NeoFrag Reborn 1.2.24

NeoFrag Reborn opens up on GitHub. The CMS code (NeoFragReborn/neofrag), the à la carte addons (NeoFragReborn/extensions) and the Discord bot (NeoFragReborn/bot-discord) are published there with the history of their versions — since 1.0.0 for the CMS and the addons, since 0.1.0 for the bot: the code of each version, its notes, and the packages from 1.2.23 onward.

Changed

• The databases listed are the ones that are tested: each version installs and passes its whole test suite, with PHP 8.2 and 8.5, on MySQL 5.7, 8.0 and 8.4 and on MariaDB 10.5, 10.6, 10.11, 11.4 and 11.8 — the installation guide lists those versions, and no longer "5.7+" and "10.5+".
• The guides say where to find the project: the installation package and the bot archive on their releases page, the à la carte addons and their catalog on the extensions one, the code for anyone who wants to contribute. In the wiki, references to a repository document (deployment, architecture, tools) lead to that document on GitHub, instead of keeping only its title.

Fixed

• Module settings open again: the "Configuration" window of the Forum, Recruitment, News, Gallery, Events, Calendar and Articles modules returned "error 500" every time it was opened, on every site, since 1.2.0: the "number" field rejected an integer (its step, and the value read back from the database) since the code switched to strict typing.
• Teams: the "Show matches played" option can be unchecked again. Saving the settings stored the word "Array" instead of a yes or a no, which was always read as "yes".
• The settings of an authenticator that was never configured (Google, Discord, GitHub) open without writing eight warnings to the log.
• The dashboard and statistics of a site without Articles, Bugtracker or Forum no longer write warnings to the log every time they are opened: the cards of these modules only appear if they are installed, and no missing table is queried anymore.
• The installation wizard rereads the configuration it has just written: on a host whose PHP cache does not recheck files, a second attempt at the "Database" step still read the old config/db.php.
• A site deployed from git and installed through the web wizard works: the wizard did not write config/neofrag.php (the package carries it, a clone only has its template), and every page returned "error 500" without a single line in the log.
• The example nginx.conf starts: the TinyMCE rule, without quotes, made nginx reject the whole configuration ("missing closing parenthesis"). Its redirects no longer carry the internal parameter request_url.
• Uploaded files are served under Apache with PHP as a module: the guard on upload/ used a directive that is forbidden in an .htaccess, and that whole folder — avatars, gallery, media library — returned "error 500".
• Under Caddy, uploaded files that are not images (a PDF from the media library) are served: the example only served images.
• /index.php leads to the home page (permanent redirect) instead of a not-found page; and an address with an extension that no page serves (/newsletter/.env, which bots try) returns 404 without writing an anomaly to the log.
• tools/check-all.php under PHP 8.2: every check counted there as a failure, even when it passed — the exit code was read one time too many, which PHP only allows from 8.3 onward. For anyone contributing under PHP 8.2.

Security

• The installation wizard no longer reopens on an installed site whose database is not responding. If the install/db.txt lock had disappeared, a temporary database outage reopened the wizard, whose "Database" step rewrites config/db.php: a visitor could then redirect the site to their own database. The site now displays "temporarily unavailable". And the "Administrator" step refuses to create an account as soon as the site has one.
• Apache now only executes the root index.php: the rewrite rule let any index.php file in a subfolder run directly (more than eighty internal controllers).

Added

• Four more checks: check-assistant runs the installation wizard end to end, like a visitor, for each profile (screens, refusals, account created, login with the password entered, silent log); check-reglages opens the settings screen of each addon, saves it as is and reopens it; check-serveur-web tests Apache, nginx and Caddy, with the shipped configurations, by placing probes (forbidden folders and files, scripts that must not run, rewriting, security headers); check-nouveau-venu follows the README and the contributor guide verbatim on a clean machine. The installation.yml and nouveau-venu.yml workflows rerun them every week.
• The README's commands work on a fresh machine: its "Develop" block ended on a test suite that failed for lack of a test database; it now points to the contributor guide, which creates that database (php tools/prepare-test-db.php).