[TikiWiki-commits] [Git][tikiwiki/tiki][master] [FIX] Tiki Admin: .htaccess mismatch notice should be info, not warning; diff...

Benoit Grégoire pushed to branch master at Tiki Wiki CMS Groupware / Tiki


Commits:
329ce27d by Alfred Syatsukwa at 2026-08-27T15:23:06+00:00
[FIX] Tiki Admin: .htaccess mismatch notice should be info, not warning; diff no longer over-escapes
---
* [FIX] .htaccess: mismatch notice is info; diff no longer over-escapes

See merge request tikiwiki/tiki!11066

- - - - -


4 changed files:

- lib/core/Tiki/Security/HtaccessChecker.php
- lib/test/Core/Security/HtaccessCheckerTest.php
- templates/tiki-admin.tpl
- templates/tiki-admin_security.tpl


Changes:

=====================================
lib/core/Tiki/Security/HtaccessChecker.php
=====================================
@@ -8,7 +8,8 @@ namespace Tiki\Security;
 
 use RecursiveDirectoryIterator;
 use RecursiveIteratorIterator;
-use Tiki\Lib\Diff\DiffUtils;
+use Tiki\Lib\Diff\Renderer\Unified;
+use Tiki\Lib\Diff\TextDiff;
 
 /**
  * Performs integrity checks on the active webroot .htaccess compared to the shipped _htaccess reference.
@@ -243,7 +244,8 @@ class HtaccessChecker
     }
 
     /**
-     * Build a lightweight unified diff representation between reference and active contents.
+     * Line-based unified diff. Avoid character-level HTML (ins/del): .htaccess
+     * contains Apache tags that the template must escape once for display.
      *
      * @param string $reference
      * @param string $active
@@ -251,7 +253,24 @@ class HtaccessChecker
      */
     private function buildUnifiedDiff(string $reference, string $active): ?array
     {
-        $diff = DiffUtils::diff2($reference, $active, 'unidiff');
-        return empty($diff) ? null : $diff;
+        $old = $reference === '' ? [] : explode("\n", $reference);
+        $new = $active === '' ? [] : explode("\n", $active);
+
+        $diff = new TextDiff($old, $new);
+        if ($diff->isEmpty()) {
+            return null;
+        }
+
+        $renderer = new class (2) extends Unified {
+            // phpcs:ignore PSR2.Methods.MethodDeclaration.Underscore -- overrides Unified::_changed
+            protected function _changed($orig, $final)
+            {
+                $this->_deleted($orig);
+                $this->_added($final);
+            }
+        };
+
+        $table = $renderer->render($diff);
+        return empty($table) ? null : $table;
     }
 }


=====================================
lib/test/Core/Security/HtaccessCheckerTest.php
=====================================
@@ -72,6 +72,36 @@ class HtaccessCheckerTest extends TestCase
         $this->assertNotEmpty($result['diff']);
     }
 
+    public function testMismatchDiffIsPlainTextWithoutCharacterHtml(): void
+    {
+        $this->createFile(
+            $this->tempDir . '/_htaccess',
+            "<IfModule mod_rewrite.c>\nRewriteEngine On\n#<Files tags>\n</IfModule>\n"
+        );
+        $this->createFile(
+            $this->tempDir . '/.htaccess',
+            "<IfModule mod_rewrite.c>\nRewriteEngine Off\n#<Files tags>\n</IfModule>\n"
+        );
+
+        $checker = new HtaccessChecker();
+        $result = $checker->run($this->tempDir, $this->tempDir . '/_htaccess', ['server_software' => 'Apache/2.4']);
+
+        $this->assertSame(HtaccessChecker::STATUS_MISMATCH, $result['status']);
+        $this->assertIsArray($result['diff']);
+
+        $types = array_column($result['diff'], 'type');
+        $this->assertContains('diffdeleted', $types);
+        $this->assertContains('diffadded', $types);
+
+        $serialized = serialize($result['diff']);
+        $this->assertStringNotContainsString('<ins', $serialized);
+        $this->assertStringNotContainsString('<del', $serialized);
+        $this->assertStringContainsString('<IfModule mod_rewrite.c>', $serialized);
+        $this->assertStringContainsString('#<Files tags>', $serialized);
+        $this->assertStringContainsString('RewriteEngine On', $serialized);
+        $this->assertStringContainsString('RewriteEngine Off', $serialized);
+    }
+
     public function testMissingHtaccessReportedAsNotApplicable(): void
     {
         $this->createReference();


=====================================
templates/tiki-admin.tpl
=====================================
@@ -140,7 +140,7 @@
             {/if}
 
             {if $htaccess_global_warning}
-                {remarksbox type="warning" title="{tr}.htaccess differs from the bundled _htaccess{/tr}"}
+                {remarksbox type="info" title="{tr}.htaccess differs from the bundled _htaccess{/tr}"}
                     <p class="mb-2">
                         {tr}Your active <code>.htaccess</code> does not match the reference <code>_htaccess</code> shipped with Tiki.{/tr}
                     </p>


=====================================
templates/tiki-admin_security.tpl
=====================================
@@ -17,7 +17,7 @@
 {assign var=htStatus value=$htaccessCheck.status}
 
 {if $htStatus == 'mismatch'}
-    {remarksbox type="warning"}
+    {remarksbox type="info"}
     {tr}.htaccess differs from the bundled _htaccess.{/tr}
     <div class="mt-2 d-flex flex-wrap gap-2">
         <a class="btn btn-outline-secondary btn-sm" href="{$htaccessDocsUrl|escape}" target="_blank" rel="noopener">



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/329ce27d7ea3c2ab25cbf0a4664ce32cdc409733

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/329ce27d7ea3c2ab25cbf0a4664ce32cdc409733
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs