Scriptlog Files

v1.8.0 — Settings Cache, Security Hardening & PHP 8.5 Compatibility

Codename: Maleo Senkawor

Highlights

• Centralized settings cache — app_settings() reads all tbl_settings rows once per request into a memoized map, eliminating per-call database queries across app_info(), app_reading_setting(), app_sitename(), app_tagline(), and app_url()
• Database-driven Page Cache admin UI — Enable/disable full-page caching and configure cache lifetime (60–86400 seconds) directly from General Settings
• safe_zip_extract() — Defense-in-depth wrapper blocking path traversal, symlink escapes, zip bombs, and null-byte injection in plugin/theme uploads
• sanitize_post_content() — Strips style attributes and on* event handlers from post HTML
• SRI integrity hash sync — sync_integrity_hashes() recomputes sha384 hashes in theme templates after asset regeneration
• Db statement cache — prepareCached() reuses PDOStatement instances for identical SQL within a request (capped at 64)
• applyTablePrefix() single-pass regex — Replaced per-table loop with a compiled alternation pattern sorted longest-first
• Theme caller memoization — theme_dir() and theme_identifier() cache per request
• Full PHP 8.5 compatibility — Updated 14 admin templates, controllers, DAOs, and utilities for PHP 8.5 deprecations

Security

• safe_zip_extract() defends against path traversal, symlink escapes, zip bombs, and null-byte injection
• sanitize_post_content() strips style and on* attributes from post HTML
• Polyglot image defense via GD/WebP library re-encoding
• hash_equals() for rate-limiter timing attack prevention
• IP-only bucket key eliminates API key header bypass
• basename() sanitization in PluginService
• script-src-attr 'none' CSP directive

Breaking Change

PageCache OOP class removed — Replaced by procedural page-cache.php functions with database-driven cache enable and TTL settings.

Upgrade Notes

No migration required. The cache_enabled and cache_lifetime settings are automatically seeded during fresh installs. Existing installations will use the APP_CACHE constant as fallback until settings are configured via the admin UI.

59 files changed · 78 commits · 2,527 tests, 4,548 assertions, 0 failures

Full [Changelog](https://github.com/cakmoel/Scriptlog/blob/main/CHANGELOG.md#180