add inline status toggle, superadmin protection, i18n, and elFinder

Pages:
- Add isActive() AJAX endpoint for inline page activation/deactivation
- Auto-remove deactivated pages from navigation menu with cache flush
- Show homepage badge in DataTables listing with real-time updates
- Filter inactive pages from frontend rendering (Home controller)

Users:
- Prevent deletion of superadmin users with localized error message
- Fix DataTables search (remove erroneous $like=[] reassignment)
- Change user_del() to read ID from POST instead of URL segment
- Add CSRF exemptions for AJAX user management endpoints

Menu:
- Replace all hardcoded Turkish strings with lang() calls (EN + TR)
- Switch refreshLeftList() from POST to GET for idempotent reads

Media:
- Upgrade elFinder from 2.1.66 to 2.1.67 (JS, CSS, i18n, help files)
- Bypass elFinder internal CSRF; CI4 Shield session auth suffices

Sitemap:
- Respect App.siteLanguageMode in Blog/Pages sitemap models
- Add public/sitemap.css stylesheet for browser-readable sitemaps

Backup:
- Fix AJAX promise chain (done/fail/always) for create and delete
- Defer DataTables reload after CSRF meta tag update

Infrastructure:
- Declare DataTable variable at module scope in Backup and Users views
- Simplify template filter path resolution in Filters.php
- Update documentation (architecture, handbook, README, CHANGELOG)

Author: bertugfahriozer

CHANGELOG.md

@@ -4,6 +4,36 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html) conventions adapted to the existing four-component version numbers.
 
+## [0.32.0.0] - 2026-06-03
+
+### Added
+
+- **Pages: Inline Status Toggle:** New `isActive()` AJAX endpoint allows administrators to activate or deactivate pages directly from the DataTables listing without opening the edit form. Deactivating a page automatically removes it from the navigation menu and invalidates the corresponding per-locale menu cache.
+- **Pages: Homepage Badge:** The pages list now shows a visual "Home" badge next to the page currently set as the homepage, updating in real time when the homepage selection changes.
+- **Sitemap Stylesheet:** Added `public/sitemap.css` to style the XML sitemap with a clean, readable layout for browsers.
+- **Users: Superadmin Delete Protection:** `user_del()` now verifies the caller holds the `superadmin` role and prevents deletion of any user belonging to the `superadmin` group, returning a localized error message (`cannotDeleteSuperadmin`) instead.
+- **Menu Module: Full Internationalization:** All hardcoded Turkish strings in the Menu module views and JavaScript (stat labels, toast messages, confirm dialogs) have been replaced with `lang()` calls backed by new language keys in both English and Turkish language files.
+
+### Changed
+
+- **elFinder Upgrade to 2.1.67:** Updated all elFinder JS, CSS, and i18n files from 2.1.66 to 2.1.67. Added three new help files (`fr`, `zh_CN`, `zh_TW`). Asset `<script>` tags now include a `?v=2.1.67` cache-buster.
+- **elFinder CSRF Bypass:** elFinder's internal CSRF token validation has been disabled via an anonymous class override because CI4 Shield's session-based authentication and the `backendGuard` filter already protect the connector endpoint; the internal CSRF mechanism was causing stale-token 403 errors during multi-request file operations.
+- **Frontend: Inactive Pages Hidden:** `App\Controllers\Home` now adds an `isActive = 1` condition when resolving page content, preventing deactivated pages from being rendered on the public site.
+- **Sitemap: Single-Language Mode:** `BlogModel::sitemapItems()` and `PagesModel::sitemapItems()` now check `App.siteLanguageMode`; in single-language mode, only records matching the default locale are emitted, eliminating duplicate sitemap entries.
+- **Users: DataTables Search Fix:** Removed the erroneous `$like = []` reassignment in `UserController::index()` that was silently discarding the search string parsed from the DataTables request.
+- **Users: CSRF Exemptions:** Added `backend/users/removeFromBlacklist`, `backend/users/blackList`, `backend/users/forceResetPassword`, and `backend/users/user_del` to `UsersConfig::$csrfExcept` so AJAX-based user management actions no longer fail on token regeneration.
+- **Users: `user_del()` Signature Change:** The method no longer accepts a URL segment parameter; the target user ID is now read exclusively from POST data, matching the AJAX call pattern.
+- **Backup Module: AJAX Reliability:** Backup create and delete operations now use the `.done()/.fail()/.always()` promise chain instead of the legacy `$.post(url, data, callback, type)` signature. The DataTables reload is deferred via `setTimeout(0)` to ensure it runs after the CSRF meta tag update.
+- **Backup & Users Views: DataTable Scope Fix:** The DataTable instance variable in both Backup and Users list views is now declared at module scope (outside the `$(function(){})` wrapper) so that external functions (e.g. create/delete handlers) can call `table.ajax.reload()` without `ReferenceError`.
+- **Filters.php: Template Filter Path Simplification:** The active theme's filter directory is now resolved with a simple `APPPATH` concatenation instead of the `resolve_template_path()` helper, removing an unnecessary abstraction layer and null-check branch.
+- **Menu Module: `refreshLeftList()` changed from POST to GET:** The left sidebar panel refresh now uses `$.get()` instead of `$.post()`, matching the idempotent nature of the request and eliminating the need for CSRF token injection on a read-only call.
+- **Pages Controller: Code Style Normalization:** Minor formatting changes (alignment, brace style, cast spacing) applied across the Pages controller for consistency with the project's coding standards.
+
+### Fixed
+
+- **Users: Search Broken in DataTables:** The `$like` variable was overwritten with an empty array immediately after being parsed from the DataTables request, making search effectively non-functional. The erroneous reassignment has been removed.
+- **Pages: `setHomePage` Client-Side Stale Badge:** After toggling the homepage via AJAX, the JavaScript `homePageId` variable was not updated, causing the "Home" badge to appear on the wrong row until a full page reload. The variable is now updated immediately upon a successful response.
+
 ## [0.31.11.0] - 2026-05-24
 
 ### Fixed
@@ -348,6 +378,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 
 - Expanded database migrations and introduced new supporting libraries.
 
+[0.32.0.0]: https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.32.0.0
+[0.31.11.0]: https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.11.0
 [0.31.10.0]: https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.10.0
 [0.31.9.0]: https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.9.0
 [0.31.8.1]: https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.8.1

README.md

@@ -172,7 +172,7 @@ Standard CodeIgniter commands (`php spark db:seed`, `php spark key:generate`, et
 
 ## Developer Notes
 
-- **Cache keys**: `settings` (24h), `menus` (24h), `{userId}_permissions`. Clear with `php spark cache:clear` or `cache()->delete()`.
+- **Cache keys**: `settings` (24h), `menus_{locale}` (per-locale, 24h), `{userId}_permissions`. Clear with `php spark cache:clear` or `cache()->delete()`.
 - **Base controller**: Extend `Modules\Backend\Controllers\BaseController` for new backend controllers; it prepares session user, navigation, mail settings, and shared data.
 - **Permissions**: Register new secured routes in `Modules\Methods` (or via the database) so the permission filter recognizes them.
 - **Slug generation**: `seflink()` handles transliteration (including Turkish characters).

app/Config/Filters.php

@@ -28,22 +28,22 @@ class Filters extends BaseFilters
      * or [filter_name => [classname1, classname2, ...]]
      */
     public array $aliases = [
-        'csrf'          => CSRF::class,
-        'toolbar'       => DebugToolbar::class,
-        'honeypot'      => Honeypot::class,
-        'invalidchars'  => InvalidChars::class,
+        'csrf' => CSRF::class,
+        'toolbar' => DebugToolbar::class,
+        'honeypot' => Honeypot::class,
+        'invalidchars' => InvalidChars::class,
         'secureheaders' => SecureHeaders::class,
-        'cors'          => Cors::class,
-        'forcehttps'    => ForceHTTPS::class,
+        'cors' => Cors::class,
+        'forcehttps' => ForceHTTPS::class,
         //'pagecache'     => PageCache::class,
         //'performance'   => PerformanceMetrics::class,
-        'session'     => \CodeIgniter\Shield\Filters\SessionAuth::class,
-        'tokens'      => \CodeIgniter\Shield\Filters\TokenAuth::class,
-        'hmac'        => \CodeIgniter\Shield\Filters\HmacAuth::class,
-        'chain'       => \CodeIgniter\Shield\Filters\ChainAuth::class,
-        'auth-rates'  => \CodeIgniter\Shield\Filters\AuthRates::class,
-        'group'       => \CodeIgniter\Shield\Filters\GroupFilter::class,
-        'permission'  => \CodeIgniter\Shield\Filters\PermissionFilter::class,
+        'session' => \CodeIgniter\Shield\Filters\SessionAuth::class,
+        'tokens' => \CodeIgniter\Shield\Filters\TokenAuth::class,
+        'hmac' => \CodeIgniter\Shield\Filters\HmacAuth::class,
+        'chain' => \CodeIgniter\Shield\Filters\ChainAuth::class,
+        'auth-rates' => \CodeIgniter\Shield\Filters\AuthRates::class,
+        'group' => \CodeIgniter\Shield\Filters\GroupFilter::class,
+        'permission' => \CodeIgniter\Shield\Filters\PermissionFilter::class,
         'force-reset' => \CodeIgniter\Shield\Filters\ForcePasswordResetFilter::class,
         //'jwt'         => \CodeIgniter\Shield\Filters\JWTAuth::class,
         'seofilter' => SearchSeoFilter::class,
@@ -137,16 +137,17 @@ public function __construct()
                     $formatRules = new \CodeIgniter\Validation\FormatRules();
                     foreach ($this->settings as $setting) {
                         if ($formatRules->valid_json($setting->value) === true)
-                            $set[$setting->key] = (object)json_decode($setting->value, JSON_UNESCAPED_UNICODE);
-                        else $set[$setting->key] = $setting->value;
+                            $set[$setting->key] = (object) json_decode($setting->value, JSON_UNESCAPED_UNICODE);
+                        else
+                            $set[$setting->key] = $setting->value;
                     }
                     cache()->save('settings', $set, 86400);
-                    $this->settings = (object)$set;
+                    $this->settings = (object) $set;
                 } else {
-                    $this->settings = (object)cache('settings');
+                    $this->settings = (object) cache('settings');
                 }
             } catch (\Throwable $e) {
-                $this->settings = (object)[];
+                $this->settings = (object) [];
             }
         }
 
@@ -163,12 +164,8 @@ public function __construct()
             }
         }
 
-        if (!empty($this->settings) && isset($this->settings->templateInfos->path)) {
-            $filtersDir = resolve_template_path(APPPATH . 'Filters/templates/', $this->settings->templateInfos->path);
-            if ($filtersDir !== null) {
-                $mods[] = $filtersDir;
-            }
-        }
+        if (!empty($this->settings) && isset($this->settings->templateInfos) && isset($this->settings->templateInfos->path))
+            $mods[] = APPPATH . 'Filters/templates/' . $this->settings->templateInfos->path;
 
         $this->loadDynamicFilters($mods);
 
@@ -188,6 +185,7 @@ private function loadDynamicFilters(array $directories): void
             \Modules\Auth\Filters\Ci4MsAuthFilter::class,
             \Modules\Backend\Filters\BackendLogFilter::class,
             \Modules\Auth\Filters\SessionTracker::class,
+            \Modules\Backend\Filters\CsrfTokenRefreshFilter::class,
         ];
         $this->aliases['langfilter'] = [
             \App\Filters\Ci4ms::class,
@@ -248,8 +246,8 @@ private function loadConfig(): void
         $allFilters = [];
         $allGlobals = [];
 
-        foreach ($modules as $module) {
-            $configClass = "Modules\\{$module}\\Config\\{$module}Config";
+        if (!empty($this->settings) && isset($this->settings->templateInfos) && isset($this->settings->templateInfos->path)) {
+            $configClass = '\\Config\\templates\\' . $this->settings->templateInfos->path . '\\ThemeConfig';
             if (class_exists($configClass)) {
                 $configInstance = new $configClass();
                 if (property_exists($configInstance, 'csrfExcept') && is_array($configInstance->csrfExcept)) {
@@ -275,34 +273,49 @@ private function loadConfig(): void
                 $allCsrfExcept = array_unique($allCsrfExcept);
             }
         }
-        $this->filters = array_merge($this->filters, $allFilters);
-        $this->mergeCsrfExcept($allCsrfExcept);
-        if (file_exists(ROOTPATH . '.env') && !empty($this->commonModel)) {
-            try {
-                $themeSlug = $this->settings->templateInfos->path ?? null;
-                $themeConfigDir = ($this->commonModel->db->tableExists('settings'))
-                    ? resolve_template_path(APPPATH . 'Config/templates/', $themeSlug)
-                    : null;
-                if ($themeConfigDir !== null) {
-                    $configFile = $themeConfigDir . '/' . ucfirst($themeSlug) . 'Config.php';
-                    if (is_file($configFile) && realpath($configFile) === $configFile) {
-                        $className = '\\Config\\templates\\' . $themeSlug . '\\' . ucfirst($themeSlug) . 'Config';
-                        if (class_exists($className)) {
-                            $themeConfig = new $className();
 
-                            if (!empty($themeConfig->csrfExcept)) {
-                                $this->mergeCsrfExcept($themeConfig->csrfExcept);
-                            }
-
-                            if (!empty($themeConfig->filters)) {
-                                $this->filters = array_merge($this->filters, $themeConfig->filters);
+        foreach ($modules as $module) {
+            $configClass = "Modules\\{$module}\\Config\\{$module}Config";
+            if (class_exists($configClass)) {
+                $configInstance = new $configClass();
+                if (property_exists($configInstance, 'csrfExcept') && is_array($configInstance->csrfExcept)) {
+                    $allCsrfExcept = array_merge($allCsrfExcept, $configInstance->csrfExcept);
+                }
+                if (property_exists($configInstance, 'filters') && is_array($configInstance->filters)) {
+                    foreach ($configInstance->filters as $filterName => $filterRules) {
+                        if (!isset($allFilters[$filterName])) {
+                            $allFilters[$filterName] = $filterRules;
+                        } else {
+                            foreach ($filterRules as $filterType => $paths) {
+                                if (!isset($allFilters[$filterName][$filterType])) {
+                                    $allFilters[$filterName][$filterType] = [];
+                                }
+                                $allFilters[$filterName][$filterType] = array_merge($allFilters[$filterName][$filterType], $paths);
                             }
                         }
                     }
                 }
-            } catch (\Throwable $e) {
-                // Ignore DB errors during install
+                if (property_exists($configInstance, 'globals') && is_array($configInstance->globals)) {
+                    $allGlobals = array_merge($allGlobals, $configInstance->globals);
+                }
+                $allCsrfExcept = array_unique($allCsrfExcept);
             }
         }
+        $this->filters = array_merge($this->filters, $allFilters);
+
+        // backendGuard'ın before rotalarını otomatik olarak after'a da yay.
+        // Böylece CsrfTokenRefreshFilter alias içinde tanımlanmış tüm korumalı
+        // rotalarda her module config'e ayrıca csrfTokenRefreshFilter eklemeye gerek kalmaz.
+        if (!empty($this->filters['backendGuard']['before'])) {
+            $this->filters['backendGuard']['after'] = array_unique([
+                ...($this->filters['backendGuard']['after'] ?? []),
+                ...$this->filters['backendGuard']['before'],
+            ]);
+        }
+
+        $this->mergeCsrfExcept($allCsrfExcept);
+        if (!empty($allGlobals)) {
+            $this->globals = array_merge_recursive($this->globals, $allGlobals);
+        }
     }
 }

app/Controllers/Home.php

@@ -31,7 +31,7 @@ public function index(string $seflink = '')
             $pages = $this->commonModel->lists(
                 'pages',
                 'pages.*, pages_langs.title, pages_langs.content, pages_langs.seo, pages_langs.seflink',
-                ['pages.id' => $homePageId, 'pages_langs.lang' => $locale],
+                ['pages.id' => $homePageId, 'pages_langs.lang' => $locale,'pages.isActive'=>1],
                 'pages.id DESC', 1, 0, [], [],
                 [['table' => 'pages_langs', 'cond' => 'pages_langs.pages_id = pages.id', 'type' => 'inner']],
                 ['isReset' => true]
@@ -41,7 +41,7 @@ public function index(string $seflink = '')
                 $pages = $this->commonModel->lists(
                     'pages',
                     'pages.*, pages_langs.title, pages_langs.content, pages_langs.seo, pages_langs.seflink',
-                    ['pages.id' => $homePageId, 'pages_langs.lang' => $defaultLang],
+                    ['pages.id' => $homePageId, 'pages_langs.lang' => $defaultLang,'pages.isActive'=>1],
                     'pages.id DESC', 1, 0, [], [],
                     [['table' => 'pages_langs', 'cond' => 'pages_langs.pages_id = pages.id', 'type' => 'inner']],
                     ['isReset' => true]
@@ -52,7 +52,7 @@ public function index(string $seflink = '')
             $pages = $this->commonModel->lists(
                 'pages',
                 'pages.*, pages_langs.title, pages_langs.content, pages_langs.seo, pages_langs.seflink',
-                ['pages_langs.seflink' => $seflink, 'pages_langs.lang' => $locale],
+                ['pages_langs.seflink' => $seflink, 'pages_langs.lang' => $locale,'pages.isActive'=>1],
                 'pages.id DESC', 1, 0, [], [],
                 [['table' => 'pages_langs', 'cond' => 'pages_langs.pages_id = pages.id', 'type' => 'inner']],
                 ['isReset' => true]
@@ -62,7 +62,7 @@ public function index(string $seflink = '')
                 $pages = $this->commonModel->lists(
                     'pages',
                     'pages.*, pages_langs.title, pages_langs.content, pages_langs.seo, pages_langs.seflink',
-                    ['pages_langs.seflink' => $seflink, 'pages_langs.lang' => $defaultLang],
+                    ['pages_langs.seflink' => $seflink, 'pages_langs.lang' => $defaultLang,'pages.isActive'=>1],
                     'pages.id DESC', 1, 0, [], [],
                     [['table' => 'pages_langs', 'cond' => 'pages_langs.pages_id = pages.id', 'type' => 'inner']],
                     ['isReset' => true]

app/Models/BlogModel.php

@@ -11,7 +11,11 @@ class BlogModel extends Model
 
     public static function sitemapItems(): array
     {
-        $blogs = model(self::class)->join('blog_langs','blog_langs.id = blog.id','left')->where(['isActive' => true, 'inXML' => true])->findAll();
+        $where=['isActive' => true,'inXML' => true];
+        if(setting()->get('App.siteLanguageMode')==='single'){
+            $where['blog_langs.lang']=setting()->get('App.defaultLocale');
+        }
+        $blogs = model(self::class)->join('blog_langs','blog_langs.id = blog.id','left')->where($where)->findAll();
         $items = [];
 
         foreach ($blogs as $blog) {

app/Models/PagesModel.php

@@ -11,7 +11,11 @@ class PagesModel extends Model
 
     public static function sitemapItems(): array
     {
-        $pages = model(self::class)->join('pages_langs','pages_langs.id = pages.id','left')->where(['isActive' => true])->orderBy('seflink ASC')->findAll();
+        $where=['isActive' => true];
+        if(setting()->get('App.siteLanguageMode')==='single'){
+            $where['pages_langs.lang']=setting()->get('App.defaultLocale');
+        }
+        $pages = model(self::class)->join('pages_langs','pages_langs.id = pages.id','left')->where($where)->orderBy('seflink ASC')->findAll();
         $items = [];
 
         foreach ($pages as $page) {