[fiammybe]

What

Posting, replying, editing and deleting, attachments, notifications and the rules around them. Moderation from the front end (move, merge, split, lock, approve, reports) stays in phase 5.

How

• PostService holds every rule: the permissions forum_post, forum_reply, forum_edit, forum_delete, forum_attach and forum_noapprove, suspensions, a flood limit, a time limit for members, locked topics, what the forum allows (HTML, signature, prefix), approval and the edit history. Members delete only their own last post of a topic.
• post.php is a thin controller on the IPF secure form, with preview, disclaimer and a captcha for guests. Everything that writes is a POST with a token, and the request is read field by field, so extra fields change nothing.
• Attachments: Uploader checks the extension against the forum list and a list that is never accepted, plus the size. Files get a random name without extension in a folder with a deny-all .htaccess. attachment.php checks read permission and the karma lock, counts the download and always sends it as a download.
• Notifications use the core system for a topic, a forum and all forums. Only members who may read the forum are told, and the mail never holds the text of a post.
• Quick reply under a topic (not for guests when the captcha is on), topic prefixes and the disclaimer come from the preferences.

Decisions to look at

• Post text is stored as typed (XOBJ_DTYPE_OTHER). The IPF textarea type runs every text through HTMLPurifier when saving, which turned [b] into HTML for good and made the HTML, smiley and line break switches of a post meaningless. The text is made safe when shown, and the edit form escapes it.
• Welcome post is left out. The core has no event for a new registration to hook it on. The plan allowed moving it to 1.1.
• The suspension check is already in the write permissions, because post.php is the gate. Phase 5 adds the screens.

Testing

• 70 integration tests (MySQL 5.5, 5.7 MyISAM, MariaDB 10.11 in CI), 40 unit tests, PHPStan level 6.
• Clicked through on ImpressCMS 2.0.4 as guest, two members and webmaster: new topic that waits for approval, attachments (a .php is refused even when the forum lists it, as is a file over the limit), quick reply, quote, preview, edit with history, delete, flood, time limit, captcha for guests, a notification message to a subscriber. Found and fixed along the way: notification titles were not translated, and notification_update.php was missing.
• Not verifiable yet: comparison with migrated data (phase 7).

---

Generated by Claude Code