ToDo R5.5

For issues regarding Unicode please look in our R6.0 ToDo list.

R 5.5

Roadmap
ChangeLog

Main Focus: HTML5 support, security related features

HTTP Strict Transport Security (HSTS)
Content-Security-Policy
Cookies, CSRF sectoken
https://www.owasp.org/index.ph[...]tication_Cheat_Sheet

1. PHP

1.1. PHP 7.4

https://www.php.net/manual/en/migration74.php

2. MariaDB / MySQL type casting

https://dev.mysql.com/doc/refm[...]type-conversion.html
https://stackoverflow.com/ques[...]d-backticks-in-mysql

whOOt https://dev.mysql.com/doc/refm[...]ent-programming.html

3. Features

normalize links to other language versions of a page
- add table: lang_link[page_id, lang, target_id]
add debug option to send error log into separate file + rotate logs
add IP block to ban bad actors, bots

4. M17

open issues (add)

relative linking seems not working for ((../ back to parent page)), it links to root level (?!)
add delimiter before page handler (_properties)
1. min_href()
2. router.conf
3. abandon standard_handlers (?)
Guide to build templates
Permalink to page vs page version
CSS does not get routed in RECOVERY_MODE
save failed $_POST data for reuse after forced logout or autologin
relative time
1. global / user setting
2. where to use relative time and where not
3. different schemes
invalidate SQL and page cache (with common function) (?), which is also checking against config settings
add also footer after hard return, GUI consistency
how to check access privileges for a group, e.g. has_access() for $ -> moderate handler : locking
upload of file without extension -> broken
allow only common reasonable extensions for upload
1. blacklist MIME types -> implement
2. blacklist extension -> update
3. white list
add notification for
1. new page -> Admin, Moderator, parent page owner
2. new attachments
  1. -> to page: watchers, Admin, Moderator
  2. -> global: Admin, Moderator
add default max value in actions: news, blog, files, etc. -> use list_count as default
empty body_r after page rename/relocation -> page needs re-rendering
installer: rewrite_mode option ! – dysfunctional
redirect hashid url?
allow multi logins (on/off)
1. add multi login warning: 'Jemand hat sich bereits an diesem Konto angemeldet'
2. This account is currently being used in 1 other location at this IP ().
add access throttling feature
- limit the number of page requests by a single IP address within a given time interval
add array for 'default' AND 'user' menu so both can used independently (create/edit menu sets)
rewrite_mode setting in AP is pointless if it is overwritten in Setting class

5. Fix

invalidate / purge only a sub set of the SQL cache (?), do we always need to purge the entire cache?
check formatting of log() function -> html / wacko formatting
use common list count setting per user + use it as default in lists for paging
check for avoidable SQL roundtrip queries
1. e.g. translit: href() -> mini_href() -> slim_url() -> translit() ($this->config['multilanguage'] == true) -> load_page()
2. fix additional round trips gaining page_id in combination with has_access() and link() function (tag <-> page_id)
  1. options: use object cache or pass variable page_id via link() function:
    - // cache page_id for for has_access validation in link function
    - $this->page_id_cache[$page['tag']] = $page['page_id'];
  2. part 1: revision:f5f2295a85b9
3. add object for extending and array with default pages (accessible via theme) to preload_link() function
  1. -> ensure pre caching to avoid single lookup per intralink in DB on each page call
  2. -> ~~parse also page path for bread crumbs in page_link table~~
link() -> default: $anchor_link – should only active inside page_body (?)
- additional check if its better to prefix the id="doc.deutsch.konfiguration"
  - to avoid unintentional mix with CSS settings
- set anchor id only where needed, minimizes also size of attributes
add option help to action to show all parameters in a info box
1. echo 'show all available parameters with description'
broken list in tree action if levels changes not in order – e.g. depth 1.2 -> depth 2.4
1. show missing levels
search?phrase="sourceforge.net" -> paging fails with "term to search"
bug: news action takes all subpages – is this desired?
improve search (open since ages), add some measures to improve relevance (time, size, user, filter, ...) and provide more and better meta data for search results
~~add options to show/hide page related categories at the page bottom~~
- themes may overwrite these settings via $this->config['footer_tags'] = OFF
- allways ON as default for posts in the forum cluster
- do we need an additional option for the user?
get translation
1. put lang-strings for action and handlers into separate dynamically loadable lang-files
2. cache
audit comments, moderation handler
replace p tag in toc action -> avoid wrong p in p
Form in preview breaks Edit / Preview form -> produces nested form -> filter?
revisit access right settings for forum posts and menu access
1. the menu won't show the page properties icon -> annoying
syntax
1. table header
  - /Dev/NewFeatures/SyntaxForTableHeader
  - add check button to WikiEdit for table headers
  - match syntax so it is possible to set TH per cell and not only per row
implement rating hack (but without mandatory JS)
1. https://www.youtube.com/watch?v=orPVEAipz2A
add unique log message key to filter events (messages may differ)
use deleted field to mark deleted pages, comments, files
- basics implemented for page and files
- open: rollback/restore procedure and handling of final deletion
disable global upload for users
1. only local
2. only for cluster
add regex for this->config['users_page']/[*]/
- Yet the engine does not validate the namespace for the user cluster, so that nobody can create a page under /User except his own [UserName]
- Then we can disallow random pages for the first level in the users cluster except the own [UserName].
- The register action creates this page usually for the user.

6. Notifications

Notifications

6.1. Notice digest

store events notices and compile digest for user [user|moderator|admin]
- new user
- comments
- files
- changes

7. Handler

clone entire cluster is only available for Admins atm., it should also available for ...
improve global upload settings
1. allow groups
2. set individual rights (only images, quota, etc. for a user, group)
send page as email (like print)
show: add option 'Flag as Spam/Inappropriate'
show: Delayed Indexing delay_index
- <meta name=“robots” content=“noindex,nofollow”>
see upload subpage
1. upload: check if the MIME type of the uploaded file matches the file extension
2. upload: add form field to chose another file name (?)
3. upload: add accept attribute depending on config settings https://www.w3.org/TR/html5/fo[...]ml#attr-input-accept
4. ~~upload: send a notify mail on upload~~ DONE
add meta handler namespace ['page', 'account', 'file', 'service']
- This is the simplest way to standardize document locations and for the language-independent single instances of service pages, like login. Next step is the separated cluster for those pages, linked with prefix, for example, ((service:login)).
- this can be easily done with the new URI router
- handler/account/
file: apply access restrictions for global files if Wiki is closed -> $
1. add and enforce global Wiki mode, minimum access rights
2. route global files only for registered users

8. Action

template toc and tree

9. Formatter

Search Highlighter
(/Users/WikiAdmin UserSpace | WikiAdmin)) -fails on |

<# #> adds  on first and  on second appearance of double quote like class=""

caused by race condition in wacko_preprocess()

<#<div class="" style="background:transparent; border:.1em solid #F66; border-left:1em solid #F66; box-sizing:border-box; margin:.5em 0; overflow:hidden; padding:.5em; text-align:left; width:auto;">Unter den Btrfs-spezifischen Anpassungen (1, 2) waren einige, die Latenz- und Stabilitäts-Probleme beseitigen, die bei knapp werdendem Speicherplatz auftreten können.</div>#>
2
<#<div class="" style="background:transparent; border:.1em solid #fcfce9; border-left:1em solid #fcfce9; box-sizing:border-box; margin:.5em 0; overflow:hidden; padding:.5em; text-align:left; width:auto;">Unter den Btrfs-spezifischen Anpassungen (1, 2) waren einige, die Latenz- und Stabilitäts-Probleme beseitigen, die bei knapp werdendem Speicherplatz auftreten können.</div>#>

<!--notypo--><div class="<!--notypo--> style="background:transparent; border:.1em solid #F66; border-left:1em solid #F66; box-sizing:border-box; margin:.5em 0; overflow:hidden; padding:.5em; text-align:left; width:auto;">Unter den Btrfs-spezifischen Anpassungen (1, 2) waren einige, die Latenz- und Stabilitäts-Probleme beseitigen, die bei knapp werdendem Speicherplatz auftreten können.</div>#><br />2<br /><#<div class=<!--/notypo-->" style="background:transparent; border:.1em solid #fcfce9; border-left:1em solid #fcfce9; box-sizing:border-box; margin:.5em 0; overflow:hidden; padding:.5em; text-align:left; width:auto;">Unter den Btrfs-spezifischen Anpassungen (1, 2) waren einige, die Latenz- und Stabilitäts-Probleme beseitigen, die bei knapp werdendem Speicherplatz auftreten können.</div><!--/notypo--><br />

Wacko is spamming BRs, in between everything
add option to hide protected links
- You must login to see this link. Register now, if you have no user account yet.
Error: Bad value 4 for attribute type on element ol.
1. see $new_indent_type in wackoformatter -> error prone
  - ```
    1. hallo
      5. should not take the number but 1, same for i, I, a, A
```
2. Block elements inside inline elements
3. http://www.w3.org/TR/html5/gro[...]nt.html#attr-ol-type
allow case insensitive matching of file links, e.g. File:image.jpg
breaks quote
```
<[http://www.example.com]>
```
((image.jpg)) shows images from image/ folder ???
<[ ]> eats blank line in quote, undesired
broken nested quote
- ```
<[block
<[nested quote]>
quote
]>
```

10. Template Engine

~~Templatest deliberately eats all line breaks~~ see WORKAROUND
- textarea issues <textarea>[ ' body ' ]</textarea>
  1. multi-line
  2. auto-indent
- edit, comment, permission, caption, ...
~~write templates.tpl for remaining actions and handlers where suitable~~ DONE
1. toc
2. tree

11. Admin Panel

add Check for Updates button in Admin panel: /Download/VersionCheck?
Synchronizing data: update comment count for page if out of sync
Querying the RIPE Database: https://apps.db.ripe.net/db-web-ui/#/query
1. https://rest.db.ripe.net/search.json?query-string=
2. user approval
3. event log
4. Bad Behavior

upload module

PAY ATTENTION TO SECURITY RISKS
 

Before adding random file/MIME types: please think about possible security issues.

For example HTML (.htm, .html), JavaScript (.js) and PHP (.php) file are types you’d better avoid as they can be “executed” on your server where you really would not want that to happen. For most of these kind of files, this should not be a problem though as these files are better off being compressed into a ZIP file anyway.

Only add file types that you REALLY need and that you are comfortable with.

user management
- deactivate / delete inactive users
  - criteria
  - actions
add module to filter, moderate and manage pages, comments, (files)
1. see modules for content like pages
recovery mode: CSS and images won't load
- index.php: (!$db->ap_mode && RECOVERY_MODE) excludes static files!
  - !$db->ap_mode
purge logs (TRUNCATE)
1. log table
2. referrers
3. badbehavior

use collgroup for col span % width

<colgroup>
  <col span="1" style="width: 10%;">
  <col span="1" style="width: 5%;">
  <col span="1" style="width: 5%;">
  <col span="1" style="width: 45%;">
  <col span="1" style="width: 15%;">
  <col span="1" style="width: 10%;">
  <col span="1" style="width: 10%;">
</colgroup>

 <thead class="data-head">
        <tr class="">
        </tr>
        [...]
    </thead>

<tbody id="table-section-one">
[...]
</tbody>

<tbody id="table-section-two">
[...]
</tbody>

12. Database

12.1. Check for SQL STRICT mode violations

Using GROUP BY and selecting an ambiguous column
Inserting the non standard zero date into a datetime column
Inserting a 20 character string into a 10 character column
Division by zero
Inserting a negative value into an unsigned column

so far

#1406 – Data too long for column 'description' at row 1
1. set HTML maxlength="DB_FIELDSIZE" for all (VAR)CHAR form field
  - suggested (JS hint – might differ in some cases – smaller, e.g. meta description 160, meta title 60) + database field size (mandatory enforcement)
  - JS hint: You have <strong>60</strong> characters left
2. set PHP length check before passing to INPUT / UPDATE
#1055 – 'dev.g.group_name' isn't in GROUP BY

SELECT
`DIGEST_TEXT` AS `query`,
`SCHEMA_NAME` AS `db`,
`COUNT_STAR` AS `exec_count`,
`SUM_ERRORS` AS `errors`,
(ifnull((`SUM_ERRORS` / nullif(`COUNT_STAR`,0)),0) * 100) AS `error_pct`,
`SUM_WARNINGS` AS `warnings`,
(ifnull((`SUM_WARNINGS` / nullif(`COUNT_STAR`,0)),0) * 100) AS `warning_pct`,
`FIRST_SEEN` AS `first_seen`,
`LAST_SEEN` AS `last_seen`,
`DIGEST` AS `digest`
FROM
 performance_schema.events_statements_summary_by_digest
WHERE
((`SUM_ERRORS` > 0) OR (`SUM_WARNINGS` > 0))
ORDER BY
 `SUM_ERRORS` DESC,
 `SUM_WARNINGS` DESC;

13. WikiEdit

use only one popup for new link, having link and link description together
popup for tables

1. select rows and columns

set table header
select color for text and highlighting
resize textarea
undo / redo
JavaScript search&replace
symbols

14. Usability issues

~~indicate page [language|permissions]~~
1. permissions: use icon and different colors
add double-click support for editing comments
When should I use a select box instead of radio buttons?
1. https://www.nngroup.com/articl[...]es-vs-radio-buttons/
Not indicating an active form field
- e.g.
```
textarea:focus {
    border: 1px solid red; }
```
- You can use the ‘:focus’ selector on lots of elements, but it’s super handy when used on inputs and textareas to indicate that the field is active. Add CSS styling such as a highlighted border, or a subtle change to the background color.
forms with checkboxes and options in lists
- e.g. ~~category handler~~ or users in admin panel
- assignment of form buttons
usage of new page handler
- seen in many fresh installs, users adding sub pages to HomePage/subpage
  - this is possible but is it really desired and understood, should we filter out system pages as pre-provided cluster in the /new [page] handler?
make name spaces for users and groups more intuitive accessible
1. users/nickname/userspace/..
2. groups/usability/groupspace/..
add ability to easily create groups and to add group members
1. suggestions?
GUI inconsistencies
1. handler
2. actions
3. message boxes
Your session has timed out. Please sign in again.

Readings

15. Extensions

https://github.com/google/code-prettify

16. Refactoring

https://www.owasp.org/index.php/Logging_Cheat_Sheet

17. Staging Area

blog action (will replace news action)
snippet action
forum, topics action
Admin Panel
1. refactor -> antipatterns
2. bad behaviour module
3. list and check each module, assign status
moderate handler -> quite a mess
poll actions -> quite a mess

18. Ideas

spam / badword handling -> bad_words($text) function
1. https://en.wikipedia.org/wiki/Wordfilter
2. https://stackoverflow.com/ques[...]ood-profanity-filter
3. What you need is a good way for users to flag inappropriate content and a mechanism to deal with it swiftly. One way is to automatically hide/remove content if it's been flagged more than X times.
rel="edit" -> https://tools.ietf.org/html/rfc686
enforce ACL-Policy, e.g. set read to $, user can't overwrite the setting
test PHPThumb alternatives
1. https://github.com/mosbth/cimage
Composer
https://github.com/openpgpjs/openpgpjs
https://highlightjs.org/
https://www.w3.org/TR/css3-page/
1. https://www.smashingmagazine.c[...]-for-print-with-css/

19. Themes

new mobile ready theme / layout? -> on hold (we got a new template engine!)
- https://getbootstrap.com/
- https://getbootstrap.com/docs/[...]tarted/introduction/
https://developers.google.com/web/fundamentals/
https://www.w3.org/Style/Examples/007/leaders

Flexbox vs Grid

Flexbox: content dictates layout
Grid: container dictates layout (to some extent)

Flexbox is great, it just isn't the best thing for overall page layouts.
Flexbox and grid play well together, and are a huge step forward from the float & table hacks they replace. The sooner we can use them both in production, the better.

CSS Varibles

CSS colums for index <div class="gimme-columns"><ul>

 
.gimme-columns {
	columns: 20em 3;
	column-count: 3;
	column-width: 20em;
}

.sticky {
  position: sticky;
  top: 0;
}

default theme

change blockquote
- box-shadow: 0 0 6px rgba(0, 0, 0, 0.5);
add option to hide $this->config['site_name'] in theme header, e.g.: WackoWiki: To Do R5.5 -> To Do R5.5
min-height: 200px for .article, #page

19.1. Favicon

Supported Formats

ico -> type="image/x-icon" ->
png -> type="image/png" -> http://caniuse.com/link-icon-png
gif -> type="image/gif" ->
svg -> type="image/svg+xml" -> http://caniuse.com/link-icon-svg

Dimensions

16×16
32×32
48×48
64×64

20. Documentation

add documentation for Admin Panel
backup and restore
Update / foster Core Documentation for
1. Deutsch
2. English
3. Français
4. Русский
  - https://www.pgpru.com/proekt/wiki – well made
  - https://www.pgpru.com/comment78727 – Markup Rules for nerds
blog action -> Blogging with WackoWiki
where and when you should use relative or absolute addressing (include action, files, actions with page parameter)
how you use the include function (pages, comments)
release notes
1. add a New & Noteworthy section / sub page to raise visibility of 'hidden' features
moderate handler
message functions and usage
add sub page to config documentation about CSP
Video Tutorials
update screen shots

21. Feedback

themes
migration and encoding issues
frequent annoying issues
unsolved questions
add rfc section in dev cluster
add dev activity log
Nginx configuration (rewrite rules)

22. Testing

Tools
https://github.com/mozilla/readability – test with firefox reading mode
/Forum/Discussion/UserPasswordReset -> solution paths

22.1. Test cases

-> Test cases

22.2. Debug

Content Security Policy: Die Einstellungen der Seite haben das Laden einer Ressource auf self blockiert ("script-src http://localhost 'unsafe-inline'").
- call to eval() or related function blocked by CSP: autocomplete.js (Line 253)