kernel/includes, branch master

kernel: load mConfig before checkEnvironment writes to it

2026-06-06T22:35:20Z

checkEnvironment() called setConfig() to record site_server_type before mConfig had been loaded from the database. This left mConfig non-empty with only the server-type entry, so the subsequent empty() guard in loadConfig() short-circuited and site_title was never loaded. Result: getSiteCookieName() fell back to 'bit-user-bitweaver' on every request where checkEnvironment() ran first, creating a second spurious cookie alongside the real 'bit-user-' cookie and splitting sessions. Fix: call loadConfig() at the top of checkEnvironment() if mConfig is not yet populated, matching the pattern used elsewhere. The bit-user-bitweaver fallback is now only reached during a genuine cold install. Co-Authored-By: Claude Sonnet 4.6

kernel: revert installer login redirect attempts

2026-06-06T22:04:38Z

The signin/loginfrom session approach didn't work reliably due to session name inconsistency. Revert to original force_installer.tpl display. Use gOverrideLoginFunction for upgrade-time admin access. Co-Authored-By: Claude Sonnet 4.6

kernel: redirect non-admin to signin when INSTALLER_FORCE is active

2026-06-06T21:46:23Z

Replace the inline login form (which suffered from session cookie name inconsistency) with a direct redirect to signin.php. The post-login redirect to install.php is now handled by validate.php checking the version mismatch directly, which is session-independent. Co-Authored-By: Claude Sonnet 4.6

kernel: set loginfrom to installer before force_installer.tpl display

2026-06-06T21:30:06Z

After login via validate.php, redirect back to the installer rather than the site homepage, so the admin can proceed with the upgrade without having to navigate back manually. Co-Authored-By: Claude Sonnet 4.6

kernel: fix site_closed login bypass for nginx (SCRIPT_URL not set)

2026-06-06T19:55:21Z

SCRIPT_URL is an Apache-only variable — nginx does not set it unless explicitly added to fastcgi_params. When site_closed is active, validate.php needs to bypass the gate so admins can log in, but the SCRIPT_URL check always failed on nginx, making login impossible while the site is closed. Fall back to PHP_SELF (set by nginx) when SCRIPT_URL is absent. Co-Authored-By: Claude Sonnet 4.6

BitSystem: replace TikiWiki placeholder with architecture docblock

2026-06-06T14:18:26Z

Covers the six concerns: package registry (registerPackage/scanPackages/ registerAppMenu), configuration (kernel_config, getConfig/storeConfig), display pipeline (display/fatalError/fatalPermission), permissions and access guards, installer schema registration (register* family / verifyInstalledPackages), and utilities (MIME, versioning, date/time, navigation). Co-Authored-By: Claude Sonnet 4.6

BitBase: replace TikiWiki placeholder with architecture docblock

2026-06-06T14:12:22Z

Covers the four concerns: DB connection, mInfo/mErrors data hash, APCu object caching, and list utilities (prepGetList/postGetList). Co-Authored-By: Claude Sonnet 4.6

Bump BIT_SUB_VERSION to 1 — getBitVersion() was still returning 5.0.0

2026-06-01T16:17:57Z

Co-Authored-By: Claude Sonnet 4.6

Bump version to 5.0.1

2026-06-01T15:59:50Z

Co-Authored-By: Claude Sonnet 4.6

Return early from bit_redirect() if URL is null or empty

2026-06-01T11:33:40Z

Co-Authored-By: Claude Sonnet 4.6