Skip to content

refactor: modernize for PHP 8.x and current DokuWiki#34

Open
teal-bauer wants to merge 1 commit into
turnermm:masterfrom
c3lingo:refactor/php8-modernize
Open

refactor: modernize for PHP 8.x and current DokuWiki#34
teal-bauer wants to merge 1 commit into
turnermm:masterfrom
c3lingo:refactor/php8-modernize

Conversation

@teal-bauer
Copy link
Copy Markdown

Summary

  • PHP 8.x compat: Replace raw $_GET/$_POST/$_REQUEST/$_SERVER access with DokuWiki's $INPUT API, eliminating undefined array key warnings
  • Modern DokuWiki classes: Use namespaced ActionPlugin, AdminPlugin, EventHandler instead of legacy DokuWiki_Action_Plugin etc.; drop require_once (autoloaded)
  • Drop legacy form path: Remove HTML_REGISTERFORM_OUTPUT hook and old-form code branches ($event->data->_hidden, $event->data->_content), keep only dokuwiki\Form\Form
  • Auth API for user lookup: Replace is_user() file-based plainauth parsing with $auth->getUserData() — works with any auth backend
  • Deprecated function fixes: strftime()date(), ptln()echo, var → typed property
  • Safer deserialization: Add ['allowed_classes' => false] to all unserialize() calls
  • Security: Escape admin panel hidden input values with hsc(), build confirmation URLs via wl() instead of manual string concatenation
  • Cleanup: Tighten MD5 regex to [a-f0-9]{32}, remove unused write_debug(), add return types, fix double semicolons

Technical Notes

  • Tested on DokuWiki 2025 "Librarian" with PHP 8.2: full registration flow (form → captcha → email → confirmation link → account creation), duplicate user detection, and admin panel all work without PHP warnings or deprecation notices
  • is_user() now uses the auth API, so this works with any auth backend (not just plainauth)
  • wl() generates correct URLs regardless of the wiki's URL rewriting mode

- Replace legacy class names with namespaced equivalents
  (ActionPlugin, AdminPlugin, EventHandler)
- Remove require_once imports (autoloaded)
- Replace raw superglobal access with DokuWiki $INPUT API
- Remove HTML_REGISTERFORM_OUTPUT hook and legacy form code paths
- Replace is_user() file-based lookup with $auth->getUserData() API
- Replace deprecated strftime() with date(), var with typed property
- Add ['allowed_classes' => false] to all unserialize() calls
- Fix XSS: escape hidden input values with hsc() in admin panel
- Fix URL construction: use wl() instead of manual string concat
- Tighten MD5 regex to [a-f0-9]{32}, remove double semicolons
- Remove unused write_debug() method
- Add return types to all methods
- Clean up indentation and trailing whitespace
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant