fix(modules): prevent module deletion from wiping entire database

Bumps version to 0.31.10.0.

Critical:
- ModuleInstaller::rollbackModuleMigrations() called
  MigrationRunner::regress(0), which ignores the namespace filter in
  CI4 (regress() nulls $this->namespace internally and
  getBatches()/getBatchHistory() do not filter by namespace). Any
  single-module uninstall therefore downed every registered module's
  migrations and dropped the entire database. Replaced with a
  namespace-scoped getHistory() walk that calls force() per migration
  in reverse order; finally{} resets the shared runner's namespace.

Sitemap:
- BlogModel/PagesModel sitemapItems(): return path-only loc values.
  ci4seopro's SitemapBuilder prepends baseUrl, so site_url() produced
  duplicate scheme+host inside <loc> entries.
- Both models now LEFT JOIN their *_langs tables so localized records
  are not filtered out.

CSRF (backend):
- setCsrfHash() in be-assets/js/ci4ms.js also rewrites every
  csrf_field() hidden input after a token refresh, so non-AJAX form
  submits following an AJAX call no longer hit 403.
- ajaxPrefilter sends a pre-encoded URL string for empty POST bodies
  instead of building an object jQuery would later re-serialize away.

Frontend:
- templates/default/assets/ci4ms.js gates captchaF() on the presence
  of .captcha elements, removing the per-page-load /commentCaptcha
  POST.
- funcs_helper.php switches the captcha refresh button from inline
  onclick="captchaF()" to a .captcha-refresh class bound via the
  existing delegated handler.

Backend UX:
- modules/Methods/Views/update.php: fix broken route_to('list') →
  route_to('methodList'); cast inNavigation/isBackoffice/hasChild to
  bool so checkboxes render active for stored 1/0 values.

elFinder:
- pageImgelfinderDialog / pageMultipleImgelfinderDialog now cache
  their jQuery wrapper and reopen the same instance instead of
  rebuilding on every call. sync interval exec() is wrapped in
  try/catch so a destroyed instance no longer throws every second.

Misc:
- .gitignore: exclude CLAUDE.md and ci4ms-specs/.
- Install.php / Ci4msSetup.php: app.version → 0.31.10.0.

Author: bertugfahriozer

.gitignore

@@ -146,6 +146,8 @@ dist/
 composer.lock.json
 .antigravityignore
 .claude
+CLAUDE.md
+ci4ms-specs
 tests/*
 phpunit.xml.dist
 node_modules

CHANGELOG.md

@@ -4,6 +4,28 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html) conventions adapted to the existing four-component version numbers.
 
+## [0.31.10.0] - 2026-05-23
+
+### Fixed
+
+- **CRITICAL — Single Module Deletion Wiped Entire Database:** `ModuleInstaller::rollbackModuleMigrations()` called `MigrationRunner::regress(0)` under the assumption that `setNamespace()` scoped the rollback to a single module. CI4's `regress()` ignores the namespace filter (it nulls `$this->namespace` internally, and `getBatches()`/`getBatchHistory()` do not filter by namespace), so any uninstall would down every registered module's migrations and drop the entire database. Replaced with a namespace-filtered `getHistory()` walk that calls `force()` per migration, guaranteeing only the target module's tables are dropped and only its `migrations` table rows are removed. Added a `finally` block to reset the shared MigrationRunner singleton's namespace.
+- **Sitemap URL Duplication:** `BlogModel::sitemapItems()` and `PagesModel::sitemapItems()` returned fully-qualified URLs via `site_url()`, but `ci4seopro\Libraries\Seo\Search\SitemapBuilder` prepends `Seo::$baseUrl` to every `loc`, producing malformed `<loc>https://host.tldhttps://host.tld/...</loc>` entries. Models now return paths only (`'/' . ltrim($seflink, '/')`), matching the package contract.
+- **Sitemap Multilingual Coverage:** Both sitemap models now `LEFT JOIN` their `*_langs` tables so localized records are included instead of being filtered out by the primary-table-only query.
+- **Backend CSRF Hidden Input Stale After AJAX:** `setCsrfHash()` in `public/be-assets/js/ci4ms.js` only updated the `<meta name="X-CSRF-TOKEN">` tag after token regeneration, leaving every `csrf_field()` hidden input in the page bound to the previous token. Classic (non-AJAX) form submissions following an AJAX request received `403 Forbidden`. The setter now also writes the new hash to every `input[name="csrf_token_ci4ms"]` on the page.
+- **Backend CSRF Empty-Body POST Token Loss:** When an AJAX POST was sent with `data: null` or no `data` at all, `ajaxPrefilter` created a fresh object and assigned the token to it, but jQuery later re-serialized that object into an empty body, stripping the CSRF parameter. The prefilter now writes a pre-encoded URL-encoded string instead, so the token survives to the wire.
+- **Frontend Captcha Auto-Fire on All Pages:** `public/templates/default/assets/ci4ms.js` invoked `captchaF()` at file scope, firing a `POST /commentCaptcha` request on every public-side page load regardless of whether a captcha image was rendered. Wrapped the call in a DOM-ready guard that runs only when `.captcha` elements exist.
+- **Methods Update View Broken Route:** "Back to list" link in `modules/Methods/Views/update.php` referenced the non-existent route alias `list`; updated to the correct `methodList` alias.
+- **Methods Update View Checkbox Active State:** `inNavigation`, `isBackoffice`, and `hasChild` flags are stored as integers (`1` / `0`) but the view used strict `=== true` comparison, never marking checkboxes as active for existing records. Added `(bool)` casts so the `active` class and `checked` attribute apply correctly.
+
+### Changed
+
+- **elFinder Dialog Reuse:** `pageImgelfinderDialog()` and `pageMultipleImgelfinderDialog()` no longer create a fresh dialog on every call. The first invocation builds the dialog and caches the jQuery wrapper in a module-scoped variable (or keyed map for the multi-image variant); subsequent invocations call `dialogelfinder("open")` on the existing instance. Removes the `destroyOnClose: true` flag on these variants, prevents leaked event handlers, and stops repeated `cssAutoLoad` HTTP requests. The `sync` interval is wrapped in `try/catch` so a destroyed instance no longer throws a polling exception every second.
+- **Captcha Refresh Button Wiring:** The "New Captcha" button in `app/Helpers/templates/default/funcs_helper.php` switched from inline `onclick="captchaF()"` to a `.captcha-refresh` class that the existing jQuery delegation in `captchaF()` already binds. Cleaner separation between markup and behavior.
+
+### Added
+
+- **`.gitignore` Entries:** Excluded `CLAUDE.md` and `ci4ms-specs/` so per-developer agent tooling artifacts stay out of version control.
+
 ## [0.31.9.0] - 2026-05-08
 
 ### Security
@@ -314,6 +336,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 
 - Expanded database migrations and introduced new supporting libraries.
 
+[0.31.10.0]: https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.10.0
 [0.31.9.0]: https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.9.0
 [0.31.8.1]: https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.8.1
 [0.31.8.0]: https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.8.0

app/Helpers/templates/default/funcs_helper.php

@@ -31,7 +31,7 @@ function comments(array $comments, string $blog_id)
 <div class="input-group">
 <img src="" class="captcha" alt="captcha">
 <input type="text" placeholder="captcha" name="captcha" class="form-control">
-<button class="btn btn-secondary" onclick="captchaF()" type="button">New Captcha</button>
+<button class="btn btn-secondary captcha-refresh" type="button">New Captcha</button>
 </div>
 </div>
 <div class="col-6 form-group text-end">

app/Models/BlogModel.php

@@ -11,12 +11,12 @@ class BlogModel extends Model
 
     public static function sitemapItems(): array
     {
-        $blogs = model(self::class)->where(['isActive' => true, 'inXML' => true])->findAll();
+        $blogs = model(self::class)->join('blog_langs','blog_langs.id = blog.id','left')->where(['isActive' => true, 'inXML' => true])->findAll();
         $items = [];
 
         foreach ($blogs as $blog) {
             $items[] = [
-                'loc'        => site_url('blog/' . $blog['seflink']),
+                'loc'        => '/blog/' . ltrim($blog['seflink'], '/'),
                 'lastmod'    => $blog['updated_at'] ?? $blog['created_at'],
                 'changefreq' => 'weekly',
                 'priority'   => 1.0,

app/Models/PagesModel.php

@@ -11,12 +11,12 @@ class PagesModel extends Model
 
     public static function sitemapItems(): array
     {
-        $pages = model(self::class)->where(['isActive' => true])->orderBy('seflink ASC')->findAll();
+        $pages = model(self::class)->join('pages_langs','pages_langs.id = pages.id','left')->where(['isActive' => true])->orderBy('seflink ASC')->findAll();
         $items = [];
 
         foreach ($pages as $page) {
             $items[] = [
-                'loc'        => site_url($page['seflink']),
+                'loc'        => '/' . ltrim($page['seflink'], '/'),
                 'lastmod'    => $page['updated_at'] ?? $page['creationDate'],
                 'changefreq' => $page['changefreq'] ?? 'weekly',
                 'priority'   => $page['priority'] ?? 0.8,

modules/Backend/Commands/Ci4msSetup.php

@@ -220,7 +220,7 @@ public function run(array $params)
             'app.supportedLocales'               => '["ar","de","en","es","fr","hi","ja","pt","ru","tr","zh"]',
             'app.negotiateLocale'                => 'true',
             'app.appTimezone'                    => '\'Europe/Istanbul\'',
-            'app.version'                        => '0.31.9.0',
+            'app.version'                        => '0.31.10.0',
         ];
 
         if (!$this->updateEnvSettings($updates)) {

modules/Install/Controllers/Install.php

@@ -67,7 +67,7 @@ public function index()
                 'app.supportedLocales' => '["ar","de","en","es","fr","hi","ja","pt","ru","tr","zh"]',
                 'app.negotiateLocale' => 'true',
                 'app.appTimezone' => '\'Europe/Istanbul\'',
-                'app.version' => '0.31.9.0'
+                'app.version' => '0.31.10.0'
             ];
             if ($this->copyEnvFile() && $this->updateEnvSettings($updates)) $this->generateEncryptionKey();
 

modules/Methods/Libraries/ModuleInstaller.php

@@ -90,7 +90,7 @@ public function runAllPendingMigrations(): array
     public function runModuleSeeder(string $moduleName): array
     {
         $seederName = "Modules\\{$moduleName}\\Database\\Seeds\\{$moduleName}Seeder";
-        
+
         // If such a Seeder class exists, run it
         if (class_exists($seederName)) {
             try {
@@ -182,21 +182,30 @@ public function rollbackModuleMigrations(string $moduleName): array
             return ['success' => true, 'rolledBack' => 0, 'error' => null];
         }
 
-        try {
-            /** @var \CodeIgniter\Database\MigrationRunner $migrate */
-            $migrate = Services::migrations();
-            $namespace = 'Modules\\' . $moduleName . '\\Database\\Migrations';
-
-            // Roll back all migrations (batch 0 = roll back all)
-            $migrate->setNamespace($namespace)->regress(0);
+        /** @var \CodeIgniter\Database\MigrationRunner $migrate */
+        $migrate = Services::migrations();
+        $namespace = 'Modules\\' . $moduleName . '\\Database\\Migrations';
 
-            $files = glob($migrationPath . '/*.php');
-            $rolledBack = is_array($files) ? count($files) : 0;
+        try {
+            $migrate->setNamespace($namespace);
+            $dbGroup = (new \Config\Database())->defaultGroup;
+            $history = $migrate->getHistory($dbGroup);
+
+            $rolledBack = 0;
+            foreach (array_reverse($history) as $row) {
+                $file = $migrationPath . '/' . $row->version . '_' . $row->class . '.php';
+                if (is_file($file)) {
+                    $migrate->force($file, $namespace);
+                    $rolledBack++;
+                }
+            }
 
             return ['success' => true, 'rolledBack' => $rolledBack, 'error' => null];
         } catch (\Throwable $e) {
             log_message('error', "[ModuleInstaller] Rollback failed for {$moduleName}: {$e->getMessage()}");
             return ['success' => false, 'rolledBack' => 0, 'error' => $e->getMessage()];
+        } finally {
+            $migrate->setNamespace(null);
         }
     }
 

modules/Methods/Views/update.php

@@ -15,7 +15,7 @@
             </div>
             <div class="col-sm-6">
                 <ol class="breadcrumb float-sm-right">
-                    <a href="<?php echo route_to('list') ?>" class="btn btn-sm btn-outline-info"><?php echo lang('Backend.backToList') ?></a>
+                    <a href="<?php echo route_to('methodList') ?>" class="btn btn-sm btn-outline-info"><?php echo lang('Backend.backToList') ?></a>
                 </ol>
             </div>
         </div>
@@ -101,14 +101,14 @@
                 </div>
                 <div class="form-group col-md-9 d-flex align-items-end">
                     <div class="w-100 btn-group btn-group-toggle" data-toggle="buttons">
-                        <label class="btn btn-outline-primary <?php echo $method->inNavigation === true ? 'active' : '' ?>">
-                            <input class="custom-control-input" value="1" name="inNavigation" type="checkbox" id="inNavigation" <?php echo $method->inNavigation === true ? 'checked' : '' ?>> Menüde mi ?
+                        <label class="btn btn-outline-primary <?php echo (bool)$method->inNavigation === true ? 'active' : '' ?>">
+                            <input class="custom-control-input" value="1" name="inNavigation" type="checkbox" id="inNavigation" <?php echo (bool)$method->inNavigation === true ? 'checked' : '' ?>> Menüde mi ?
                         </label>
-                        <label class="btn btn-outline-primary <?php echo $method->isBackoffice === true ? 'active' : '' ?>">
-                            <input class="custom-control-input" value="1" name="isBackoffice" type="checkbox" id="isBackoffice" <?php echo $method->isBackoffice === true ? 'checked' : '' ?>> Panelde mi ?
+                        <label class="btn btn-outline-primary <?php echo (bool)$method->isBackoffice === true ? 'active' : '' ?>">
+                            <input class="custom-control-input" value="1" name="isBackoffice" type="checkbox" id="isBackoffice" <?php echo (bool)$method->isBackoffice === true ? 'checked' : '' ?>> Panelde mi ?
                         </label>
                         <label class="btn btn-outline-primary <?php echo $method->hasChild === true ? 'active' : '' ?>">
-                            <input class="custom-control-input" value="1" name="hasChild" type="checkbox" id="hasChild" <?php echo $method->hasChild === true ? 'checked' : '' ?>> Alt sayfası var mı ?
+                            <input class="custom-control-input" value="1" name="hasChild" type="checkbox" id="hasChild" <?php echo (bool)$method->hasChild === true ? 'checked' : '' ?>> Alt sayfası var mı ?
                         </label>
                     </div>
                 </div>