Poznote 6.81.0-beta
Prerelease. Mostly internal restructuring, published as a beta so it can be tried without anyone on the :6 or :latest tag picking it up.
✨ New
- Deleting a table from the context menu now works for Markdown tables.
🐛 Fixes
- Saving a folder's sort order failed silently. The endpoint loaded
config.php
twice and died onCannot redeclare _env(), so the order was never stored. - Exported notes kept the language badge on code blocks. Backups already removed
it; the two copies of that cleanup had drifted apart. - Dragging a note onto a spacer between notes could miss its target.
- Markdown rendering is more consistent between rich-text and Markdown notes.
🔒 Hardening
- The shared PHP files (
functions.php,auth.php,db_connect.php, the API
controllers and 50 others) are no longer reachable by URL. They were served
before, and while none of them leaked anything, they were only safe by
accident. The web root is now a directory that contains only the pages meant
to be requested. i18n/,version.txtand the note templates are no longer readable either.
⚠️ For anyone using the REST API
Error responses now carry a real HTTP status code. They used to answer 200
with {"success": false, ...}, which made a failure indistinguishable from a
success for any client checking the status. The response bodies are unchanged,
so a client reading success or error from the body needs no change; a client
checking the status code will start seeing 400, 404, 413, 500 or 502.
🧹 Under the hood
functions.phpsplit into eighteen modules, and the seven oversized browser scripts became focused modules.- The three largest functions were broken up, the biggest going from 760 lines to a 45-line dispatch.
- Dead CSS and lines of unreachable JavaScript removed.
- Every silently swallowed exception now leaves a trace in the logs.
- A test suite, and PHP linting, unit tests, static analysis and JavaScript linting now run in CI, alongside the Docker image build.