that gives a false all-clear is worse than none, so the page, its routes, use cases and scanner are removed.

The keys of GitHub, Google, VK and Yandex are settings of external services like the captcha, not a matter of security. The page is the Sign-in services tab of the settings now, /admin/settings/sign-in; /admin/auth/providers and the item of the Security section are gone.

It is laid out like the captcha: a card for each service switched on in its head, with a badge for one without its keys, a warning when a service is on but its button is not shown, the members without another way in counted without a plural to agree, and the callback address with a button to copy it (copy-button.js, for any data-copy). The class of the framed card is shared by both tabs as admin-provider-card.

auth:migrate-legacy-access and auth:drop-legacy-columns are no longer tasks of the maintenance screen: before the transfer no member of staff has a role to open the panel with, so the buttons could not be reached when they were needed. The commands stay in the console, and the group of one-time tasks goes with them.

The one-time steps of a site coming from 9.9 stood among the everyday tasks in alphabetical order. #[AsAdminTask] takes a group (AdminTaskGroup: routine, update, migration) and an order within it, and the maintenance screen shows a card per group with a line on when to run its tasks: the routine ones at any time, the ones after an update in turn from the database on, and the migration from 9.9 in its order, framed apart.

A task is titled and described in English in its #[AsAdminTask] attribute, which the gettext scanner never sees, so the maintenance screen showed them untranslated. i18n:scan now collects them too (AdminTaskScanner) into the domain the attribute names, system unless it says otherwise, and the screen looks them up in that domain. The Russian translations of the tasks of the system are added.

Each task was a card of its own with a solid button. They are rows of one list now: the title, the description, the command, the status and the time of the last run, an outlined button on the right, and the output of the last run folded under the row in the colours of the theme. The note about the scheduler is a line under the list, shown when there are background tasks.