LogAnalyzer v5.0.2

Change log (from repository ChangeLog)

Version 5.0.2, 2026-09-28

• Security fixes & hardening
  • Reporter credit: Thank you to @KHr00t for responsibly reporting the security issues addressed in this release.
  • Prevent SQL injection in chart ordering and database-source mappings by validating supported identifiers and using parameterized database operations, including validation of persisted mappings.
  • Harden reflected and stored HTML output across administration, source, user, error, and confirmation views; constrain redirects to safe internal destinations.
  • Restrict disk-source reads to canonical, readable regular files beneath configured allowed directories, including protection against traversal, symlink escapes, and path-prefix collisions.
  • Validate numeric query filters, strengthen session handling, and constrain generated report-file paths and output.
  • Add PHPUnit and Playwright regression coverage for the security boundaries and affected workflows.
• UI / themes
  • Credit: Modernization and flattened-layout direction inspired by community PR #73 (Simplified Layout, 2021) from @Alfa-Soft — #73 — reworked for the current tree rather than merged verbatim.
  • Add optional modern theme (themes/modern/): flat slate styling for main.css and jquery-ui-theme.css; neutral about.txt metadata (directory key modern only).
  • Modern theme refresh: CSS design tokens (:root), system font stack, lighter surfaces and shadows, clearer focus rings (:focus-visible), refined table and severity chip styling, and jQuery UI alignment (8px radii, shared slate/blue palette).
  • Details popup (grid → syslog link): dialog titlebar tied to theme; hide duplicate inner .title row; soften #EventItemDetails label cells for contrast, padding, and vertical alignment inside .ui-dialog.
  • Modern jQuery UI: ui-state-default surfaces (toolbars, selectmenu triggers, dialog chrome) use flat #fff with no background texture; hover/focus stay white with a stronger border, active stays white with the existing accent border/text; menu dropdown rows and datepicker day hovers use #f1f5f9 so highlights remain visible on white panels; checkbox/radio icon boxes drop the structure inset shadow for a clean white control.
  • Modern theme assets: ship themes/modern/images/ (jQuery UI ui-icons sprites aligned with jquery-ui-theme.css, plus bg_bottom.gif for include_footer.html) so controls and the footer bar do not 404 when the theme is active.
  • Modern polish (visual review): remove stray table cell / bad </span> closures in index.html SearchPanel; flatten native + jQuery UI buttons (appearance, no box-shadow); white multi-select list surfaces; tighter cell/dialog padding; dialog button pane float containment + table margin so the last detail row is not crowded; slightly brighter report title links on slate headers.
  • ViewDefaultTheme in config.sample.php is modern for new installs (installer output, Docker-generated config.php). Existing sites keep whatever is already in config.php and the user DB; PHP fallbacks for missing keys remain default so behaviour does not change until an operator updates settings.
  • Style selector list picks up new themes via existing filesystem scan.
• Templates & accessibility tidy
  • Remove deprecated align="left" from toolbar/menu <img> elements; align via css/defaults.css (#menu buttons, top-menu links, search form).
  • Stable hooks: #SearchPanel, #ProjectPanel, #PagerTop on main index chrome; #MainMenuPanel around the primary menu; #EventItemDetails on the detail view field table.
  • Main menu: Help and KB controls moved after authentication / user actions (before maximise).
• Robustness & i18n
  • DieWithErrorMsg / DieWithFriendlyErrorMsg: fix invalid extra <tr> in the auxiliary error table; normalise detail rows; correct friendly-error footer cell markup; trim redundant padding <br> in error cells (functions_common.php).
  • Export placeholder copy: strip decorative > / < from LN_GEN_SELECTEXPORT in en/de/es/ja main.php.
  • PHP 8.1+: cast event timestamps to int before date() in disk consolidation/chart helpers, grid date formatting, DB/PDO/ClickHouse date-range filters, and export filenames; fix wrong field variable in disk ConsolidateItemListByField / ConsolidateDataByField date grouping (#132, thanks @KDocProf).
• E2E / Playwright
  • Modern theme visual review: switch session style via userchange.php, assert theme stylesheets, capture modern-01…modern-05 screenshots under e2e/test-results/ci-visual/ (index grid, details dialog, admin index, advanced search, reports).
• Bug fixes
  • PDO syslog summary per-host filter (#71, PR #129): ConsolidateDataByField in logstreampdo.class.php now regenerates the WHERE clause for each grouped value so per-host filtering is applied correctly in syslog summary reports.
  • DB source mapping deletion (#61, PR #128): fix illegal-string-offset PHP warnings when deleting multiple rows from a DB source mapping; the row-index loop now operates on the correct array structure.

---

Commits and pull requests (auto-generated by GitHub)

What's Changed

• LogAnalyzer v5.0.1: Docker handbook & seeding, admin/grid/export fixes, Playwright regression by @alorbach in #124
• Add modern theme, template/CSS hygiene, and 5.0.2 changelog by @alorbach in #125
• fix: validate disk paths start-with allowed prefix (fixes #16) by @alorbach with @Copilot in #126
• fix: reject duplicate FieldID on add-new-field instead of silently overwriting by @alorbach with @Copilot in #127
• Fix illegal string offset warnings when deleting multiple DB mapping rows (issue #61) by @alorbach with @Copilot in #128
• fix: per-host filter not applied in syslogsummary PDO ConsolidateDataByField by @alorbach with @Copilot in #129
• Release 5.0.2: ChangeLog bug fixes + README screenshot refresh by @alorbach with @Copilot in #130
• Fix PHP 8 date() timestamp casts (fixes #132) by @alorbach in #133
• security: bump pymdown-extensions to 11.0.1 for CVE-2026-67422 by @alorbach in #134
• Harden security boundaries and regression coverage by @alorbach in #135

Full Changelog: v5.0.1...v5.0.2