To Do R5.5

R 5.5

dev repo []
Team Sessions

Main Focus: basic HTML5 support, address security related features

  1. HTTP Strict Transport Security (HSTS)
  2. Content-Security-Policy 2
  3. Cookies, CSRF sectoken


  1. Strict-Transport-Security HTTP Response Header
    • Instructs the browser to always request a domain using the HTTPS protocol instead of HTTP.
  2. Content-Security-Policy (CSP)
    • HTTP Response header, allows server to control how resources are loaded.

1. Security Headers

  1. foster http_security_headers() implementation
  2. abandon vendor prefixes -> Content-Security-Policy (Suggestion: avoid prefixed implementations)
    1. Content-Security-Policy:
       default-src 'self';
       script-src 'self' 'unsafe-eval';
       style-src 'self';
       connect-src 'self';
       media-src 'self';
       object-src 'self';
       child-src 'self'
    2. Content-Security-Policy:
       default-src 'self';
       script-src 'self' 'unsafe-inline';
       style-src 'self' 'unsafe-inline';
       img-src *;
      • replace inline scripts

1.1. Replace inline JavaScript

Unobtrusive JavaScript
How to Use HTML5 Data Attributes

CSP uses 'unsafe-inline' or data: inside script-src.

Replace inline JavaScript


  1. <script>var dbclick = "page";</script>[..]d-vs-document-onload

//'Getting' data-attributes using dataset 
var showhandler = document.getElementById('showhandler');
var dbclick = showhandler.dataset.dbclick1; // dbclick = 'page';

2. Refactoring inline code

2.1. Unsigned JavaScript code placed inline

By default CSP disables any unsigned JavaScript code placed inline in the HTML source, such as this:

<script>var foo = "314"<script>

The inline code can be enabled by specifying its SHA256 hash in the CSP header:

Content-Security-Policy: script-src 'sha256-gPMJwWBMWDx0Cm7ZygJKZIU2vZpiYvzUQjl5Rh37hKs='

This particular script's hash can be calculated using the following command:

echo -n 'var foo = "314"' | openssl sha256 -binary | openssl base64

Some browsers (e.g. Chrome) will also display the hash of the script in JavaScript console warning when blocking an unsigned script.

The inline code can be also simply moved to a separate JavaScript file:

<script>var foo = "314"<script>


<script src="app.js"></script>

with `app.js` containing the `var foo = "314"` code.

2.2. Inline event handlers

The inline code restriction also applies to inline event handlers, so that the following construct will be blocked under CSP:

<button id="button1" onclick="doSomething()">

This should be replaced by `addEventListener' calls:

document.getElementById("button1").addEventListener('click', doSomething);

Variable assignment in inline scripts. Rather than do this:

<script>var foo = "314";<script>

Leverage HTML5's custom data attributes by setting the value as follows:

<body data-foo="314”>

And access the value by doing:

var itemID = document.body.getAttribute("data-foo”);

3. SafeHTML / HTMLPurifier

  1. implement optional support for HTMLPurifier

4. HTML5 Migration

  1. update form attributes[..]ml#the-input-element
    1. placeholder=""
    2. placeholder="E-Mail-Adresse eingeben"
    3. autofocus

5. PHP

5.1. PHP 7.2


5.2. PHP 7.1

    • Deprecated: Function mcrypt_create_iv() is deprecated in wacko/class/ut.php on line 405
    • Warning: Cannot assign an empty string to a string offset

5.3. PHP 7.0

Null Coalescing Operator
$action = $_POST['action'] ?? 'default';
$user_name = $_GET['user_name'] ?? $_POST['user_name'] ?? 'nobody';

6. MariaDB / MySQL type casting[..]type-conversion.html[..]d-backticks-in-mysql


7. Features

  1. normalize links to other language versions of a page
    • add table: lang_link[page_id, lang, target_id]

8. RC3

open issues (add)

  1. add delimiter before page handler (_properties)
    1. min_href()
    2. router.conf
    3. abandon standard_handlers (?)
  2. guide to build templates -> parent file -> template
    1. how do templates work
    2. $tpl->naming
    3. how to process conditions
  3. save failed posts for reuse after forced logout or autologin
  4. route TLS-Proxy – not part of page name space
  5. route admin.php with mode_rewrite fails
  6. disable cache for message after forced logout: $http->no_cache();
  7. recognize audio and video files and use new html5 tags <audio> <video> using the link function
  8. relative time
    1. global / user setting
    2. where to use relative time and where not 
    3. different schemes
  9. invalidate SQL and page cache (with common function) (?), which is also checking against config settings
  10. add also footer after hard return, GUI consistency
  11. how to check access privileges for a group, e.g. has_access() for $ -> moderate handler : locking
  12. upload of file without extension -> broken
  13. allow only common reasonable extensions for upload
    1. blacklist MIME types -> implement
    2. blacklist extension -> update
    3. white list
  14. add notification for 
    1. new page -> Admin, Moderator, parent page owner
    2. new attachments
      1. -> to page: watchers, Admin, Moderator
      2. -> global: Admin, Moderator
  15. add default max value in actions: news, blog, files, etc. -> use list_count as default
  16. empty body_r after page rename/relocation -> page needs rerendering
  17. installer: CSS routing using subdomain?
  18. installer: rewrite_mode option ! – dysfunctional
  19. ->
    Not Found
    The requested URL /doc/Bugs/WackoWikiStart was not found on this server.
  20. redirect hashid url?
  21. double click in edit / write comment form field should not load edit page, user looses his already written content, ANNOYING
    1. additional user should get a warning like it is done for page edit: Do you really want leave .., you will lose your content
  22. delete / reset pages with missing language, e.g. 'mo', upgrade or AP routine
  23. allow multi logins (on/off)
    1. add multi login warning: 'Jemand hat sich bereits an diesem Konto angemeldet'
    2. This account is currently being used in 1 other location at this IP ().
  24. add access throttling feature
    • limit the number of page requests by a single IP address within a given time interval
  25. useful messages for regular users after logout
  26. revisions.xml handler adds falsely,
    1. </body></html>
    2. <!-- WackoWiki Caching Engine: page cached at 2017-05-21 07:41:20 -->
    3. and diag output
    4. see final.php
  27. load translation is loaded before resource for theme lang is set for theme_per_page, FIXED same issue for user theme
  28. add array for 'default' AND 'user' menu so both can used independently (create/edit menu sets)
  29. common header can't be reused for none template themes -> fix?
  30. rewrite_mode setting in AP is pointless if it is overwritten in Setting class
  31. wacko.all.php settings in themes were ignored! Fix?
    •  <?php
      // tabs theme options =========
      	$this->db->revisions_hide_cancel = 1;
      	$this->db->footer_inside = 0;
      // ============================
      $theme_translation = [
      	'EditIcon' => '<img src="' . $this->db->theme_url . 'icon/edit.png" alt="Edit included page" />',
      	'' => '',

Customizable Logo and Favicon

  1. Location
2. currently image/ folder
  1. chmod issue
  2. Options
    1. Favicon
      1. site_favicon
    2. Logo
      1. site_logo
      2. logo_width
      3. logo_height

9. Fix

  1. invalidate / purge only a sub set of the SQL cache (?), do we always need to purge the entire cache?
  2. check formatting of log() function -> html / wacko formatting
  3. file links were tracked only after a second rendering -> ?
  4. use common list count setting per user + use it as default in lists for paging
  5. check for avoidable SQL roundtrip queries
    1. e.g. translit: href() -> mini_href() -> slim_url() -> translit() ($this->config['multilanguage'] == true) -> load_page()
    2. fix additional round trips gaining page_id in combination with has_access() and link() function (tag <-> page_id)
      1. options: use object cache or pass variable page_id via link() function:
        • // cache page_id for for has_access validation in link function
        • $this->page_id_cache[$page['tag']] = $page['page_id'];
      2. part 1: revision:f5f2295a85b9
    3. add object for extending and array with default pages (accessible via theme) to preload_link() function
      1. -> ensure pre caching to avoid single lookup per intralink in DB on each page call
      2. -> parse also page path for bread crumbs in page_link table
  6. link() -> default: $anchor_link – should only active inside page_body (?)
    • additional check if its better to prefix the id="doc.deutsch.konfiguration"
      • to avoid unintentional mix with CSS settings
    • set anchor id only where needed, minimizes also size of attributes
  7. add option help to action to show all parameters in a info box 
    1. echo ''
  8. <#<kbd>F1</kbd>#> – add css class for kbd tag 
  9. broken list in tree action if levels changes not in order – e.g. depth 1.2 -> depth 2.4
    1. show missing levels
  10. add function to replace random isset($_GET|$_POST) ? .. : null
    1. filter_input # gets a specific external variable by name and optionally filters it 
  11. search?phrase="" -> paging fails with "term to search"
  12. bug: news action takes all subpages – is this desired?
  13. improve search (open since ages), add some measures to improve relevance (time, size, user, filter, ...) and provide more and better meta data for search results
  14. add options to show/hide page related categories at the page bottom
    • themes may overwrite these settings via $this->config['footer_tags'] = OFF
    • allways ON as default for posts in the forum cluster
    • do we need an additional option for the user?
  15. get translation
    1. put lang-strings for action and handlers into separate dynamically loadable lang-files
    2. cache
  16. audit comments, moderation handler
  17. better localization of "users" cluster
  18. replace p tag in toc action -> avoid wrong p in p 
  19. should we allow page names like chicken.egg, might conflict with other settings like tikiwiki formatter option
  20. review concept handling files per page file?get= -> performance, time, resources, necessity, alternatives
  21. Form in preview breaks Edit / Preview form -> produces nested form -> filter?
  22. revisit access right settings for forum posts and menu access
    1. the menu won't show the page properties icon -> annoying
  23. syntax
    1. table header
  24. implement rating hack (but without mandatory JS)
  25. add graphviz formatter to /community/formatter
  26. image action
    1. resize, cache
    2. using library
    3. store thumbnails in extra folder
      1. under files/ or _cache/ [..] thumbnails/
      2. global / per_page
  27. gallery action sharing functions with image action
  28. add a License / Standard Terms feature
    • page / file
  29. add unique log message key to filter events (messages may differ)
  30. use deleted field to mark deleted pages, comments, files
    • basics implemented for page and files
    • open: rollback/restore procedure and handling of final deletion
    • check how we do this for files alone and/or with related page (matrix)
    • WHERE clause from COUNT(*) queries
  31. add meta name= date and last-modified ?
  32. disable registration in default config / disable installer via ?setting? by default
  33. CSS: display: table; for layout-box class (?)
  34. disable global upload for users
    1. only local
    2. only for cluster
  35. TODO: wacko class -> function validate_reserved_words( $data )
  36. add regex for this->config['users_page']/[*]/
    • Yet the engine does not validate the namespace for the user cluster, so that nobody can create a page under /User except his own [UserName]
    • Then we can disallow random pages for the first level in the users cluster except the own [UserName].
    • The register action creates this page usually for the user.



10. Notifications

  1. email body and subject message encoding is pure shit in multi-language mode
    1. _t() function gives back html entities
    2. encoding setting seems chosen randomly (?)
  2. Notifications

10.1. Notice digest

  • store events notices and compile digest for user [user|moderator|admin]
    • new user
    • comments
    • files
    • changes

11. Installer

  1. installer: add missing form label fields
  2. mode_rewrite is OFF / not available
    • 'base_url' => '' ?
  3. colliding page names with multiple languages with the same name -> insert_page()
    1. creates only the first match, other page and menu creations will fail
    2. Solution: (A) UTF-8, (B) different page names, e.g. index, index
  4. legacy upgrade: SQL strict mode and missing default values -> HOTFIX: set default values manually via phpMyAdmin
    1. see table structure and select all rows with Default -> None
    2. chose change at the bottom and change Default -> None to As defined: and save
    3. repeat this for all related tables if necessary

12. Handler

  1. disallow white space in tags: new and moderate -> strip
preg_replace('/\s+/', '', $string);

  1. add rel="canonical" to show handler?
  2. review transliteration of file names in upload handler: white space, '-', '_'
  3. clone entire cluster is only available foe Admins atm., it should also available for ...
  4. improve global upload settings
    1. allow groups
    2. set individual rights (only images, quota, etc. for a user, group)
  5. send page as email (like print)
  6. show: add option 'Flag as Spam/Inappropriate'
  7. diff: show time, revision, user and change note for side A and B 
  8. show: Delayed Indexing delay_index
    • <meta name=“robots” content=“noindex,nofollow” />
  9. see upload subpage
    1. upload: check if the MIME type of the uploaded file matches the file extension
    2. upload: add form field to chose another file name (?)
    3. upload: add accept attribute depending on config settings[..]ml#attr-input-accept
    4. upload: send a notify mail on upload
  10. unify form label style, see filemeta, properties, account handler
    • make label secondary ->
  11. add service handler namespace ['page', 'service']
    • This is the simplest way to standardize document locations and for the language-independent single instances of service pages, like login. Next step is the separated cluster for those pages, linked with prefix, for example, ((service:login)).
  12. file: apply access restrictions for global files if Wiki is closed -> $
    1. add and enforce global Wiki mode, minimum access rights
    2. route global files only for registered users

13. Formatter

  1. (/Users/WikiAdmin UserSpace | WikiAdmin)) -fails on |
  2. <# #> adds <!--notypo--> on first and <!--/notypo--> on second appearance of double quote like class=""
    1. <#<div class="" style="background:transparent; border:.1em solid #F66; border-left:1em solid #F66; box-sizing:border-box; margin:.5em 0; overflow:hidden; padding:.5em; text-align:left; width:auto;">Unter den Btrfs-spezifischen Anpassungen (1, 2) waren einige, die Latenz- und Stabilitäts-Probleme beseitigen, die bei knapp werdendem Speicherplatz auftreten können.</div>#>
      <#<div class="" style="background:transparent; border:.1em solid #fcfce9; border-left:1em solid #fcfce9; box-sizing:border-box; margin:.5em 0; overflow:hidden; padding:.5em; text-align:left; width:auto;">Unter den Btrfs-spezifischen Anpassungen (1, 2) waren einige, die Latenz- und Stabilitäts-Probleme beseitigen, die bei knapp werdendem Speicherplatz auftreten können.</div>#>
    2. <!--notypo--><div class="<!--notypo--> style="background:transparent; border:.1em solid #F66; border-left:1em solid #F66; box-sizing:border-box; margin:.5em 0; overflow:hidden; padding:.5em; text-align:left; width:auto;">Unter den Btrfs-spezifischen Anpassungen (1, 2) waren einige, die Latenz- und Stabilitäts-Probleme beseitigen, die bei knapp werdendem Speicherplatz auftreten können.</div>#><br />2<br /><#<div class=<!--/notypo-->" style="background:transparent; border:.1em solid #fcfce9; border-left:1em solid #fcfce9; box-sizing:border-box; margin:.5em 0; overflow:hidden; padding:.5em; text-align:left; width:auto;">Unter den Btrfs-spezifischen Anpassungen (1, 2) waren einige, die Latenz- und Stabilitäts-Probleme beseitigen, die bei knapp werdendem Speicherplatz auftreten können.</div><!--/notypo--><br />
  3. Image links to other sites
    • The automatically added symbol for an outerlink is misplaced here, e.g.:
      • ((
  4. Wacko is spamming BRs, in between everything
  5. add option to hide protected links
    • You must login to see this link. Register now, if you have no user account yet.
    • add 'nofollow' to protected link -> class="acl-denied"
  6. Wacko is putting around DIV elements = Plain Simple Bullshit -> bugs:375
    1. should not set paragraphs in cases like
    2. <p class="auto" id="p96596-1"><!--notypo--><pre class="code">
      <p class="auto" id="p21312-1"><!--notypo--><div class="layout-box">
    3. leads to invalid html tag nesting
  7. Error: Bad value 4 for attribute type on element ol.
    1. see $new_indent_type in wackoformatter -> error prone
      •   1. hallo
            5. should not take the number but 1, same for i, I, a, A
    2. Block elements inside inline elements
  8. even if wiki_links were turned off (disable_wikilinks) the formatter should try to form links for in intralinks with at least one slash (?) like
    • /Dev/Release/R50/ReleaseNotes#h1433-7
  9. place holder
    1. div.image {
      	width:            100px;
      	height:           100px;
      	background-image: url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR4nGP6zwAAAgcBApocMXEAAAAASUVORK5CYII=');
  10. allow case insensitive matching of file links, e.g. File:image.jpg
  11. breaks quote
  12. ((image.jpg)) shows images from image/ folder ?
  13. display of correct headings inside wrapper %%(wacko wrapper="shade") with toc is broken
  15. <[ ]> eats blank line in quote, undesired
  16. broken nested quote
    • <[block
      <[nested quote]>

14. Cache

15. Admin Panel

  1. add Check for Updates button in Admin panel: /Download/VersionCheck
  2. Synchronizing data: update comment count for page if out of sync
  3. upload module
      Before adding random file/MIME types: please think about possible security issues.
      For example HTML (.htm, .html), JavaScript (.js) and PHP (.php) file are types you’d better avoid as they can be “executed” on your server where you really would not want that to happen. For most of these kind of files, this should not be a problem though as these files are better off being compressed into a ZIP file anyway.
      Only add file types that you REALLY need and that you are comfortable with.
  4. user management
    • deactivate / delete inactive users
      • criteria
      • actions
  5. add module to filter, moderate and manage pages, comments, (files)
    1. see modules for content like pages
  6. recovery mode: CSS and images won't load
  7. use collgroup for col span % width
    •  <colgroup>
                  <col span="1" style="width: 10%;">
                  <col span="1" style="width: 5%;">
                  <col span="1" style="width: 5%;">
                  <col span="1" style="width: 45%;">
                  <col span="1" style="width: 15%;">
                  <col span="1" style="width: 10%;">
                  <col span="1" style="width: 10%;">
    •  <thead class="data-head">
              <tr class="">
      <tbody id="table-section-one">
      <tbody id="table-section-two">

16. Database

  2. /Dev/Guidelines/SQL/SQLmodes

16.1. Check for SQL STRICT mode violations

  1. Using GROUP BY and selecting an ambiguous column
  2. Inserting the non standard zero date into a datetime column
  3. Inserting a 20 character string into a 10 character column
  4. Division by zero
  5. Inserting a negative value into an unsigned column

so far

  1. #1406 – Data too long for column 'description' at row 1
    1. set HTML maxlength="DB_FIELDSIZE" for all (VAR)CHAR form field
      • suggested (JS hint – might differ in some cases – smaller, e.g. meta description 160, meta title 60) + database field size (mandatory enforcement)
      • JS hint: You have <strong>60</strong> characters left
    2. set PHP length check before passing to INPUT / UPDATE
  2. #1055 – 'dev.g.group_name' isn't in GROUP BY

`DIGEST_TEXT` AS `query`,
`COUNT_STAR` AS `exec_count`,
`SUM_ERRORS` AS `errors`,
(ifnull((`SUM_ERRORS` / nullif(`COUNT_STAR`,0)),0) * 100) AS `error_pct`,
`SUM_WARNINGS` AS `warnings`,
(ifnull((`SUM_WARNINGS` / nullif(`COUNT_STAR`,0)),0) * 100) AS `warning_pct`,
`FIRST_SEEN` AS `first_seen`,
`LAST_SEEN` AS `last_seen`,
`DIGEST` AS `digest`
((`SUM_ERRORS` > 0) OR (`SUM_WARNINGS` > 0))

17. WikiEdit

  1. use only one popup for new link, having link and link description together
  2. popup for tables
3. select rows and columns
  1. set table header
  2. select color for text and highlighting
  3. undo / redo
  4. symbols

18. Translations

-> /Dev/Release/R55/Translations


  1. "\n\n"
    "Click on the following link to view the page:\n\n"
    • function notify_watcher

Refactor message sets, e.g. use only a common set for generic messages 'CancelButton'

  • 199: 'ACLCancelButton' => 'Cancel',
  • 242: 'CategoriesCancelButton' => 'Cancel',
  • 277: 'MetaCancelButton' => 'Cancel',
  • 280: 'EditCancelButton' => 'Cancel',
  • 964: 'ModerateDecline' => 'Cancel',
  • 1.066: 'PollsCancel' => 'cancel',

18.1. improve notifications

-> Notifications

  1. 'EmailRegistered' => 'You\'ve successfully registered at %1.'."\n".'Your username: %2'."\n\n".'If you want to receive notifications, you must click on the link below or copy it to a web browser.'."\n".'%3'."\n\n".'Please return to the Wiki and login with your new username and password.'."\n\n\n".'If you did not request any registration, ignore this message and nothing will happen.'."\n\n".'Do not reply to this message'."\n\n".'',
  2. revisit all email message sets

19. Usability issues

  1. indicate page [language|permissions]
  2. When should I use a select box instead of radio buttons?
  3. Not indicating an active form field
    • e.g.
      textarea:focus {
          border: 1px solid red; }
    • You can use the ‘:focus’ selector on lots of elements, but it’s super handy when used on inputs and textareas to indicate that the field is active. Add CSS styling such as a highlighted border, or a subtle change to the background color.
  4. forms with checkboxes and options in lists
    • e.g. category handler or users in admin panel
    • assignment of form buttons
  5. usage of new page handler
    • seen in many fresh installs, users adding sub pages to HomePage/subpage
      • this is possible but is it really desired and understood, should we filter out system pages as pre-provided cluster in the /new [page] handler?
  6. make name spaces for users and groups more intuitive accessible
    1. users/nickname/userspace/..
    2. groups/usability/groupspace/..
  7. add ability to easily create groups and to add group members
    1. suggestions?
  8. GUI inconsistencies
    1. handler
    2. actions
    3. message boxes
  9. Your session has timed out. Please sign in again.
    2. I wish more developers would test their web applications for session timeout issues. Despite all rumors to the contrary, your users will not be dedicating their entire lives to using your web application in a punctual and timely manner. They have phone calls to take, meetings to go to, other websites and applications to attend to.

      Is it really fair to kick users all the way out of your web application, or worse, blindly reject data they've submitted — just because they were impudent enough to wait a few hours since their last supplication to the web server gods? In most web apps, the penance is awfully severe for such a common sin.



20. Libs

  1. update PHPMailer to v6.0
  2. update Hashids to v2.0

21. Extentions

22. Refactoring

  1. start replacing magic numbers at least with true and false where possible
  2. erode the mountain of technical debt

23. Staging Area

  1. blog action (will replace news action)
  2. snippet action
  3. forum, topics action
  4. Admin Panel
    1. refactor -> antipatterns
    2. bad behaviour module
    3. list and check each module, assign status
  5. moderate handler -> quite a mess
  6. poll actions -> quite a mess

24. Ideas

  1. spam / badword handling -> bad_words($text) function
    3. What you need is a good way for users to flag inappropriate content and a mechanism to deal with it swiftly. One way is to automatically hide/remove content if it's been flagged more than X times.
  2. HTML5 media action: {{media type="[audio|video|flash]" source=http://.... [width=000] [height=000] [...some other options...]}}
  3. rel="edit" ->
  4. enforce ACL-Policy, e.g. set read to $, user can't overwrite the setting
  5. test PHPThumb alternatives
  6. Composer
  8. as extension
    1. https://www.smashingmagazine.c[..]-for-print-with-css/

25. Themes

  1. Clean up themes section
    • update repo links and info section
    • foster or (re)move theme
  2. new mobile ready theme / layout -> on hold (we got a new template engine!)

Flexbox vs Grid

  1. Flexbox: content dictates layout
  2. Grid: container dictates layout (to some extent)

Flexbox is great, it just isn't the best thing for overall page layouts.
Flexbox and grid play well together, and are a huge step forward from the float & table hacks they replace. The sooner we can use them both in production, the better.

CSS Varibles


CSS colums for index <div class="gimme-columns"><ul>

.gimme-columns {
	columns: 20em 3;
	column-count: 3;
	column-width: 20em;

default theme

  • change blockquote
    • box-shadow: 0 0 6px rgba(0, 0, 0, 0.5);
  • add option to hide $this->config['site_name'] in theme header, e.g.: WackoWiki: To Do R5.5 -> To Do R5.5
  • min-height: 200px for .article, #page

25.1. SVG

Icon setting: add viewBox="0 0 16 16" AND height="16" width="16"


25.2. Site Logo

25.3. Favicon

Supported Formats

  1. ico -> type="image/x-icon" ->
  2. png -> type="image/png" ->
  3. gif -> type="image/gif" ->
  4. svg -> type="image/svg+xml" ->


  1. 16×16
  2. 32×32
  3. 48×48
  4. 64×64


26. Documentation

  1. add documentation for Admin Panel
    1. backup and restore module
  2. Update / foster Core Documentation for
    1. Deutsch
    2. English
    3. Français
    4. Русский
  3. describe forum and topic action
  4. blog action -> Blogging with WackoWiki
  5. where and when you should use relative or absolute addressing (include action, files, actions with page parameter)
  6. how you use the include function (pages, comments)
  7. release notes
    1. add a New & Noteworthy section / sub page to raise visibility of 'hidden' features
  8. moderate handler
  9. message functions and usage
  10. add sub page to config documentation about CSP 
  11. Video Tutorials
  12. update screen shots

27. Feedback

  1. themes
  2. migration and encoding issues
  3. frequent annoying issues
  4. unsolved questions
  5. add rfc section in dev cluster
  6. add dev activity log 
  7. Nginx configuration (rewrite rules)

28. Testing

  1. Tools
    5. WAVE – Online accessibility validator
  2. PHP 
  3. – test with firefox reading mode
  4. /Forum/Discussion/UserPasswordReset -> solution paths

28.1. Test cases

-> Test cases

28.2. Debug

  1. Content Security Policy: Die Einstellungen der Seite haben das Laden einer Ressource auf self blockiert ("script-src http://localhost 'unsafe-inline'").
    • call to eval() or related function blocked by CSP: autocomplete.js (Line 253)
  2. #1139 – Got error 'this version of PCRE is compiled without UTF support at offset 0' from regexp
    • Error
      Static analysis:
      8 errors were found during analysis.
          Unrecognized keyword. (near "REGEXP" at position 209)
          Unexpected token. (near "'^/Blog/.+/.+/.+$'" at position 216)
          Unrecognized keyword. (near "AND" at position 235)
          Unexpected token. (near "p" at position 239)
          Unexpected token. (near "." at position 240)
          Unexpected token. (near "deleted" at position 241)
          Unexpected token. (near "<>" at position 249)
          Unexpected token. (near "'1'" at position 252)
      SQL query: Documentation
      SELECT p.page_id, p.owner_id, p.user_id, p.tag, p.title, p.created, p.comments, u.user_name AS owner FROM wacko_page p INNER JOIN wacko_user u ON (p.owner_id = u.user_id) WHERE p.comment_on_id = '0' AND p.tag REGEXP '^/Blog/.+/.+/.+$' AND p.deleted <> '1' ORDER BY p.created DESC LIMIT 0, 10
      MySQL said: Documentation
      #1139 - Got error 'this version of PCRE is compiled without UTF support at offset 0' from regexp

5.5.0 – distilled from error.log (PHP 7.0)

Undefined index: HTTP_USER_AGENT in /class/session.php on line 51
Undefined index: HTTP_USER_AGENT in /class/wacko.php on line 6338

Undefined index: deleted in /class/wacko.php on line 1495
Undefined index: tag in /class/wacko.php on line 1507
Undefined index: page_lang in /class/wacko.php on line 1512

htmlspecialchars() expects parameter 1 to be string, array given in /class/wacko.php on line 3290

Undefined index: page_id in /class/wacko.php on line 1386

Undefined index: comment_on_id in /handler/page/show.php on line 12
Undefined index: deleted in /handler/page/show.php on line 43
Undefined index: latest in /handler/page/show.php on line 66
Undefined index: modified in /handler/page/show.php on line 71
Undefined index: user_name in /handler/page/show.php on line 72
Undefined index: page_lang in /class/wacko.php on line 4023
Undefined index: page_id in /handler/page/show.php on line 114
Undefined index: body_r in /handler/page/show.php on line 133
Undefined index: latest in /handler/page/show.php on line 137
Undefined index: body in /handler/page/show.php on line 138
Undefined index: page_id in /handler/page/show.php on line 138
Undefined index: latest in /handler/page/show.php on line 199
Undefined index: latest in /theme/_common/_header.php on line 19
Undefined index: description in /class/wacko.php on line 1032
Undefined index: page_id in /theme/default/appearance/header.php on line 83

Undefined index: page_id in /theme/default/appearance/header.php on line 166
Undefined index: modified in /theme/default/appearance/footer.php on line 20
Undefined index: comment_on_id in /theme/default/appearance/footer.php on line 46
Undefined index: page_id in /action/hashid.php on line 21

Undefined index: HTTP_ACCEPT_ENCODING in /class/http.php on line 750
Undefined index: page_id in /action/hashid.php on line 27
Undefined index: handler in /class/wacko.php on line 4626

Undefined index: footer_comments in /class/wacko.php on line 6441
Undefined index: footer_files in /class/wacko.php on line 6441
Undefined index: footer_rating in /class/wacko.php on line 6441
Undefined index: hide_toc in /class/wacko.php on line 6441
Undefined index: hide_index in /class/wacko.php on line 6441
Undefined index: tree_level in /class/wacko.php on line 6441
Undefined index: allow_rawhtml in /class/wacko.php on line 6441
Undefined index: disable_safehtml in /class/wacko.php on line 6441
Undefined index: theme in /class/wacko.php on line 6441

Undefined index: page_id in /class/wacko.php on line 6451

Undefined index: modified in /class/wacko.php on line 6461

Undefined index: comment_on_id in /class/wacko.php on line 6476

Uninitialized string offset: 0 in /formatter/class/wackoformatter.php on line 330
Uninitialized string offset: 0 in /formatter/class/wackoformatter.php on line 440
Undefined offset: 3 in /formatter/class/wackoformatter.php on line 874

imagedestroy(): supplied resource is not a valid Image resource in /lib/captcha/freecap.php on line 364, referer: https:///Registration

Invalid argument supplied for foreach() in /lib/Text_Highlighter/Highlighter/Renderer/Html.php on line 310

Read comment (1 comment)