Vervolg op v2.6.6: vier plekken lazen nog ruwe enabled_plugins zonder
essential-forcering. handleDashboard(), handleContentFiles/Edit() en
AdminPluginAPI::getEnabledPlugins() forceren nu essential plugins
consistent met PluginManager. Dode functie countEnabledPlugins()
verwijderd. AGENTS.md aangevuld met verplichte docblock-sectie.
Bug: beschermde/essentiële plugins (Dashboard, Navigation) konden niet
meer geactiveerd worden als ze uit enabled_plugins raakten. Core forceert
nu laden van essential plugins (plugin.json essential: true); admin-UI
toont ze altijd als Actief; toggle-handler staat aanzetten wél toe,
uitzetten blijft geblokkeerd; isProtectedPlugin() dekt nu ook essential.
- Bug: dashboard toonde 0 content (AdminPluginAPI::getContentDir() gaf relatief pad terug zonder normalisatie)
- Dynamische pad-resolutie: PluginAPIInterface uitgebreid met getProjectRoot/getContentDir/getPluginsDir/getVersionInfo; CMSAPI en AdminPluginAPI implementeren deze universeel
- public/index.php media-serving gebruikt $config['content_dir'] i.p.v. hardcoded /content
- Navigation en Logs plugins halen paden via de API i.p.v. hardcoded dirname(__DIR__)
- WordPress-stijl docblocks toegevoegd voor alle classes, methods, properties en functies (~450 docblocks, @since 2.6.5)
- Security: hardcoded plaintext-wachtwoord 'admin' verwijderd uit AdminAuth.php; bij eerste installatie wordt een cryptografisch veilig wachtwoord gegenereerd (random_bytes, 16 tekens) en eenmalig op het inlogscherm getoond
- Security: git-geschiedenis schoongemaakt (admin.json, admin.json.example, admin-console/config/admin.json verwijderd uit alle commits; filter-branch over alle branches + tags, gc --prune --aggressive)
- README.md, README.en.md, AGENTS.md bijgewerkt
- Test-scripts bijgewerkt naar clean-URL structuur + actuele ARIA-waarden
- Versie verhoogd naar 2.6.5
- Tests: pentest 29/29, WCAG 25/25, functioneel 16/16, enhanced 25/25
- Content bestanden met dezelfde naam maar ander type (md/php/html) worden
correct geserveerd: URL met extensie opent dat bestand, URL zonder extensie
valt terug op md > php > html (resolveContentByType helper)
- Admin content editor accepteert bestanden met dezelfde naam (ander type);
preview-knop linkt per extensie
- Frontend navigatie/directory listing/search tonen elk bestandstype apart
- getAllPages() array structuur gewijzigd naar list van
['path','title','type'] met type 'md'/'php'/'html'/'folder'
- Verberg-prefix logica: _ is geen verberg-prefix meer, alleen . (en -);
admin toont wél alle . bestanden/mappen
- ContentAPI getPage()/pageExists() respecteren expliciete extensie
- Handleiding content-api.md (NL+EN) herschreven
- File-tree unificatie: _file-tree.twig + _editor-styles.twig includes
- Versie verhoogd naar 2.6.3
Nieuwe features:
- Admin gebruikerslijst met zoeken/filter op gebruikersnaam en rol
- Profiel bewerken pagina met wachtwoord wijzigen en rol wijzigen
- Nieuwe gebruiker aanmaken via aparte pagina
- CLI commando cli/reset-admin-password.php voor admin wachtword reset + lockout reset
Architectuur:
- /admin/users: lijst met zoekveld, rol filter, bewerk/verwijder acties
- /admin/users-edit?user=<naam>: profiel, wachtwoord, rol, verwijderen
- /admin/users-new: nieuwe gebruiker aanmaken
- AdminAuth::clearLockout() public methode voor CLI gebruik
Documentatie:
- guide/nl/en/admin-beheerder/gebruikers.md herschreven
- 15 nieuwe admin vertaalkeys in NL/EN/DE
- Release notes: docs/release-notes/v2.6.1c.md
Tests:
- Pentest: 30/30 geslaagd, 0 vulnerabilities
- WCAG 2.1 AA: 25/25 geslaagd, 100% compliance
- PluginManager: getAdminMenuItems(), handleAdminRoute(), getPluginType()
- admin.php: load PluginManager, pass plugin_admin_menu to Twig
- admin.php: route to plugin admin pages via handleAdminRoute()
- admin.twig: show 'Plugins' sidebar section for system plugins
- plugins-new.twig: choose content or system plugin type
- handlePluginsNew: generate proper template based on type (content/system)
- plugin-admin.twig: renders plugin output in admin layout
- GeoIPInfo: example system plugin (admin page with GeoIP info)
- System plugins: getAdminMenu(), getAdminRoutes(), handleAdminRoute()
- Content plugins: getSidebarContent() (unchanged)
- plugin.json type field: 'content' (sidebar) or 'system' (API only)
- Content-edit: label 'Plugins', hide section if layout has no sidebar
- Content-edit: disable checkboxes when no sidebar layout selected
- Content-edit: hide up arrow on first item, down arrow on last item
- PluginManager: isPluginViewable() checks type=system -> not viewable
- Admin plugins page: show Content/Systeem type badge
- HTMLBlock: add plugin.json with type=content
- Navigation: add type=content to config
- border-radius: 0 on all dropdown-menu and dropdown-item
- padding: 0 and margin: 0 on dropdown-menu
- margin-left: 0 on submenu (no gap between parent and child)
- margin-top: -1px on submenu (seamless border overlap)
- CSS hover opens submenu on desktop, click on mobile
- white-space: nowrap on dropdown items
- Fix statistics getFullStats -> getStats
- Fix Twig ?? operator -> default filter on dashboard/statistics
- Asset server (public/asset.php) for production static file serving
- .htaccess rewrite rules for themes/admin/plugins assets
- Reorganize admin into admin/theme/default/ (views + assets)
- Rename GuideNav to Navigation plugin (essential, protected)
- Plugin assets support (SCSS/CSS) loaded after theme CSS
- User roles: Admin, Content Manager, BI Manager, Site Admin
- Role-based access control (RBAC) for admin routes and sidebar
- Guide restructure: sub-topics in separate folders with sidebar nav
- Dynamic breadcrumb for homepage and subdirectories
- Fix theme path traversal (../../ -> ../) in admin.php
- Fix CodeMirror mode load order (xml -> css -> js -> htmlmixed -> php)
- Fix editor-toolbar.js null checks for plugin edit pages
- Layout select from theme.json with live frontmatter update
- Footer sticky at bottom of viewport (min-height: 100vh)
- Breadcrumb color fix (var(--nav-font) -> var(--header-bg))
- Remove language switcher from guide pages
- Update README.md and README.en.md
- Bump version to 2.5.1
- handleUpdate(): set versionError flag and return 0.0.0 if version.php missing/invalid
- Dashboard stats: use 0.0.0 fallback instead of '-' when version cannot be determined
- Makes version.php truly required as intended
Major changes:
- New ThemeManager with Twig templating and SCSS compilation
- Dynamic themes system (themes/default, themes/demo)
- LogManager with SQLite storage and syslog forwarding
- RequestLogger with static helper methods
- Admin UI overhaul (Bootstrap 5, dark mode)
- Admin config page with logging and theme settings
- Admin logs page with filters and search
- Removed legacy Mustache templates
- Removed test plugin and theme
- Composer dependencies: Twig, scssphp, CommonMark, MaxMind GeoIP
World map:
- Fix zero-padded ISO numeric ids leaving 31 countries unrendered
(Brazil, Australia, Belgium, Austria, Algeria and more)
- Fix Russia and Fiji smearing across the full map width at the antimeridian
by unwrapping ring longitudes and drawing them at both edges
- Crop to 84N-60S, add evenodd fill rule, 174 countries rendered
Improvements:
- Logger::tail() reads backwards in chunks instead of loading the whole file
- External links get rel=noopener noreferrer in footer and Markdown content
- formatDisplayName() cleaned up and guarded against empty input
- Export statistics as CSV (Excel BOM) or JSON
- GeoIP database auto-updates when older than 35 days
- Editor shortcuts Ctrl/Cmd+S to save and Ctrl/Cmd+N for a new page
- Live search filter in the admin content browser
- Content versioning with timestamped .bak copies in content/-backups/
Also removes eight stale TODO entries that were already implemented
- Add GeoIP class with provider chain: local DB-IP Lite, MaxMind .mmdb, external API
- Add built-in pure-PHP MMDBReader so .mmdb works without Composer
- Add cli/geoip-update.php to download DB-IP Lite and build a compact binary index
- Add cli/generate-world-map.php to generate the world map SVG from Natural Earth TopoJSON
- Add Analytics class aggregating stats in admin/storage/stats.json with LOCK_EX
- Add admin statistics page with choropleth world map, country list, top pages,
daily chart, referrers and a period filter
- Add GeoIP and privacy settings with database update and stats reset buttons
- Add optional IP anonymization and configurable retention period
- Add country field to requests.log (parser accepts 7, 8 or 9 fields)
- Add country column to request log and KPI cards to the dashboard
- Ignore GeoIP binaries and stats.json in Git
- Update TODO.md, guides and version to 1.9.0
- Exclude config.json and admin.json in .gitignore so live settings/passwords are never overwritten by git
- Auto-generate config.json and admin.json with defaults if missing
- Add config.json.example and admin.json.example reference templates
- Add System Update page (/admin/update) in Admin Console to pull updates via Git with 1 click
- Log effective page name in index.php instead of literal 'auto'
- Add extra HAProxy/PFSense proxy headers to RequestLogger::getClientIp()
- Fix detectNewestPage() to search subdirectories recursively and handle language prefixes
- Fix getFileInfo() to preserve frontmatter created date or ctime instead of overwriting with mtime
- Automatically store created date in frontmatter when creating/editing files
- Add RequestLogger::getClientIp() with proxy and Cloudflare header support
- Replace domain column in request log with visitor/bot type badges (Human, AI, Search, Scraper)
- Update 'Activiteitenlog' to 'Activiteiten log' in UI and guide
buildUrl() hardcoded 'index' as the homepage, so the menu link for
index.md pointed at /nl. With a different default_page that root URL
served another page, making index.md unreachable.
- Add getEffectiveDefaultPage(): resolves 'auto' to the detected page
and caches the result
- buildUrl() now omits the page segment only for the effective default
page instead of the literal string 'index'
- Route getPage(), generateBreadcrumb(), getContentType() and the
render() template data (default_page, homepage, is_homepage,
home_active_class, current_page, lang switch URLs) through it
- getHomepageTitle() returns t('home') so the home button no longer
duplicates a menu item label
- Drop the now-redundant default_page skip in renderMenu() so every
page stays reachable from the menu
- getAllContentDirs() also skips dot-directories (.git) in the move
dropdown
- config.json now has default_page: auto for fresh installs
- CodePressCMS::detectDefaultPage() scans content/ for first available file
- getHomepageTitle() also respects auto mode
- Admin config form preserves auto as selectable option
- Save handler falls back to auto instead of index
- Move heading IDs from hidden permalink anchors to parent headings so deep links scroll correctly (admin.php)
- Change code block background from dark to light gray (guide.php)
- Add pre/code CSS to frontend layout.mustache for visible code blocks
- Nederlandse en Engelse handleiding hebben nu een inhoudsopgave
met anchors naar alle hoofdstukken op dezelfde pagina
- HeadingPermalinkExtension toegevoegd aan CommonMark configuratie
voor zowel frontend als admin markdown parsers
- Heading IDs gegenereerd voor elk kopje (## en lager)
- Nieuwe ContentAPI class beschikbaar als $api in PHP content bestanden
met methodes: getAllPages, getPage, getMenu, getConfig, buildUrl, etc.
- Admin handleiding pagina op /admin/guide met taalwisselaar
- Zijbalk link naar handleiding in admin menu
- Dubbele alert in config pagina verwijderd
- Handleidingen (nl/en) uitgebreid met Content API referentie
- Admin config pagina is nu een formulier met secties voor algemeen, taal,
SEO, auteur en features
- Startpagina instelbaar via dropdown met beschikbare pagina's uit content/
- Handleiding (nl/en) bijgewerkt met nieuwe configuratie-instructies
- Add .htaccess rewrite rules for clean URLs (/nl/page, /admin/route)
- Add PHP dev server router with clean URL support
- Update admin template asset paths to absolute for clean URL compat
- All pentest fixes verified: CSRF on login, directory listing disabled,
secure cookies, backup/sourcemap files removed, version disclosure off
- handleMediaList() now scans content/ recursively for all media files
- URLs use /-media/ prefix mapping directly to content/ (no special cases)
- index.php: added /-media/ route, kept /-assets/ for backward compat
- editor-toolbar.js: fixed editor.on('change') placement (was inside switchMode)
- content-edit.php and content-new.php: back-btn unsaved-changes detection
- Removed unused __editorCleanup global
File-based admin panel accessible at /admin.php with:
- Session-based auth with bcrypt hashing and brute-force protection
- Dashboard with site statistics and quick actions
- Content manager: browse, create, edit, delete files
- Config editor with JSON validation
- Plugin overview with status indicators
- User management: add, remove, change passwords
- CSRF protection on all forms, path traversal prevention
- Updated README (NL/EN) and guides with admin documentation
- Fix path traversal with realpath() validation in getPage() and executePhpFile()
- Remove insecure JWT secret fallback, require JWT_SECRET env var
- Fix IP spoofing by only trusting proxy headers from configured proxies
- Add Secure/HttpOnly/SameSite flags to all cookies
- Use env var for debug mode instead of hardcoded true
- Fix operator precedence bug in MQTTTracker track_user_flows check
- Remove dead code: duplicate is_dir() block, unused scanForPageNames()
- Remove htmlspecialchars() from filesystem path operations
- Remove duplicate require_once calls and redundant autoloader includes
- Fix unclosed </div> in getDirectoryListing()
- Escape breadcrumb titles and add lang param to search result URLs
- Make language prefixes dynamic from config instead of hardcoded nl|en
- Make HTML lang attribute dynamic, add go_to translation key
- Add aria-label/aria-expanded to sidebar toggle for accessibility
- Fix event listener leak in app.js using event delegation
- Remove console.log from production code
- Update guides (NL/EN) with sidebar toggle documentation
- Add TODO.md documenting all identified improvements
Move sidebar toggle from sidebar panel to breadcrumb navigation, positioned
left of the HOME icon. Uses distinct icons for open (sidebar-inset) and
closed (sidebar) states. Sidebar state persists via sessionStorage. Remove
old non-functional toggle buttons from layout and HTMLBlock plugin.
E.Noorlander
root