Architecture Overview
Scriptlog uses a multi-layer architecture designed for maintainability and scalability.
Request Flow
1. Request
User makes a request to the server
2. Front Controller
index.php or admin/index.php
3. Bootstrap
Initializes application and services
4. Dispatcher
Routes request to appropriate controller
5. Controller
Handles HTTP logic
6. Service
Contains business logic
7. DAO
Handles data access
8. Database
MySQL/MariaDB processes queries
Handler dispatch: Frontend query-string requests (for example ?p=123, ?cat=news, or ?blog) are resolved by a HandlerRegistry that maps route keys (p, pg, cat, tag, a, blog, privacy, download) to FrontRequestHandler implementations. Admin form actions use the parallel AdminActionRegistry with 35 AdminActionCommand classes.
Directory Structure
public_html/
|-- index.php # Public front controller
|-- config.php # Application configuration
|
|-- admin/ # Admin panel
| |-- index.php # Admin entry point
| |-- login.php # Login page
| |-- posts.php # Post management
| |-- pages.php # Page management
| |-- topics.php # Category management
| |-- comments.php # Comment management
| |-- reply.php # Reply management
| |-- users.php # User management
| |-- menu.php # Menu management
| |-- navigation.php # Navigation menu
| |-- templates.php # Theme management
| |-- plugins.php # Plugin management
| |-- medialib.php # Media library
| |-- media-upload.php # Media upload
| |-- downloads.php # Download management
| |-- dashboard.php # Dashboard
| |-- export.php / import.php # Data import/export
| |-- languages.php # Language management
| |-- translations.php # Translation management
| |-- privacy.php # Privacy management
| |-- signup.php # User registration
| |-- option-*.php # Settings pages (general, permalink, mail, ...)
| |-- ui/ # Admin UI components
| |-- plugins/ # Installed plugins (each in its own folder)
| | |-- index.php # Plugin listing entry
| | +-- hello-world/ # Example plugin (plugin.ini + main class)
| |-- assets/ # Admin assets
| +-- wysiwyg/ # Rich text editor
|
|-- api/ # RESTful API
| +-- index.php # API entry point (/api/v1/)
|
|-- lib/ # Core library
| |-- main.php # Application bootstrap
| |-- common.php # Constants (APP_ROOT, APP_ADMIN, ...)
| |-- options.php # PHP configuration
| |-- Autoloader.php # Legacy class autoloader
| |-- utility-loader.php # Utility functions loader
| |-- autoload-aliases.php # 233 class_alias() entries (reference only)
| |-- autoload-aliases-map.php # Static alias map for lazy autoloader
| |
| +-- core/ # Core classes - Scriptlog\Core (102 files)
| |-- Bootstrap.php # Application initialization, routes
| |-- Dispatcher.php # URL routing
| |-- DbFactory.php # PDO database connection
| |-- Db.php # PDO wrapper (prefix handling, dbQuery/...)
| |-- Authentication.php # User authentication
| |-- SessionMaker.php # Custom session handler
| |-- Dao.php # DAO base class
| |-- CSRFGuard.php # CSRF protection
| |-- ApiResponse.php # API response handler
| |-- ApiAuth.php # API authentication
| |-- ApiRouter.php # API routing
| |-- SearchFinder.php # FULLTEXT search engine
| +-- ...
|
| +-- dao/ # Data Access Objects - Scriptlog\Dao (19 files)
| |-- PostDao.php # Posts CRUD
| |-- UserDao.php # Users CRUD
| |-- CommentDao.php # Comments CRUD
| |-- TopicDao.php # Categories CRUD
| |-- MediaDao.php # Media CRUD
| |-- PageDao.php # Pages CRUD
| |-- MenuDao.php # Menus CRUD
| |-- PluginDao.php # Plugins CRUD
| |-- ThemeDao.php # Themes CRUD
| |-- ConfigurationDao.php
| +-- ... # 19 DAOs total (see docs/dev-docs/DATABASE_SCHEMA_GUIDE.md)
|
| +-- dto/ # Data Transfer Objects - Scriptlog\Dto (5 files)
| |-- PostRequestDto.php
| |-- UploadedFileDto.php
| +-- api/ # API DTOs
| |-- PostApiDto.php
| |-- CommentApiDto.php
| +-- TopicApiDto.php
|
| +-- service/ # Business logic - Scriptlog\Service (24 files)
| |-- PostService.php
| |-- PostApplicationService.php
| |-- ProtectedPostService.php
| |-- UserService.php
| |-- CommentService.php
| |-- TopicService.php
| |-- MediaService.php
| |-- PageService.php
| |-- MenuService.php
| |-- PluginService.php
| |-- ThemeService.php
| |-- ThemeLicenseService.php
| |-- ConfigurationService.php
| |-- ReplyService.php
| |-- ScheduledPostService.php
| |-- FrontService.php
| |-- ConsentService.php
| |-- DataRequestService.php
| |-- DownloadService.php
| |-- ExportService.php
| |-- MigrationService.php
| |-- LanguageService.php
| |-- TranslationService.php
| +-- NotificationService.php
|
| +-- handler/ # Request handlers - Scriptlog\Handler (13 files)
| |-- HandlerRegistry.php # Handler registration & lookup
| |-- FrontRequestHandler.php # Frontend dispatch contract
| |-- AdminActionRegistry.php # Admin action registration & lookup
| |-- AdminActionCommand.php # Base class for admin action commands
| |-- PostHandler.php
| |-- PageHandler.php
| |-- CategoryHandler.php
| |-- TagHandler.php
| |-- ArchiveHandler.php
| |-- PrivacyHandler.php
| |-- DownloadHandler.php
| |-- BlogHandler.php
| |-- HomeHandler.php
| +-- admin/ # Admin action commands (35 *Cmd.php classes)
| |-- comment/ # DeleteCommentCmd, EditCommentCmd, ListCommentsCmd
| |-- media/ # DeleteMediaCmd, EditMediaCmd, ListMediaCmd, NewMediaCmd
| |-- page/ # DeletePageCmd, EditPageCmd, ListPagesCmd, NewPageCmd
| |-- plugin/ # ActivatePluginCmd, DeactivatePluginCmd, ...
| |-- post/ # DeletePostCmd, EditPostCmd, ListPostsCmd, NewPostCmd
| |-- theme/ # ActivateThemeCmd, DeactivateThemeCmd, ...
| |-- topic/ # DeleteTopicCmd, EditTopicCmd, ListTopicsCmd, NewTopicCmd
| +-- user/ # DeleteUserCmd, EditUserCmd, ListUsersCmd, NewUserCmd
|
| +-- validator/ # Validators - Scriptlog\Validator (5 files)
| |-- PostValidator.php
| |-- FileUploadValidator.php
| |-- ProtectedPostValidator.php
| |-- CompositeValidator.php
| +-- ValidationResult.php
|
| +-- controller/ # Request controllers - Scriptlog\Controller (20 files)
| |-- PostController.php
| |-- UserController.php
| |-- CommentController.php
| |-- TopicController.php
| |-- MediaController.php
| |-- PageController.php
| |-- MenuController.php
| |-- PluginController.php
| |-- ThemeController.php
| |-- ConfigurationController.php
| |-- ReplyController.php
| |-- DownloadController.php
| |-- DownloadAdminController.php
| |-- ExportController.php
| |-- ImportController.php
| |-- LanguageController.php
| |-- LocaleController.php
| |-- SearchController.php
| |-- TranslationController.php
| |-- ApiController.php
| |
| +-- api/ # API Controllers - Scriptlog\Controller\Api (12 files)
| |-- ApiController.php # Public API info endpoint (GET /api/v1)
| |-- PostsApiController.php
| |-- CategoriesApiController.php
| |-- CommentsApiController.php
| |-- ArchivesApiController.php
| |-- SearchApiController.php
| |-- GdprApiController.php
| |-- MediaApiController.php
| |-- ProtectedPostApiController.php
| |-- LanguagesApiController.php
| |-- TranslationsApiController.php
| +-- QueryApiController.php
|
| +-- model/ # Data models - Scriptlog\Model (9 files)
| |-- PostModel.php
| |-- FrontContentModel.php
| |-- TopicModel.php
| |-- TagModel.php
| |-- PageModel.php
| |-- CommentModel.php
| |-- GalleryModel.php
| |-- ArchivesModel.php
| +-- DownloadModel.php
|
| +-- utility/ # Utility functions (224 files, dash-lowercase)
| |-- app-config.php
| |-- app-url.php
| |-- csrf-defender.php
| |-- remove-xss.php
| |-- email-validation.php
| +-- ...
|
| +-- vendor/ # Composer dependencies
|
|-- benchmark/ # Performance benchmarks
|
|-- public/ # Public web root
| +-- themes/ # Theme templates
| |-- blog/ # Default theme
| |-- restoblog/
| |-- tastybites/
| +-- valdur/
| +-- files/ # Uploaded files
| |-- pictures/
| |-- audio/
| |-- video/
| +-- docs/
| +-- cache/ # Cache directory
| +-- log/ # Log directory
|
|-- docs/ # Documentation
| |-- dev-docs/ # Developer documentation (Markdown + HTML)
| | |-- DEVELOPER_GUIDE.md
| | |-- TESTING_GUIDE.md
| | |-- THEME_DEVELOPER_GUIDE.md
| | |-- PLUGIN_DEVELOPER_GUIDE.md
| | |-- API_DOCUMENTATION.md
| | |-- DATABASE_SCHEMA_GUIDE.md
| | |-- API_OPENAPI.yaml
| | +-- API_OPENAPI.json
| +-- user-docs/ # End-user documentation
|
|-- tests/ # PHPUnit test suites
|
|-- e2e/ # End-to-end tests
|
+-- install/ # Installation wizard
|-- index.php
|-- setup-db.php
|-- validate-db.php
|-- update-step.php
|-- finish.php
+-- include/
|-- dbtable.php
|-- setup.php
+-- settings.php
Tip: Use APP_ROOT, APP_ADMIN, APP_PUBLIC, and other constants defined in lib/common.php for path handling.
Core Components
lib/core/ ...
Bootstrap
Initializes application and sets up services
Bootstrap.php
Dispatcher
URL routing and request dispatching
Dispatcher.php
DbFactory
PDO database connection factory
DbFactory.php
Authentication
auth, sessions and access control
Authentication.php
Layered Namespaces (PSR-4)
Every class lives in a Scriptlog\* namespace. Backward compatibility is provided by class_alias() entries in lib/autoload-aliases.php and the lazy map in lib/autoload-aliases-map.php.
| Layer | Directory | Namespace | Files |
|---|---|---|---|
| Controller | lib/controller/ | Scriptlog\Controller | 20 |
| API Controller | lib/controller/api/ | Scriptlog\Controller\Api | 12 |
| Service | lib/service/ | Scriptlog\Service | 24 |
| DTO | lib/dto/ | Scriptlog\Dto | 5 |
| DAO | lib/dao/ | Scriptlog\Dao | 19 |
| Model | lib/model/ | Scriptlog\Model | 9 |
| Handler | lib/handler/ | Scriptlog\Handler | 13 (+ 35 admin commands) |
| Validator | lib/validator/ | Scriptlog\Validator | 5 |
| Core | lib/core/ | Scriptlog\Core | 102 |
| Utility | lib/utility/ | (global functions) | 224 |
Route Patterns
$rules = [
'home' => "/",
'category' => "/category/(?'category'[\w\-]+)",
'archive' => "/archive/[0-9]{2}/[0-9]{4}",
'archives' => "/archives",
'blog' => "/blog([^/]*)",
'page' => "/page/(?'page'[^/]+)",
'single' => "/post/(?'id'\d+)/(?'post'[\w\-]+)",
'tag' => "/tag/(?'tag'[\w\- ]+)",
'search' => "/search",
'privacy' => "/privacy",
'locale' => "/locale",
'download' => "/download/(?'identifier'[a-f0-9\-]+)",
'download_file' => "/download/(?'identifier'[a-f0-9\-]+)/file"
];
Key Application Constants
| Constant | Value | Description |
|---|---|---|
APP_TITLE | 'Scriptlog' | Application title |
APP_VERSION | '1.8.1' | Current application version |
API_VERSION | 'v1' | REST API version |
DS | Directory separator | Platform-specific path separator |
APP_ROOT | Application root | Root directory of the application |
APP_ADMIN | 'admin' | Admin directory name |
APP_PUBLIC | 'public' | Public web root |
APP_LIBRARY | 'lib' | Library directory |
APP_THEME | 'public/themes' | Themes directory |
APP_PLUGIN | 'admin/plugins' | Plugin directory |
APP_IMAGE | 'public/files/pictures' | Image directory |
SCRIPTLOG | HMAC hash | Security constant for direct access prevention |
User Levels & Access Control
| Level | Permissions |
|---|---|
| administrator | Full access - all features |
| manager | PLUGINS, THEMES, CONFIG, PAGES, NAVIGATION, TOPICS, COMMENTS, MEDIALIB, REPLY, POSTS |
| editor | TOPICS, POSTS |
| author | COMMENTS, MEDIALIB, REPLY, POSTS |
| contributor | POSTS |
| subscriber | DASHBOARD only |
Every authenticated level can reach the dashboard. The mapping is enforced per action in Authentication::checkAccessByLevel() (lib/core/Authentication.php), which resolves each ActionConst to the list of roles allowed to perform it.
Access Control Implementation
if (false === $authenticator->userAccessControl(ActionConst::PRIVACY)) {
direct_page('index.php?load=403&forbidden=' . forbidden_id(), 403);
}