XC_VM

1,654 Commits 3 Branches 57 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
rootandClaude Opus 5	0d06fff983	fix(security): confirmIDs returns the integers it checked InputValidator::confirmIDs() kept an id when intval($id) > 0 but returned the original value, and its callers implode the result into SQL `IN (...)` lists (mass edit and delete of lines, users, streams, series; bouquet contents; global search). '1) OR (1=1' has an intval of 1, so it passed the filter and reached the query unchanged. It now returns the integers. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V2uBUbGApb4A7Rbcoi7dxA	2026-09-17 07:45:48 +00:00
Divarion-D	da291e20f8	chore(psr4): phase 3 (Core) — namespace remaining Core subdirs Namespace the rest of Core, completing the Core layer: - Backup, Boundary, Cache (CacheInterface/FileCache/RedisCache), Diagnostics, GeoIP (GeoIPService/MaxMindUpdater), Init (LegacyInitializer), Localization (Translator), Process (Thread/Multithread/ProcessManager), Updates (GitHubReleases), Util (NetworkUtils, AdminHelpers, Encryption, GeoIP, ImageUtils/ImageResizeService, Mobile_Detect, StreamUtils, SystemInfo, TimeUtils), Validation (InputValidator) → XcVm\Core\<Subdir>. - Rename GithubReleases.php → GitHubReleases.php so the file matches its class name (PSR-4 is case-sensitive); fix the WebApiBootstrap require accordingly. - Qualify built-ins (\Exception, \DateTime, \DateTimeZone, \Redis, \RuntimeException, \BadMethodCallException, ...) and still-global deps (\ServerRepository, \CacheReader, \DatabaseFactory, \BouquetService, \CategoryService, \FfmpegPaths, \StreamSorter, \XC_VM). LegacyInitializer's Domain calls stay \-qualified (the known Core→Domain exception). - Add use to referrers; fix leading-backslash refs from earlier commits; fix string class refs class_exists('Translator'/'NetworkUtils'/...) → ::class. Remove the duplicate global 'use BoundaryInterface;' in MinistraModule. - phpstan-baseline.neon regenerated. Core is now fully namespaced (procedural constant/error/RequestGuard files stay global by design; M3uParser/PhpM3u8 remain vendored). Verified: php -l clean; PHPStan no errors; PHPUnit 295/295; leading-backslash re-sweep clean.	2026-06-24 22:35:33 +03:00
Divarion-D	e737025ff8	test: add targeted PHPUnit setup and docs, fix GitHubReleases cache switching - add PHPUnit bootstrap and config under tests/ - add focused unit tests for GitHubReleases, InputValidator and FfmpegPaths - fix GitHubReleases cache file handling when switching update channel - document PHPUnit PHAR usage and debug run commands in RU/EN docs - document SFTP sync for tests/ and contributor test workflow - remove broad smoke coverage approach in favor of per-file tests	2026-04-17 22:55:54 +03:00

Author

SHA1

Message

Date

rootandClaude Opus 5

0d06fff983

fix(security): confirmIDs returns the integers it checked

InputValidator::confirmIDs() kept an id when intval($id) > 0 but returned
the original value, and its callers implode the result into SQL `IN (...)`
lists (mass edit and delete of lines, users, streams, series; bouquet
contents; global search). '1) OR (1=1' has an intval of 1, so it passed the
filter and reached the query unchanged. It now returns the integers.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V2uBUbGApb4A7Rbcoi7dxA

2026-09-17 07:45:48 +00:00

Divarion-D

da291e20f8

chore(psr4): phase 3 (Core) — namespace remaining Core subdirs

Namespace the rest of Core, completing the Core layer:
- Backup, Boundary, Cache (CacheInterface/FileCache/RedisCache), Diagnostics,
  GeoIP (GeoIPService/MaxMindUpdater), Init (LegacyInitializer), Localization
  (Translator), Process (Thread/Multithread/ProcessManager), Updates
  (GitHubReleases), Util (NetworkUtils, AdminHelpers, Encryption, GeoIP,
  ImageUtils/ImageResizeService, Mobile_Detect, StreamUtils, SystemInfo,
  TimeUtils), Validation (InputValidator) → XcVm\Core\<Subdir>.
- Rename GithubReleases.php → GitHubReleases.php so the file matches its class
  name (PSR-4 is case-sensitive); fix the WebApiBootstrap require accordingly.
- Qualify built-ins (\Exception, \DateTime, \DateTimeZone, \Redis,
  \RuntimeException, \BadMethodCallException, ...) and still-global deps
  (\ServerRepository, \CacheReader, \DatabaseFactory, \BouquetService,
  \CategoryService, \FfmpegPaths, \StreamSorter, \XC_VM). LegacyInitializer's
  Domain calls stay \-qualified (the known Core→Domain exception).
- Add use to referrers; fix leading-backslash refs from earlier commits; fix
  string class refs class_exists('Translator'/'NetworkUtils'/...) → ::class.
  Remove the duplicate global 'use BoundaryInterface;' in MinistraModule.
- phpstan-baseline.neon regenerated.

Core is now fully namespaced (procedural constant/error/RequestGuard files stay
global by design; M3uParser/PhpM3u8 remain vendored). Verified: php -l clean;
PHPStan no errors; PHPUnit 295/295; leading-backslash re-sweep clean.

2026-06-24 22:35:33 +03:00

Divarion-D

e737025ff8

test: add targeted PHPUnit setup and docs, fix GitHubReleases cache switching

- add PHPUnit bootstrap and config under tests/
- add focused unit tests for GitHubReleases, InputValidator and FfmpegPaths
- fix GitHubReleases cache file handling when switching update channel
- document PHPUnit PHAR usage and debug run commands in RU/EN docs
- document SFTP sync for tests/ and contributor test workflow
- remove broad smoke coverage approach in favor of per-file tests

2026-04-17 22:55:54 +03:00