WackoWiki v6.3.0 — Major Feature Release

This release represents a massive architectural overhaul, bringing modern JavaScript tooling, a completely rewritten editor experience, hardened security defaults, and a flexible new syntax highlighter.

Headline Features

WikiEdit: Complete Rewrite (ES2023 + ES Modules)

The editor has been modularized into ES6 modules with a dedicated state management layer and a AbortController for all fetch calls.

Dev Note: Complex legacy helpers (MarkUp, _LSum, _RSum, _TSum) have been refactored. Autocomplete selection bugs are fixed.

Security & Platform Hardening

• Content Security Policy (CSP) Nonces: All inline scripts now use strict nonces.
• Cookie Prefixes (RFC 6265bis): __Host- and __Secure- prefixes applied for session integrity.
• Native Clipboard API: Removed Clipboard.js dependency; uses modern navigator.clipboard with robust fallback.
• Fixed Invalid Selector Tokens: Patched potential broken "Copy to Clipboard" handlers.

Core Architecture & Routing

UI & Theming

• Dark Mode: First-class support with OS detection (prefers-color-scheme) and manual toggle.
• Double-Click Edit Comments: Rapid inline editing for comment sections.

Syntax & Markup Extensions

Phiki Highlighter (v2.2.0)

Replaces the legacy Pear highlighter. Fast, modern, supports 350+ languages via TextMate grammars.

Migration Required: Obsolete highlighters removed (css, ini, html, java, pascal, sql).
Action: Run the admin_replace action to auto-migrate:

%%(css)   →  %%(hl css) %%(sql)   →  %%(hl sql) ... etc 

Table Markup Improvements

New attribute system for rows, cells, and tables.

New Syntax:

!| col | col |!            # Header row with attributes #|(attr=value)             # Row attributes 

Supported Attributes:

CSS Selectors Added:

• .alternate — Zebra striping
• .sticky — Fixed header on scroll
• .default[left|center|right|top|middle|bottom] — Global cell alignment
• .colN[...] — Column N alignment (1–25)
• .col-N[...] — Column N from right alignment (1–9)

Helper Functions

• New table_attr() parser for the extended markup.
• Wrapper page now accepts col option.

Internationalization (i18n)

New complete translations added:

• 🇭🇷 Croatian (hr)
• 🇹🇭 Thai (th)
• 🇹🇷 Turkish (tr)
• 🇻🇳 Vietnamese (vi)

Dependency Updates

Upgrade Guide

1. Run Composer: composer install --no-dev (populates vendor/).
2. Run Migrations: Execute the installer script.
3. Migrate Highlighters: Run the admin_replace action to convert %%(lang) → %%(hl lang).
4. Check Routes: If you have custom handlers or pages named edit, show, properties, etc., verify they resolve correctly under the new page/_* namespace.
5. Clear Cache: Delete cache/config/ and cache/template/ (or run admincache action).
6. Test CSP: Verify your web server passes the Content-Security-Policy header with nonces.

Credits

Huge thanks to contributors for the Phiki integration, the translation teams for HR/TH/TR/VI, and everyone testing the WikiEdit rewrite.

Full Changelog: 6.2.1...6.3.0
Documentation: wackowiki.org

Minor feature and bug fix release for 6.2.x series

• extend table markup allowing table caption, cell spans, width and cell attributes
  • ?| table caption |?
  • ^| header | cell ||
  • || cell ^ header ||
  • ||(attr=value) cell | cell ||
  • attributes:
    • align = [center|left|right|justify]
    • bgcolor = [blue|red|green|x11colors]
    • colspan = number
    • id = id_name
    • rowspan = number
    • scope = [row|col|rowgroup|colgroup]
    • valign = [top|middle|bottom]
    • width = number[px|%|em|rem]
• allows now [px|%|em|rem] with wrapper_width
• change markup syntax for subscript to ,,subscript,,
• make sess->date_pattern dependent on $this->user_lang
• x11colors.css
  • replace .mark-[blue|green|red] with [xblue|xgreen|xred] to not overwrite default definitions in wacko.css
• miscellaneous minor fixes
• Libs
  • PHPMailer 7.0.2

Full Changelog: 6.2.0...6.2.1

Major feature release

• SQLite support
  • add DbSqlite class
  • add backup & restore in admin panel for SQLite
  • rewrote SQL queries to work with MySQL as well as SQLite
  • register custom regexp function to use REGEXP with SQLite
  • add functions to abstract SQL syntax and function differences between MySQL and SQLite
    • utc_dt()
    • date_sub(int $value, string $interval)
    • binary()
    • collate()
    • limit()
• fix missing route case for CSS files in RECOVERY_MODE
• validates the namespace to prevent users from creating inaccessible pages when mode_rewrite is enabled
• add binary string search action (see community folder)
  • adds exact or regex search for registered users
• installer
  • add SQLite table creation script
  • add _t() function for $lang[] array
    • installer uses now English as fallback for missing message sets
  • add mandatory installer password protection
    • It is imperative to set the password for the installer in the config/lock_setup file.
  • add new system page with whatsnew action
  • add private system page with with the admincache and admin_recovery action and set it as bookmark for the admin
  • the installer sets now bookmarks for the admin account, therefore it no longer shows the default bookmarks for the admin in the menu by default
• actions
  • menu: fix not showing 'Set a bookmark' form
  • whatsnew:
    • add filter for pages, comments and files
    • show also edited comments in list
  • no longer use link table for mostcommented and mostpopular action
• miscellaneous minor fixes
• WikiEdit
  • replace var with const and let
• update libs
  • php-diff 2.5.0
  • PHPMailer 7.0.1
  • PHP Thumb Library 2.3.3
  • SimplePie 1.9.0

Full Changelog: 6.1.29...6.2.0

Minor feature and bug fix release for 6.1.x series

• removed deprecated Pragma: no-cache and Expires: header
• fixes If-Modified-Since conditional requests issues
• fixes invalid ETag
• fixes various Cache-Control header issues
• fixes missing height width value for external img links
• adds option to transliterate filenames to lowercase
• adds navigation action
• adds option to set the SameSite attribute , see constants.php
• adds option login_notice to hide recurring 'Welcome back' notice
• adds full words highlight mode
• miscellaneous minor fixes
• update libs
  • PHPMailer 6.9.1
  • svg sanitizer 0.18

Full Changelog: 6.1.24...6.1.25

Minor feature and bug fix release for 6.1.x series

• adds file_meta for file_cache
• uses :focus-within pseudo selector for dropdown
• adds CSS class btn-sm and btn-md
• English message sets fixes
• initial language files for Tamil
• re-check for anonymous user before storing cache
  • soft_login() may set sess->user_profile
• removes redundant setlocale() call
• adds db_vendor to primary config
• installer auto-detects db_vendor
  • either mariadb or mysql
  • uses server SQL mode for installer by default
  • in debug mode the db_vendor can be selected in the db config page along with the SQL mode
  • mainly to solve SQL mode incompatibilities between MariaDB and MySQL
• renames sql_mode_strict to sql_mode
  • 0 - server (default)
  • 1 - session lax
  • 2 - session strict
• fixes not showing read ACL $ pages in the default menu for logged in users with no own bookmarks defined
• miscellaneous minor fixes
• update libs
  • svg sanitizer 0.19
  • PhpThumb 2.3.1

Full Changelog: 6.1.25...6.1.26

add CSS class text-secondary

int casting for $user['dark_mode']

re-add autocomplete entry for add_comment heartbeat

Modernize autocomplete & session heartbeat This commit replaces the fragile `~~~`-delimited text protocol with a proper JSON API, consolidates the handler into a single optimized endpoint, and integrates autocomplete as a standard WikiEdit feature module loaded via main.js. Backend (src/handler/page/_autocomplete.php) - Single UNION query replaces two separate LIKE queries + PHP merge - Removed ancient `escape()`/`%uXXXX` decoding (client sends UTF-8) - Heartbeat (`?_autocomplete=1` only) and autocomplete (`q`+`ta_id`) share endpoint - JSON response: {ta_id, best_match, suggestions[]} Frontend (src/js/editor/features/autocomplete.js – new module) - fetch/AbortController, debounced requests, proper error handling - Lazy dropdown attachment fixes race condition on first response - Keyboard navigation (ArrowUp/Down, Enter, Escape, Ctrl+Space) - Accessible markup (role=listbox, aria-selected, aria-label) - Clean destroy() for WikiEdit lifecycle Session Heartbeat (src/js/editor/features/session-heartbeat.js) - Uses same endpoint, validates JSON `{ok:true}` response - Keeps simple 3-strike warning with draft-save UI (unchanged behavior) Integration (src/js/main.js, src/js/editor/wikiedit.js) - Autocomplete loaded unconditionally via main.js (like live-preview) - Feature flag `data-autocomplete` on textarea controls activation - Instance created BEFORE toolbar build so button renders in initial DOM - `_protoBuildToolbar` attaches dropdown synchronously post-render Template & Handler (src/handler/page/edit.php, edit.tpl, _header.tpl) - Removed inline `<script>` import and conditional script tag - Added `data-autocomplete` attribute driven by user setting - edit.php unchanged – still includes _autocomplete.php for AJAX Removed legacy cruft - `~~~` text parsing, double-query pattern - Ancient JS `escape()` decoder in PHP - Duplicate ACL SQL logic

refactor: add robust lifecycle management - core/init-diag.js * Release the debug‑console popup reference (`window._debugConsole`) and disconnect the MutationObserver on `beforeunload` so the popup and observer can be GC‑ed. - editor/editor-state.js * Implement `EditorState.destroy()` that unsubscribes every listener returned by `subscribe()` and clears internal data. - editor/wikiedit.js * Initialise `this._cleanup = []` in the constructor (guaranteed existence even if a feature throws). * `destroy()` now runs all registered clean‑ups, tears down `EditorState`, `AutoComplete`, removes global refs (`window.weSave`, `textarea.wikiEditInstance`), detaches textarea listeners, clears undo/redo stacks and timers, and calls `super.destroy()` when available. - editor/autocomplete.js * Declare all private handlers (`#handleDropdownClick`, `#handleDropdownMouseover`, `#onButtonClick`, `#onResetClick`) and keep bound references for reliable `addEventListener` / `removeEventListener`. * Add `destroy()` that cancels the debounce timer, aborts in‑flight fetches, removes every DOM listener, and nulls private DOM references. - components/upload.js * Refactor per‑form initialisation into a factory returning a `destroyUpload()` closure that removes all drag‑drop, paste, click listeners and any injected summary UI. The destroy function is stored on the form (`form._destroyUpload`) for SPA unmount handling. - editor/toolbar/toolbar-customizer.js * Auto‑close the toolbar‑customizer modal on `beforeunload` to avoid leaked dialog nodes and listeners. Overall these changes eliminate reference cycles, guarantee cleanup on page unload or SPA navigation.