add GfmNumericEntity for CommonMark numeric character references

Decodes &#nnn; (decimal, 1-7 digits) and &#xhhh; / &#Xhhh; (hex,
1-6 digits) to the corresponding Unicode codepoint, emitted as
plain

add GfmNumericEntity for CommonMark numeric character references

Decodes &#nnn; (decimal, 1-7 digits) and &#xhhh; / &#Xhhh; (hex,
1-6 digits) to the corresponding Unicode codepoint, emitted as
plain cdata. Codepoint 0, codepoints above U+10FFFF, and the
surrogate range U+D800..U+DFFF map to U+FFFD per the spec.

Distinct from the typography Entity mode, which is renderer-side
configurable via entities.conf. Numeric refs are not configurable
so decoding happens at parse time and the renderer needs no
changes.

Lexer leftmost-match consumes the run before any structural
pattern, so *foo* renders as literal *foo* and * foo
does not start a list - matching the spec rule that numeric refs
cannot stand in for structural markers.

show more ...

rename syntax flavors 'dokuwiki' / 'markdown' to 'dw' / 'md'

Symmetry with the existing 'dw+md' / 'md+dw' setting values.

add GfmLinebreak for GFM hard line breaks

Two-or-more trailing spaces, or a single backslash, immediately before
a non-final newline render as a `<br/>`. Both delimiter forms share a
single SUBSTITI

add GfmLinebreak for GFM hard line breaks

Two-or-more trailing spaces, or a single backslash, immediately before
a non-final newline render as a `<br/>`. Both delimiter forms share a
single SUBSTITION mode at sort 140, loaded under any MD-active syntax
(markdown, dw+md, md+dw); pure dokuwiki is unaffected.

Reuses the existing `linebreak` handler call and renderer; no new
instructions or renderer changes. SpecCompatRenderer overrides
linebreak() to emit the spec's `<br />` shape. Examples 662, 663
(line break inside a raw HTML tag) are skipped — raw HTML is not
passed through by default.

show more ...

�� Rector and PHPCS fixes

Translation update (tr)

replace DW Hr with unified GfmHr

Single mode covers both DokuWiki (4+ dashes) and GFM (3+ of -/*/_)
horizontal rules; pattern self-narrows on $conf['syntax']. Always
loaded across all four syntax se

replace DW Hr with unified GfmHr

Single mode covers both DokuWiki (4+ dashes) and GFM (3+ of -/*/_)
horizontal rules; pattern self-narrows on $conf['syntax']. Always
loaded across all four syntax settings, mirroring the GfmQuote
replacement pattern. Same `hr` handler call so renderers and the
call API are unchanged.

Drops DW's old [ \t]* leading-whitespace tolerance — inert in
practice past 0-1 spaces (Preformatted at sort 20 intercepts
everything ≥ 2 spaces or any tab).

Spec examples 13, 20, 26-28, 224 turn green; 17, 21-24, 29, 30, 31
go to skip.php as deliberate non-implementations (whitespace
tolerance and list-precedence cases).

show more ...

replace DW Quote with unified GfmQuote

GfmQuote covers blockquote parsing for both DokuWiki and GFM dialects
in a single mode. Same quote_open/quote_close handler instructions; a
DW-preferred post-p

replace DW Quote with unified GfmQuote

GfmQuote covers blockquote parsing for both DokuWiki and GFM dialects
in a single mode. Same quote_open/quote_close handler instructions; a
DW-preferred post-pass flattens sub-parsed paragraph wrapping into
linebreak calls so existing pages keep their <br/>-between-lines
rendering. MD-preferred keeps the <p>-wrapped spec shape.

Block content (lists, fenced code, tables) inside `>` quotes now
renders, since the body is sub-parsed. Headers stay excluded
(BASEONLY) — TOC and section-edit anchors don't compose with
<blockquote>, same rationale as GfmListblock.

Convert ModeRegistry's sub-parser cache into an acquire/release pool
to support same-key re-entrancy: a list inside a quote re-enters
gfm_quote during the list-item sub-parse, and the inner call needs
its own parser instance even though the exclusion key matches.
GfmListblock is updated to use the new acquire/release primitives.

show more ...

add listo_open_start sibling method for GFM start numbers

Reverts the listo_open signature widening from 5a2118acc and instead
adds a sibling method `listo_open_start($start = 1)` on the renderer
hi

add listo_open_start sibling method for GFM start numbers

Reverts the listo_open signature widening from 5a2118acc and instead
adds a sibling method `listo_open_start($start = 1)` on the renderer
hierarchy. The base default delegates to listo_open() so renderers
that don't override it still produce a valid (but unnumbered) list;
xhtml's override emits <ol start="N">.

The handler now emits 'listo_open_start' only for ordered lists with
a non-default first number; plain ordered lists keep emitting the
unchanged 'listo_open' instruction. This preserves the historical
listo_open / listu_open signatures (zero-arg base, $classes-only
xhtml form from 2016) so the 17 plugin renderers found via
codesearch keep working without modification, while still
implementing GFM's "5. foo" -> <ol start="5"> rule.

show more ...

Translation update (fr)

add GfmEscape for GFM backslash escapes

Implements GFM §6.1 backslash-escape handling. GfmEscape is a sort-5
inline mode in CATEGORY_SUBSTITION that claims `\X` for any escapable
ASCII punctuation c

add GfmEscape for GFM backslash escapes

Implements GFM §6.1 backslash-escape handling. GfmEscape is a sort-5
inline mode in CATEGORY_SUBSTITION that claims `\X` for any escapable
ASCII punctuation char before competing delimiters can match. The
shared character class lives on Helpers\Escape so the lexer pattern
and the post-hoc unescape stay in lockstep.

Whole-span captures (GfmCode info string, GfmLink label/URL) bypass
the lexer; those modes call Escape::unescapeBackslashes() on the
relevant slot. GfmLink skips the unescape when the URL classifies as
a windowssharelink so the leading \\host survives intact.

GfmTable cells get a separate per-cell `\|` to `|` pass in the
rewriter to honour the tables-extension rule that pipes always
unescape, even inside code spans where standard §6.1 escapes don't
fire.

show more ...

add GfmTable for GFM tables

Implements the GFM pipe-table extension as a CONTAINER mode at sort 55,
one below DW Table at 60. A lookahead-validated entry pattern asserts a
header line plus a `:?-+:?

add GfmTable for GFM tables

Implements the GFM pipe-table extension as a CONTAINER mode at sort 55,
one below DW Table at 60. A lookahead-validated entry pattern asserts a
header line plus a `:?-+:?` delimiter row before consuming any input, so
non-table paragraphs containing pipes flow through unchanged. Cells are
inline-only per spec.

Handler\GfmTable rewrites the flat token stream into the canonical
table_open / tablethead_* / tabletbody_* / table_close sequence, deriving
per-column alignment from the delimiter row, padding short body rows
(spec 202), truncating long ones (spec 204), and falling back to a single
cdata when the column count mismatches (spec 203).

`tabletbody_open` / `tabletbody_close` are emitted for the first time;
they are part of the base renderer API but DW Table never used them.
Added to Block's blockOpen / blockClose lists alongside `tabletfoot_*`
for symmetry. SpecCompatRenderer gains minimal table-element overrides
so spec roundtrip output matches GFM's `<table><thead><tr><th>` shape
without DW's wrapper div, row/col counter classes, or align-as-class.

show more ...

add GfmListblock for GFM lists

GfmListblock captures an entire list block atomically with one
addSpecialPattern match, then walks the captured text in handle()
grouping lines into items. Each item's

add GfmListblock for GFM lists

GfmListblock captures an entire list block atomically with one
addSpecialPattern match, then walks the captured text in handle()
grouping lines into items. Each item's body is dedented to its
content column and parsed by ModeRegistry::getSubParser() so
block content (paragraphs, fenced code, blockquotes, plugin
blocks) works inside items uniformly. Sub-parsed calls are wrapped
in a Nest call before they reach the outer handler, matching the
Footnote pattern: the main handler's Block rewriter treats nest
as opaque and the renderer base class unwraps it transparently,
so multi-paragraph items don't get double-wrapped in <p>.

Marker syntax: -, *, + (unordered) or 1-9 digits followed by
. or ) (ordered). Indentation is a 2-space-multiple step starting
at 0; depth = (indent / 2) + 1, odd indents round down, tabs become
two spaces. The first ordered item's number drives the start
attribute on <ol> via the listo_open $start parameter.

GfmLists subclasses AbstractListsRewriter with the GFM marker
parser; the state machine on the base class is shared with DW Lists.

GfmListblock loads only when $conf['syntax'] is markdown or md+dw.
Under those settings the DW Listblock is suppressed because the two
list models conflict — DW's mandatory 2-space indent rule vs GFM's
zero-indent top-level rule, and -/*/+ markers shared. Plugins that
relied on Listblock loading under md+dw will see it absent there.

Sub-parser exclusion set: CATEGORY_BASEONLY (no Header inside list
items) and gfm_listblock itself (defensive guard against re-entry
on pathological inputs; nested lists are handled by the outer
pattern, not by re-entry).

Tests cover marker variants, ordered start numbers, nested lists at
two and three levels, inline formatting inside items, marker-
character switches keeping one list, type switches splitting the
list, fenced code inside items, multi-paragraph (loose) items, and
two regressions on blank-line tolerance inside the captured block.
SpecCompatRenderer learns to render the list call sequence, and
spec.txt tests for digit/marker-width/lazy-continuation behavior
that GfmListblock deliberately doesn't implement are documented in
gfm-spec/skip.php with the per-bucket reasons (A-F).

Drops two now-obsolete entries from skip.php (image escapes that
land via earlier GfmLink/GfmMedia work) and inlines the Setext
explanation that previously pointed at SPEC.md. Replaces the
SPEC.md reference in GfmEmphasisTest with the inline reason.

show more ...

add sub-parser support to Handler / Parser / ModeRegistry

A block mode that wants to parse the body of one of its captured
matches needs a second Parser instance configured with the active
modes min

add sub-parser support to Handler / Parser / ModeRegistry

A block mode that wants to parse the body of one of its captured
matches needs a second Parser instance configured with the active
modes minus whatever would re-enter the outer mode. Doing this by
hand is verbose and easy to get wrong — modes hold a $Lexer slot
that addMode() overwrites, so the same mode object can't be shared
between the main parser and a sub-parser.

Three small additions:

Handler::reset() — clears calls, status, currentModeName, and
installs a fresh CallWriter. Lets one Handler instance be parsed
against repeatedly without state bleed.

Parser::getHandler() — accessor; sub-parser callers need it to
reach the handler for reset() and for harvesting the produced
call list.

ModeRegistry::getSubParser($excludeCategories, $excludeModes) —
returns a cached Parser preconfigured with every active mode
except those excluded. Mode objects are cloned before being
attached so connectTo()'s assignment to $Lexer does not clobber
the main parser's references. Cache key is the exclusion-set;
default exclusion is CATEGORY_BASEONLY (no Header inside the
sub-parsed content).

Tests cover Handler::reset's full clear, sub-parser caching,
default and custom exclusions, registry-reset propagation, and
the clone-not-share invariant for $Lexer.

show more ...

extract AbstractListsRewriter from Lists

The list-block CallWriter rewriter mixed two concerns: a shared state
machine that turns flat list_open / list_item / list_close calls into
the nested listu_

extract AbstractListsRewriter from Lists

The list-block CallWriter rewriter mixed two concerns: a shared state
machine that turns flat list_open / list_item / list_close calls into
the nested listu_open / listo_open / listitem / listcontent shape
the renderers expect, and a syntax-specific marker parser that maps
the captured indent + marker text to depth/type.

Hoist the state machine onto a new abstract base class
AbstractListsRewriter; Lists keeps only its DokuWiki marker parser
(`*` unordered, `-` ordered, 2-space-per-level indent). The upcoming
GfmLists will share the same base class with its own GFM marker
parser.

The interpretSyntax contract changes shape:

protected function interpretSyntax($match, &$type): int
to
abstract protected function interpretSyntax(string $match): array;
// returns ['depth' => int, 'type' => 'u'|'o', 'start'? => int]

The optional `start` key carries the first ordered item's number for
syntaxes that support it (GFM); DokuWiki omits it and gets the
default of 1. Plugins subclassing Lists that override interpretSyntax
need to update — known affected: creole, markdowku, mediasyntax (per
codesearch.dokuwiki.org). The migration is mechanical: replace the
by-ref $type assignment and int return with an associative-array
return.

The protected listStart / listOpen / listEnd dispatch methods on the
old Lists are gone (renamed handleListOpen / handleListItem /
handleListClose on the base class), but no plugin in the ecosystem
overrides those, only interpretSyntax.

show more ...

add `$start` parameter to listo_open

Doku_Renderer::listo_open() is now listo_open($classes = null, $start = 1),
with the same signature on the metadata and XHTML renderers. The XHTML
renderer emits

add `$start` parameter to listo_open

Doku_Renderer::listo_open() is now listo_open($classes = null, $start = 1),
with the same signature on the metadata and XHTML renderers. The XHTML
renderer emits start="N" only when $start is not 1, so existing
ordered-list output is unchanged.

Used by the upcoming GfmListblock to implement GFM's ordered-list start
rule (`5. foo` → `<ol start="5">`). Plugin renderers that override
listo_open keep working, since PHP lets overrides omit added-with-default
parameters.

show more ...

remove getLineStartMarkers registry — sort order already wins

Preformatted's entry pattern carried a `(?![\*\-])` negative
lookahead to defer to list modes on indented bullet lines.
0cecf9d50 (2005,

remove getLineStartMarkers registry — sort order already wins

Preformatted's entry pattern carried a `(?![\*\-])` negative
lookahead to defer to list modes on indented bullet lines.
0cecf9d50 (2005, "new parser added") introduced it hardcoded;
7958e6980 (2026, "decouple hardcoded mode names in Eol and
Preformatted") refactored that hardcoded knowledge into
register/getLineStartMarkers on ModeRegistry so each list mode
owned its marker chars. Both preserved the behavior verbatim;
neither documented why it was needed.

Tracing the lexer, it isn't. ParallelRegex merges all entry
patterns into one PCRE expression; PCRE returns the leftmost
match and breaks ties on expression order. Modes are added in
sort order via ModeRegistry::getModes(), so Listblock (sort 10)
always precedes Preformatted (sort 20) and wins the tie on
" - foo" without any lookahead. The only test that caught a
difference was testPreformattedList, which happened to register
modes in non-canonical order - that was a test bug.

This patch drops the lookahead in Preformatted::connectTo, the
registerLineStartMarkers call in Listblock::preConnect, the
register/getLineStartMarkers methods on ModeRegistry, and the
three registry-API unit tests. testPreformattedList now
registers Listblock before Preformatted.

show more ...

refactor(changelog): persist external-edit detection on first read

This addresses the flaky test that makes tests randomly fail (mostly on
windows runners).

The flake in common_saveWikiText_test::t

refactor(changelog): persist external-edit detection on first read

This addresses the flaky test that makes tests randomly fail (mostly on
windows runners).

The flake in common_saveWikiText_test::test_savesequence5 came from
this line in ChangeLog::getCurrentRevisionInfo():

'date' => max($lastRev + 1, time() - 1)

The synthesized "external delete" entry was kept in memory only and
only persisted later, when saveWikiText next called detectExternalEdit.
That meant the formula was evaluated twice on different ChangeLog
instances — once during the test's inspection, and again during the
following saveWikiText — and the two evaluations could pick different
seconds depending on how long the surrounding I/O took. The test
cached the first result in $expectExternal and asserted it against the
on-disk entry written during the second call. On the slower Windows
runner the second call sometimes crossed a second boundary, producing
the off-by-one date mismatch.

The questions I had was, why are we persisting external file deletions
(or edits) only when a page is saved when we are obviously already
detecting it earlier during the changelog read already?

Instead of recording the external delete at the time a new page is
written, it makes sense to record it as soon as we detect it (when the
changelog is requested by a user or a bot). This will make the recoded
timestamp closer to the actual deletion.

This patch refactors the changelog accordingly, but still tries to be
minimal invasive (I think the changelog handling would need much more
refactoring, but that's beyond the scope of this change).

To enable proper locking (when logging an external edit and copying
the attic file), locking had to be moved to the Changelog class,
duplicating some code of io_saveFile.

PageFile::detectExternalEdit() and the deprecated procedural wrapper
detectExternalEdit() in inc/common.php are removed. A codesearch.dokuwiki.org
check confirmed no plugin calls the method directly; the only external
caller of the procedural function is the farmsync plugin, which needs
a parallel update.

show more ...

fix(infoutils): escape git log arguments for Windows compatibility

Single quotes are not shell quoting on Windows cmd, causing git to
parse '%cd' as an ambiguous revision and emit a fatal error to s

fix(infoutils): escape git log arguments for Windows compatibility

Single quotes are not shell quoting on Windows cmd, causing git to
parse '%cd' as an ambiguous revision and emit a fatal error to stderr.
Pass each argument through escapeshellarg() so quoting works on both
Unix and Windows.

show more ...

fix(preview): remove deprecated X-XSS-Protection header

The header was added in 2015 to work around Chrome's XSS Auditor
false-positives on preview pages (issue #1182). Chrome removed the
auditor in

fix(preview): remove deprecated X-XSS-Protection header

The header was added in 2015 to work around Chrome's XSS Auditor
false-positives on preview pages (issue #1182). Chrome removed the
auditor in version 78 (2019); no other browser ever shipped it. The
header is non-standard, deprecated, and a no-op today.

Fixes #4578

show more ...

fix EXIF-rotated images shown cropped in previews, closes #4482

JPEGs with EXIF orientation 5/6/7/8 were rendered cropped in the
mediamanager detail view, the image diff view and the fullscreen
deta

fix EXIF-rotated images shown cropped in previews, closes #4482

JPEGs with EXIF orientation 5/6/7/8 were rendered cropped in the
mediamanager detail view, the image diff view and the fullscreen
detail page: getimagesize() / JpegMeta report raw (rotation-unaware)
pixel dimensions, and passing both w and h to fetch.php defaults to
center-crop.

- Bump splitbrain/slika to 1.1, which ships ImageInfo: a rotation-
aware, metadata-only dimension simulator mirroring Adapter's
fluent API (autorotate/resize/crop).
- Add fit=1 to fetch.php: when both w and h are given, route to
media_resize_image() (bbox fit) instead of media_crop_image().
Token hashes only (id, w, h) so existing tokens stay valid.
- Add MediaFile::getDisplayDimensions($w, $h, $crop) which delegates
to ImageInfo and returns the dims fetch.php would produce.
- Add Display::getDetailHtml() and retire media_preview() / the old
media_image_preview_size() helper. media_tab_view and MediaDiff
now share the Display-based renderer.
- Rewrite tpl_img() (lib/tpl/*/detail.php) to use MediaFile dims +
fit=1 URL; drops the manual ratio math.
- Tests: MediaFileTest covers the dims math, DisplayTest covers the
detail-view HTML (rotated dims, rev-vs-timestamp URL selection,
structure), fetch_imagetoken gains a fit-token compat test.
Fixture _test/data/media/wiki/exif-orient-6.jpg: 20x30 JPEG with
EXIF orientation 6.

show more ...

split Parsing\Helpers into per-domain Link / Media / Code classes

gate monospace, unformatted, file on DokuWiki syntax

These DokuWiki specific modes should only be loaded when DokuWiki syntax
is still wanted, not in Markdown-only mode.
Expands the ModeRegistryTest

gate monospace, unformatted, file on DokuWiki syntax

These DokuWiki specific modes should only be loaded when DokuWiki syntax
is still wanted, not in Markdown-only mode.
Expands the ModeRegistryTest data provider to cover the full always-loaded
and DW-always sets.

show more ...

add GfmCode / GfmFile for fenced code blocks

GfmCode (backticks) emits the `code` handler instruction; GfmFile
(tildes) emits `file`. Column-0 fences only, no length pairing
between opener and close

add GfmCode / GfmFile for fenced code blocks

GfmCode (backticks) emits the `code` handler instruction; GfmFile
(tildes) emits `file`. Column-0 fences only, no length pairing
between opener and closer, and unclosed fences stay literal —
matching DokuWiki's `<code>` tag convention. The info string accepts
DW's full attribute vocabulary (language, filename, [options])
through a new shared `Helpers::parseCodeAttributes` that `Code`
also uses, with `html` aliased to `html4strict` and `-` meaning "no
language".

Preformatted's indent threshold is now preference-gated: 2 spaces
in DW-preferred settings, 4 spaces in MD-preferred, matching GFM's
indented code block rule. A single tab is a trigger in both.

show more ...

add GfmMedia and extend GfmLink with image-as-label form

- New GfmMedia parses `` with the full DokuWiki media-parameter
vocabulary in the URL slot (?100x200, ?right, ?nolink, ?recache,

add GfmMedia and extend GfmLink with image-as-label form

- New GfmMedia parses `` with the full DokuWiki media-parameter
vocabulary in the URL slot (?100x200, ?right, ?nolink, ?recache, …).
Adds `?left`/`?right`/`?center` align keywords shared with DW `{{…}}`
— gives pure-Markdown users a way to align inline images.
- GfmLink now also matches `[](target)` — the GFM equivalent
of `[[target|{{img}}]]`. Detection is post-entry, mirroring
Internallink's `^{{…}}$` check; one mode covers the whole family.
- LinkDispatch trait replaced by Helpers::classifyLink and
Helpers::parseMediaParameters — two pure static methods, shared by
DW and GFM counterparts.
- Entry patterns for GfmLink / GfmMedia simplified (permissive URL slot,
handle-time parsing), following DW's Internallink style.
- GfmSpecTest drives a test-only SpecCompatRenderer that emits bare
<img> / <a> instead of DW's wiki-wrapped HTML, recovering 13 spec
tests that previously failed/skipped only because of renderer shape.

show more ...

add GfmLink for GFM inline links `[text](url)`

Extracts the URL-classification ladder from Internallink into a
LinkDispatch trait so both modes route identically across all six
DokuWiki link flavors

add GfmLink for GFM inline links `[text](url)`

Extracts the URL-classification ladder from Internallink into a
LinkDispatch trait so both modes route identically across all six
DokuWiki link flavors (internal, external, interwiki, email,
windowsshare, local anchor). GfmLink parses the `[text](url)` form
with optional `"title"` / `'title'` and hands the URL to the trait.
The GFM title attribute is discarded — DokuWiki link instructions
have no slot for it.

show more ...