NeoFrag Reborn 1.0.0

First cycle of the fork: modernization of the foundation, security hardening and a broad wave of features.

Platform & tooling

Database migrations, versioned (tools/migrate.php, with a baseline command to take over an existing database), and first automated tests (PHPUnit).
New web installer, replacing the original NeoFrag one: a five-step wizard (Requirements → Database → Modules → Administrator → Done). The "Modules" step offers three site profiles (Community, Gaming / eSport, Simple site) and can add addons from the marketplace.
Remote marketplace (catalog and archives served by neofrag-reborn.xyz): the installer ("Modules" step) and the admin ("Marketplace" button on the Themes & Addons page) add, in one click, the official catalog's addons that do not ship with the site. Security: HTTPS required, SHA-256 checksum verified, archive checked entry by entry (no path leaving the addon's folder, no symbolic link), fixed catalog address, bounded sizes and timeouts.
Packaging tools: package-addons builds the marketplace catalog, build-release the archives to upload by FTP.
Maintenance script (tools/maintenance.php, to be run by a scheduled task): empties trash items older than 30 days (configurable) and deletes never-confirmed accounts after 7 days, when registration validation is on — never an administrator.

Themes & interface

Four themes created for NeoFrag Reborn: Nebula, designed for community sites, Forge, Blockcraft and Granite. Shared color variables (--nf-*) dress modules and widgets in each theme's colors.
Complete redesign of the admin: new look, sidebar, command palette (Ctrl+K), light and dark modes.
Theme and language selectors in the footer (visitors included).
Menus: multi-level menu builder, usable in the Navigation widget ("Managed menu" option).

Content

News and articles: scheduled publishing — content goes live at the chosen time, and notifications, webhooks and points are only sent at that moment, no longer on save (an address to be called by a scheduled task, protected by a key); bulk actions; search, filters and pagination in the admin; a dedicated page to read a news item. Articles get a featured image, as news items already had, and the news view counter, which never went up, finally counts.
Scheduled publishing on pages, galleries and events too (publication date separate from the date the event takes place, for events).
Wiki: serves as on-site documentation (table of contents as cards, reliable Markdown rendering); search and pagination; visual line-by-line comparison of two revisions of a page.
Media: editable title and description for each file, search, filter by type and pagination. Search, filters and pagination also in the admin of Downloads, the Link directory, FAQ, Surveys and the Guestbook.
RSS 2.0 feed (news + articles), social share buttons, SEO (meta description, canonical, Open Graph, Twitter Card, per-page meta).

Community & engagement

On-site notification center (bell and unread count), with subscriptions (follow a piece of content or a category). Notifications cover comments, forum replies, @username mentions, private messages and event invitations.
"Like" reactions on news, articles, comments and forum posts; content revisions (history and restore); "Latest comments" widget.
Shared trash: deleted news, articles, galleries, comments and forum posts go there and can be restored.
Forum: category reserved for VIP members, image per category.

Gaming

Events: full management of opponents (list, edit, delete; the original NeoFrag only let you add one from a match), live countdown, invitation notification.

Monetization & gamification

Karma/reputation → points (configurable scale) → shop (payment in points) → VIP status.
Stripe (buying points and VIP packs), ad management (hidden for VIP members), donations (module and widget ported from HiddenBlob's "Donation v3", after majiid; LGPLv3).

Links between modules

Statistics extended to 19 modules (the original NeoFrag covered 3: comments, forum, members); activity wall on the profile, gathering a member's activity across all modules; "To handle" dashboard in the admin; page blocks: the [block:…] shortcode inserts a module block into a page (news, articles, downloads).

Webhooks & audit

Signed (HMAC) outgoing webhooks, managed from the admin. The audit log also records addon installs and uninstalls, theme or module activation, and settings saves.

Account administration

Members: CSV or JSON member export (GDPR); moderators with the right permission adjust moderation settings from their member area. Editing and deleting a member from the admin, already in the original NeoFrag, are wired back to the new member list.

Versioning normalized to pure SemVer in addon dependencies (removal of the "Alpha" labels).
Pages is now part of the core; News, Forum and Galleries can be uninstalled.
Rich text editor: it finally works — the HTML it produces is cleaned instead of being shown as text.

The original NeoFrag's two themes, "Thème par défaut" (default) and Azuro, replaced by the NeoFrag Reborn themes.
The original NeoFrag's BBCode editor (WysiBB) and BBCode conversion: the rich text editor replaces it, and text written in BBCode is now shown as is.

Ten defects fixed, including: events without participants or matches did not appear; editing or deleting a game mode failed; deleting a recruitment offer failed; a partner's link led to "page not found" (it now leads to their site); the author of a report was never shown, even to authorized moderators; the Galleries and Forum widgets checked their settings or permissions wrongly. View counters now count once per visit and ignore bots.
Scheduled content is no longer visible through its direct address before its time. Buttons that did nothing now work: statistics periods, enabling email templates, social networks (all six are shown), "Add" buttons for news, pages and galleries.
Themes: button contrast raised to WCAG AA, login fields joined to their icons, alignment fixes.
Small and large screens (checked from 390 to 2,560 pixels wide): in the admin, sliding side menu and full-width content on phones; member profile; compact account bar in Nebula, Forge, Blockcraft and Granite.
The Members, Statistics and Live Editor admin pages showed a 500 error; some counters were stuck at 1 (moderation badge, newsletter subscribers, media statistics), and an empty Downloads, FAQ or links category could not be deleted. (For developers: strict typing errors in timetostr() and helpers; (int) on row(FALSE) of a COUNT/SUM was always 1.)

HTML sent by members is cleaned server-side (HTMLPurifier) against code injection; an uploaded file is checked by its actual content, not just its extension; HSTS enabled (browsers no longer fall back to HTTP).
Anti-CSRF tokens compared in constant time. IP address: rate limiting and the IP ban list no longer trust spoofable headers (X-Forwarded-For…), unless a trusted proxy is declared. Permissions: permission checks added where they were missing (Guestbook, Games, Galleries, Events, Statistics).
Old upgrade scripts can no longer recreate arbitrary PHP objects when reading settings back (unserialize restricted by allowed_classes).
Session fingerprint against session hijacking: a logged-in member is logged out if their browser (user-agent) changes markedly during the session — a mere browser update is not enough. The scheduled-publishing address is protected by a key compared in constant time.

Read next