WackoWiki: Todo List

https://wackowiki.org/doc     Version: 12.08.2021 15:47





1. R 6.1

Roadmap[link9]
dev repo [bitbucket.org][link10]
ChangeLog[link11]
https://github.com/WackoWiki/w[...]pare/6.1.12...master[link12] – Diff since last release


Main Focus: Implement new PHP 8 functionality and improve GUI usability.


Contributions are encouraged.


Please look here for open issues from R6.0[link13].

1.1. PHP

1.1.1. PHP 8.0

  1. https://stitcher.io/blog/new-in-php-8
  2. https://php.watch/versions/8.0
  3. https://github.com/php/php-src/blob/php-8.0.0/UPGRADING
  4. https://php.watch/articles/php-regex-readability

1.1.2. PHP 8.1

  1. https://stitcher.io/blog/new-in-php-81
  2. https://github.com/php/php-src/blob/php-8.1.0/UPGRADING
  3. https://github.com/rectorphp/r[...]es_overview.md#php81[link14]
  4. https://php.watch/versions/8.1/gd-avif

Deprecated:

  1. Passing null to non-nullable internal function parameters[link15]

1.2. Features

1.3. Core

  1. declared visibility on all properties, constants and methods (good luck with that)
  2. fix SQL Strict mode issues opportunistically (see error log)
    • 'sql_mode_strict' => '1'
    • const SQL_MODE_STRICT = 'TRADITIONAL,NO_ENGINE_SUBSTITUTION,ONLY_FULL_GROUP_BY';
      const DB_ERROR_MODE = 1;
  3. unwrap_link() strip also last slash if user provides page="/Cluster/SubPage/" to match tag Cluster/SubPage in database
    • utf8_rtrim(new_tag, '/') or better already via regex
  4. add option to overwrite upload pre-selection (global/local)
  5. migrating from SAH-1 to SHA-256 for all hashes?
  6. improve mixed directionality of text[link16] support
    • set dir in user elements when dir differs from content, e.g content is in Persian and GUI is Greek
    • how to determine the use of the <bdi> tag, e.g. for breadcrumbs or lists
  7. made time format depended from localization and user preferences
    • DateTime::format()
    • IntlDateFormatter::format()
  8. The user name regex allows . and - in usernames however the sanitizer removes it 
  9. Why does it store interwiki in session and not as JSON in _cache/config/interwiki.conf?
    • get_inter_wiki_url($name, $tag)
  10. move interwiki.conf and antispam.conf into table & _cache/config/*
  11. add option to enforce email validation before a user can login
  12. notify_watcher(): add direct link to diff mode in email body
  13. COLLATE utf8mb4_bin for tag eats 𝓦𝓲𝓴𝓲𝓦𝓸𝓻𝓭𝓼 in LIKE '/%' query, without slash it finds it, whO_Ot
  14. UTF-8 text must be checked for well-formedness
    • static function is_utf8($string)
      {
        return (bool) preg_match('//u', $string);
      }
  15. localize default date formats
  16. improve and foster message sets
  17. set return type declarations : (array | bool | float | int | mixed | string | void | ... )
  18. fix client side JS input validation patterns
    1. new, clone and rename handler, import action
    2. $tpl->pattern = $this->language['TAG'] . '+';
  19. Replace all HTML-Entities except HTML special chars[link18]
    1. nbsp; — to indent or add extra spacing to a paragraph, sentence, or another portion, better using CSS instead of multiple non-breaking spaces.
  20. allow also login with email address instead of user name
  21. individual CSP per page
  22. move link and notifications functions in own class
    • $this->msg->notify_user()
    • $this->ref->link()
  23. partial mixed usage of DB warnings and exceptions (must use either one or the another)
    • MySQLi: mysqli_sql_exception and mysqli_connect_errno
    • PDO: errorCode and PDOException

1.4. Installer

  1. commented out auto-creation of empty help, terms and privacy page – needs FEEDBACK
    • make creation optional, the default theme shows the links when set in the config
    • either the user defines them individually in the admin panel or sets an additional option in the installer to create them
  2. set more strict write and create default ACLs for system and user pages
    • user pages: only the user should be able to write and create sub-pages by default in his namespace
    • system pages: no sub-page creation for users
    • requires a option to pass custom ACLs in page creation, e.g. $permissions = [ 'write' => 'Admins', 'create' => 'Admins']
  3. validate username
  4. Nginx: installer seems to activate rewrite_mode ?
  5. use dbal also for installer: $db->sql_query($sql)

1.5. Handler


1.6. Action

1.7. Formatter

1.8. Cache


1.9. Admin Panel


1.10. Database

1.11. WikiEdit

  1. Autocomplete seems broken, shows possible pages – but selection does not work
  2. use only one popup for new link, having link and link description together
  3. select and remember the color of the highlighter or marker, keep selected color in session
  4. do not set multi-line markup beyond paragraph, list ad other terminators, only valid tag nesting
  5. popup for tables
    1. select rows and columns
    2. set table header
  6. select color for text and highlighting
  7. resize textarea
  8. undo / redo
  9. JavaScript search & replace
  10. ECMAScript 2018

1.12. Translations

1.13. Libs

  1. https://github.com/pear/Text_Highlighter/pull/5
  2. https://github.com/PHPThumb/PHPThumb <— successor

PHPThumb ToDo:

1.14. Refactoring


1.15. Themes


1.15.1. Print

CSS Paged Media Module Level 3[link26]

@page {
    size: A4 portrait;
    margin: 15mm;
    font-family: Arial, Helvetica, sans-serif;
    marks: crop cross;

    @bottom-center {
        content: "Seite " counter(page) " von " counter(pages);
        font-size: 10pt;
    }
}

.chapter h1 {
    page-break-before: always;
    string-set: chapter-title content()
}

h2, h3 {
    page-break-after: avoid;
}

p {
    orphans: 3;
    widows: 3;
}

1.16. Ideas

1.17. Documentation

  1. add example for rewrite with Nginx – HELP needed
    1. Converting Apache Rewrite Rules to NGINX Rewrite Rules[link32]
    2. Pitfalls and Common Mistakes[link33]
    3. Creating NGINX Rewrite Rules[link34]

1.18. Feedback

1.18.1. Polls

The polls class and actions have been removed from the core. They can be added again to the community folder after evaluation and improvement. Additionally a guide as well as further documentation is needed. See 6.0 branch for source code.


module


class


actions


translations
database table

1.19. Testing

1.19.1. Debug


declare(strict_types=1);




2. R 6.0

Roadmap[link9]
dev repo [bitbucket.org][link35]
ChangeLog[link36]
https://github.com/WackoWiki/w[...]compare/6.0.31...6.0[link37]


Main Focus: UTF-8 support and migration and PHP 8.0 compatibility


R6.0 is more or less R5.5 with Unicode support. Please look here for open issues from R5.5[link38] .

2.1. PHP

PHP 8 functionality

New PHP 8 functionality is reserved for 6.1 branch[link39] releases .
Currently Supported PHP Versions[link40]

2.2. Features

2.3. Core

  1. add option to disable hit counter
    • user already uses web analytics software or there is no use case for a hit counter
    • This reduces database load, updating the page and file hits field with every page hit is a main source for slow queries.

2.4. Handler

2.5. Libs

  1. php-diff successor[link42]
    1. https://github.com/jfcherng/php-diff
    2. https://github.com/JBlond/php-diff <— SWITCHED TO 
    3. https://github.com/sebastianbergmann/diff


For issues regarding Unicode please look in our R6.0 ToDo list[link13].

R5.5 is no longer maintained, please upgrade to R6.0[link43]. Open issues will be fixed in R6 branch.

3. R 5.5

Roadmap[link9]
ChangeLog[link44]


Main Focus: HTML5 support, security related features

  1. HTTP Strict Transport Security (HSTS)
  2. Content-Security-Policy[link45]
  3. Cookies, CSRF sectoken
  4. https://www.owasp.org/index.ph[...]tication_Cheat_Sheet[link46]

3.1. MariaDB / MySQL type casting

https://dev.mysql.com/doc/refm[...]type-conversion.html[link47]
https://stackoverflow.com/ques[...]d-backticks-in-mysql[link48]


whOOt https://dev.mysql.com/doc/refm[...]ent-programming.html[link49]


3.2. Features

  1. normalize links to other language versions of a page
    • add table: lang_link[page_id, lang, target_id]
  2. add debug option to send error log into separate file + rotate logs
  3. add IP block to ban bad actors, bots

3.3. M17

open issues (add)

  1. relative linking seems not working for ((../ back to parent page)), it links to root level (?!)
  2. add delimiter before page handler (_properties)
    1. min_href()
    2. router.conf
  3. upload of file without extension -> broken
  4. empty body_r after page rename/relocation -> page needs re-rendering
  5. allow multi logins (on/off)
    1. add multi login warning: 'Jemand hat sich bereits an diesem Konto angemeldet'
    2. This account is currently being used in 1 other location at this IP ().
  6. add access throttling feature
    • limit the number of page requests by a single IP address within a given time interval
  7. add array for 'default' AND 'user' menu so both can used independently (create/edit menu sets)
  8. rewrite_mode setting in AP is pointless if it is overwritten in Setting class

3.4. Fix

  1. check for avoidable SQL roundtrip queries
  2. link() -> default: $anchor_link – should only active inside page_body (?)
    • additional check if its better to prefix the id="doc.deutsch.konfiguration"
      • to avoid unintentional mix with CSS settings
    • set anchor id only where needed, minimizes also size of attributes
  3. broken list in tree action if levels changes not in order – e.g. depth 1.2 -> depth 2.4
    1. show missing levels
  4. search?phrase="sourceforge.net" -> paging fails with "term to search"
  5. bug: news action takes all subpages – is this desired?
  6. improve search[link50] (open since ages), add some measures to improve relevance (time, size, user, filter, ...) and provide more and better meta data for search results
  7. implement rating hack (but without mandatory JS)
    1. https://www.youtube.com/watch?v=orPVEAipz2A
  8. add unique log message key to filter events (messages may differ)
  9. add regex for this->config['users_page']/[*]/
    • Yet the engine does not validate the namespace for the user cluster, so that nobody can create a page under /User except his own [UserName]
    • Then we can disallow random pages for the first level in the users cluster except the own [UserName].
    • The register action creates this page usually for the user.

3.5. Notifications

  1. Notifications[link51]

3.5.1. Notice digest

3.6. Handler

  1. clone entire cluster is only available for Admins atm., it should also available for ...
  2. improve global upload settings
    1. allow groups
    2. set individual rights (only images, quota, etc. for a user, group)
  3. send page as email (like print)
  4. show: add option 'Flag as Spam/Inappropriate'
  5. show: Delayed Indexing delay_index
    • <meta name=“robots” content=“noindex,nofollow”>
  6. see upload[link52] subpage
    1. upload: check if the MIME type of the uploaded file matches the file extension
      1. https://www.owasp.org/index.ph[...]stricted_File_Upload[link53]
      2. https://www.acunetix.com/websitesecurity/upload-forms-threat/
      3. https://www.php.net/manual/en/[...]n.exif-read-data.php[link54]
    2. upload: add form field to chose another file name (?)
    3. upload: add accept attribute depending on config settings https://www.w3.org/TR/html5/fo[...]ml#attr-input-accept[link55]
  7. add meta handler namespace ['page', 'account', 'file', 'service']
    • This is the simplest way to standardize document locations and for the language-independent single instances of service pages, like login. Next step is the separated cluster for those pages, linked with prefix, for example, ((service:login)).
    • this can be easily done with the new URI router
    • handler/account/
  8. file: apply access restrictions for global files if Wiki is closed -> $
    1. add and enforce global Wiki mode, minimum access rights
    2. route global files only for registered users

3.7. Action

  1. template toc and tree

3.8. Formatter

  1. Search Highlighter
  2. (/Users/WikiAdmin UserSpace | WikiAdmin)) -fails on |
  3. <# #> adds <!--notypo--> on first and <!--/notypo--> on second appearance of double quote like class=""
    1. caused by race condition in wacko_preprocess()
    2. <#<div class="" style="background:transparent; border:.1em solid #F66; border-left:1em solid #F66; box-sizing:border-box; margin:.5em 0; overflow:hidden; padding:.5em; text-align:left; width:auto;">Unter den Btrfs-spezifischen Anpassungen (1, 2) waren einige, die Latenz- und Stabilitäts-Probleme beseitigen, die bei knapp werdendem Speicherplatz auftreten können.</div>#>
      2
      <#<div class="" style="background:transparent; border:.1em solid #fcfce9; border-left:1em solid #fcfce9; box-sizing:border-box; margin:.5em 0; overflow:hidden; padding:.5em; text-align:left; width:auto;">Unter den Btrfs-spezifischen Anpassungen (1, 2) waren einige, die Latenz- und Stabilitäts-Probleme beseitigen, die bei knapp werdendem Speicherplatz auftreten können.</div>#>
    3. <!--notypo--><div class="<!--notypo--> style="background:transparent; border:.1em solid #F66; border-left:1em solid #F66; box-sizing:border-box; margin:.5em 0; overflow:hidden; padding:.5em; text-align:left; width:auto;">Unter den Btrfs-spezifischen Anpassungen (1, 2) waren einige, die Latenz- und Stabilitäts-Probleme beseitigen, die bei knapp werdendem Speicherplatz auftreten können.</div>#><br />2<br /><#<div class=<!--/notypo-->" style="background:transparent; border:.1em solid #fcfce9; border-left:1em solid #fcfce9; box-sizing:border-box; margin:.5em 0; overflow:hidden; padding:.5em; text-align:left; width:auto;">Unter den Btrfs-spezifischen Anpassungen (1, 2) waren einige, die Latenz- und Stabilitäts-Probleme beseitigen, die bei knapp werdendem Speicherplatz auftreten können.</div><!--/notypo--><br />
  4. Wacko is spamming BRs, in between everything
  5. add option to hide protected links
    • You must login to see this link. Register now, if you have no user account yet.
  6. Error: Bad value 4 for attribute type on element ol.
    1. see $new_indent_type in wackoformatter -> error prone
      •   1. hallo
            5. should not take the number but 1, same for i, I, a, A
    2. Block elements inside inline elements
    3. http://www.w3.org/TR/html5/gro[...]nt.html#attr-ol-type[link56]
  7. allow case insensitive matching of file links, e.g. File:image.jpg
  8. breaks quote
    <[http://www.example.com]>
  9. <[ ]> eats blank line in quote, undesired
  10. broken nested quote
    • <[block
      <[nested quote]>
      quote
      ]>

3.9. Admin Panel

  1. upload module
    1. PAY ATTENTION TO SECURITY RISKS
      
      
      Before adding random file/MIME types: please think about possible security issues.
      
      For example HTML (.htm, .html), JavaScript (.js) and PHP (.php) file are types you’d better avoid as they can be “executed” on your server where you really would not want that to happen. For most of these kind of files, this should not be a problem though as these files are better off being compressed into a ZIP file anyway.
      
      Only add file types that you REALLY need and that you are comfortable with.
  2. add module to filter, moderate and manage pages, comments, (files)
    1. see modules for content like pages
  3. recovery mode: CSS and images won't load
    • index.php: (!$db->ap_mode && RECOVERY_MODE) excludes static files!
      • !$db->ap_mode
  4. purge logs (TRUNCATE)
    1. log table
    2. referrers
    3. badbehavior
    •  <thead class="data-head">
              <tr class="">
              </tr>
              [...]
          </thead>
      
      <tbody id="table-section-one">
      [...]
      </tbody>
      
      <tbody id="table-section-two">
      [...]
      </tbody>

3.10. Database

  1. https://www.digitalocean.com/c[...]ur-mysql-5-7-upgrade[link57]
  2. /Dev/Guidelines/SQL/SQLmodes[link8]

3.10.1. Check for SQL STRICT mode[link8] violations

  1. Using GROUP BY and selecting an ambiguous column
  2. Inserting the non standard zero date into a datetime column
  3. Inserting a 20 character string into a 10 character column
  4. Division by zero
  5. Inserting a negative value into an unsigned column

so far

  1. #1406 – Data too long for column 'description' at row 1
    1. set HTML maxlength="DB_FIELDSIZE" for all (VAR)CHAR form field
      • suggested (JS hint – might differ in some cases – smaller, e.g. meta description 160, meta title 60) + database field size (mandatory enforcement)
      • JS hint: You have <strong>60</strong> characters left
    2. set PHP length check before passing to INPUT / UPDATE
  2. #1055 – 'dev.g.group_name' isn't in GROUP BY

SELECT
`DIGEST_TEXT` AS `query`,
`SCHEMA_NAME` AS `db`,
`COUNT_STAR` AS `exec_count`,
`SUM_ERRORS` AS `errors`,
(ifnull((`SUM_ERRORS` / nullif(`COUNT_STAR`,0)),0) * 100) AS `error_pct`,
`SUM_WARNINGS` AS `warnings`,
(ifnull((`SUM_WARNINGS` / nullif(`COUNT_STAR`,0)),0) * 100) AS `warning_pct`,
`FIRST_SEEN` AS `first_seen`,
`LAST_SEEN` AS `last_seen`,
`DIGEST` AS `digest`
FROM
 performance_schema.events_statements_summary_by_digest
WHERE
((`SUM_ERRORS` > 0) OR (`SUM_WARNINGS` > 0))
ORDER BY
 `SUM_ERRORS` DESC,
 `SUM_WARNINGS` DESC;

3.11. Usability issues

  1. add double-click support for editing comments
  2. When should I use a select box instead of radio buttons?
    1. https://www.nngroup.com/articl[...]es-vs-radio-buttons/[link58]
  3. Not indicating an active form field
    • e.g.
      textarea:focus {
          border: 1px solid red; }
    • You can use the ‘:focus’ selector on lots of elements, but it’s super handy when used on inputs and textareas to indicate that the field is active. Add CSS styling such as a highlighted border, or a subtle change to the background color.

Readings

  1. https://www.nngroup.com/articles/low-contrast/
  2. https://backchannel.com/how-th[...]eadable-a781ddc711b6[link59]

3.12. Extensions

  1. https://github.com/google/code-prettify (abandoned)
  2. https://highlightjs.org/
  3. https://prismjs.com/

3.13. Ideas

  1. spam / badword handling -> bad_words($text) function
    1. https://en.wikipedia.org/wiki/Wordfilter
    2. https://stackoverflow.com/ques[...]ood-profanity-filter[link60]
    3. What you need is a good way for users to flag inappropriate content and a mechanism to deal with it swiftly. One way is to automatically hide/remove content if it's been flagged more than X times.
  2. rel="edit" -> https://tools.ietf.org/html/rfc686
  3. enforce ACL-Policy, e.g. set read to $, user can't overwrite the setting
  4. test PHPThumb alternatives
    1. https://github.com/mosbth/cimage
  5. Composer[link61]
  6. https://github.com/openpgpjs/openpgpjs

  1. https://www.w3.org/TR/css3-page/
    1. https://www.smashingmagazine.c[...]-for-print-with-css/[link62]

3.14. Themes


  1. new mobile ready theme / layout -> on hold (we got a new template engine!)
  2. https://developers.google.com/web/fundamentals/
  3. https://www.w3.org/Style/Examples/007/leaders

CSS Varibles

  1. https://developer.mozilla.org/[...]/Using_CSS_variables[link64]
  2. https://www.w3.org/TR/css-variables/

CSS colums for index <div class="gimme-columns"><ul>

 
.gimme-columns {
	columns: 20em 3;
	column-count: 3;
	column-width: 20em;
}

.sticky {
  position: sticky;
  top: 0;
}

default theme



4. Unscheduled

4.1. Most Annoying Bugs

4.2. Core

  1. Extended Acls[link65]
  2. if ($method && $method != "show") unset($wacko->config["youarehere_text"]);
  3. /Users/DidierSpaier/ProposedSpecificationsForLanguagesHolding[link66]
  4. rewrite search action

4.3. Formatters

  1. cleanwacko-> strip also file: links and formatter options (hl php ...)

5. Database


Implementation itself should not be that difficult, however it needs at least one major user.


6. Requests

  1. add function InviteGroup (allow/deny add/remove)
  2. receive all messages combined in one digest
    1. daily at 
    2. once per week on 
    3. once per month, on the day number
  3. option for allowed actions in comments
  4. move antispam.conf as badword to config