[fiammybe]

What

All admin screens for imforum, built on icms_ipf_view_Table and getSecureForm():

• Categories and forums: moderators as a multi-select on the forum form, and group permissions per forum. A new forum starts with the groups from the permission template.
• Permission template: stored in its own table, and can optionally be applied to existing forums, replacing their permissions.
• Reports (open/all toggle), suspensions (per forum or everywhere), digests and the archive.
• Prune: a preview with a count, then a confirmation; topics are deleted or moved to another forum. Recount resyncs every counter in a few queries.
• Overview with statistics and a link to open reports.

Security

imforum_admin_op() runs every write operation only on POST with a valid token. A deletion confirmation (confirm=1) needs a valid token too, because icms_ipf_Controller does not check it.

Core issues worked around

These were found by installing ImpressCMS 2.0.4 through the web installer, installing imforum and clicking through every screen:

1. Missing admin menu on the first request after a cache rebuild. The core include_onces menu.php into another module object, so displayAdminMenu() fails on count(null). imforum_admin_menu() loads the menu itself.
2. Empty permission select. A permission select left empty is not posted, and saveItem_Permissions() fails on count(null). imforum_admin_store() turns missing fields into empty arrays first.
3. Date picker built too early. The date picker needs $xoTheme, so forms are passed as closures and rendered after icms_cp_header().

Tests

• Unit tests: the token rule (AdminRequestTest), and each menu entry pointing to an existing script with the right tab index.
• Integration tests (AdminToolsTest): moderators via the forum form, hidden counters that get recounted, synchroniseAll, findInactive and moveToForum.
• End-to-end check on a real installation: one category, two forums, moderators and group permissions created without SQL. A POST with a forged token, a write via GET and a tokenless deletion confirmation were all refused. Prune deleted the matching topics.

---

Generated by Claude Code