Architecture Overview

Scriptlog uses a multi-layer architecture designed for maintainability and scalability.

Home / Documentation / Architecture

Request Flow

1. Request

User makes a request to the server

2. Front Controller

index.php or admin/index.php

3. Bootstrap

Initializes application and services

4. Dispatcher

Routes request to appropriate controller

5. Controller

Handles HTTP logic

6. Service

Contains business logic

7. DAO

Handles data access

8. Database

MySQL/MariaDB processes queries

Handler dispatch: Frontend query-string requests (for example ?p=123, ?cat=news, or ?blog) are resolved by a HandlerRegistry that maps route keys (p, pg, cat, tag, a, blog, privacy, download) to FrontRequestHandler implementations. Admin form actions use the parallel AdminActionRegistry with 35 AdminActionCommand classes.

Directory Structure

Tree public_html/
public_html/
|-- index.php                    # Public front controller
|-- config.php                   # Application configuration
|
|-- admin/                      # Admin panel
|   |-- index.php               # Admin entry point
|   |-- login.php               # Login page
|   |-- posts.php               # Post management
|   |-- pages.php               # Page management
|   |-- topics.php              # Category management
|   |-- comments.php            # Comment management
|   |-- reply.php               # Reply management
|   |-- users.php               # User management
|   |-- menu.php                # Menu management
|   |-- navigation.php          # Navigation menu
|   |-- templates.php           # Theme management
|   |-- plugins.php             # Plugin management
|   |-- medialib.php            # Media library
|   |-- media-upload.php        # Media upload
|   |-- downloads.php           # Download management
|   |-- dashboard.php           # Dashboard
|   |-- export.php / import.php # Data import/export
|   |-- languages.php           # Language management
|   |-- translations.php        # Translation management
|   |-- privacy.php             # Privacy management
|   |-- signup.php              # User registration
|   |-- option-*.php            # Settings pages (general, permalink, mail, ...)
|   |-- ui/                     # Admin UI components
|   |-- plugins/                # Installed plugins (each in its own folder)
|   |   |-- index.php           # Plugin listing entry
|   |   +-- hello-world/        # Example plugin (plugin.ini + main class)
|   |-- assets/                 # Admin assets
|   +-- wysiwyg/                # Rich text editor
|
|-- api/                        # RESTful API
|   +-- index.php               # API entry point (/api/v1/)
|
|-- lib/                       # Core library
|   |-- main.php               # Application bootstrap
|   |-- common.php             # Constants (APP_ROOT, APP_ADMIN, ...)
|   |-- options.php            # PHP configuration
|   |-- Autoloader.php         # Legacy class autoloader
|   |-- utility-loader.php     # Utility functions loader
|   |-- autoload-aliases.php   # 233 class_alias() entries (reference only)
|   |-- autoload-aliases-map.php # Static alias map for lazy autoloader
|   |
|   +-- core/                  # Core classes - Scriptlog\Core (102 files)
|       |-- Bootstrap.php      # Application initialization, routes
|       |-- Dispatcher.php     # URL routing
|       |-- DbFactory.php      # PDO database connection
|       |-- Db.php             # PDO wrapper (prefix handling, dbQuery/...)
|       |-- Authentication.php # User authentication
|       |-- SessionMaker.php   # Custom session handler
|       |-- Dao.php            # DAO base class
|       |-- CSRFGuard.php      # CSRF protection
|       |-- ApiResponse.php    # API response handler
|       |-- ApiAuth.php        # API authentication
|       |-- ApiRouter.php      # API routing
|       |-- SearchFinder.php   # FULLTEXT search engine
|       +-- ...
|
|   +-- dao/                   # Data Access Objects - Scriptlog\Dao (19 files)
|       |-- PostDao.php        # Posts CRUD
|       |-- UserDao.php        # Users CRUD
|       |-- CommentDao.php     # Comments CRUD
|       |-- TopicDao.php       # Categories CRUD
|       |-- MediaDao.php       # Media CRUD
|       |-- PageDao.php        # Pages CRUD
|       |-- MenuDao.php        # Menus CRUD
|       |-- PluginDao.php      # Plugins CRUD
|       |-- ThemeDao.php       # Themes CRUD
|       |-- ConfigurationDao.php
|       +-- ...                # 19 DAOs total (see docs/dev-docs/DATABASE_SCHEMA_GUIDE.md)
|
|   +-- dto/                   # Data Transfer Objects - Scriptlog\Dto (5 files)
|       |-- PostRequestDto.php
|       |-- UploadedFileDto.php
|       +-- api/               # API DTOs
|           |-- PostApiDto.php
|           |-- CommentApiDto.php
|           +-- TopicApiDto.php
|
|   +-- service/               # Business logic - Scriptlog\Service (24 files)
|       |-- PostService.php
|       |-- PostApplicationService.php
|       |-- ProtectedPostService.php
|       |-- UserService.php
|       |-- CommentService.php
|       |-- TopicService.php
|       |-- MediaService.php
|       |-- PageService.php
|       |-- MenuService.php
|       |-- PluginService.php
|       |-- ThemeService.php
|       |-- ThemeLicenseService.php
|       |-- ConfigurationService.php
|       |-- ReplyService.php
|       |-- ScheduledPostService.php
|       |-- FrontService.php
|       |-- ConsentService.php
|       |-- DataRequestService.php
|       |-- DownloadService.php
|       |-- ExportService.php
|       |-- MigrationService.php
|       |-- LanguageService.php
|       |-- TranslationService.php
|       +-- NotificationService.php
|
|   +-- handler/               # Request handlers - Scriptlog\Handler (13 files)
|       |-- HandlerRegistry.php     # Handler registration & lookup
|       |-- FrontRequestHandler.php # Frontend dispatch contract
|       |-- AdminActionRegistry.php # Admin action registration & lookup
|       |-- AdminActionCommand.php  # Base class for admin action commands
|       |-- PostHandler.php
|       |-- PageHandler.php
|       |-- CategoryHandler.php
|       |-- TagHandler.php
|       |-- ArchiveHandler.php
|       |-- PrivacyHandler.php
|       |-- DownloadHandler.php
|       |-- BlogHandler.php
|       |-- HomeHandler.php
|       +-- admin/             # Admin action commands (35 *Cmd.php classes)
|           |-- comment/       # DeleteCommentCmd, EditCommentCmd, ListCommentsCmd
|           |-- media/         # DeleteMediaCmd, EditMediaCmd, ListMediaCmd, NewMediaCmd
|           |-- page/          # DeletePageCmd, EditPageCmd, ListPagesCmd, NewPageCmd
|           |-- plugin/        # ActivatePluginCmd, DeactivatePluginCmd, ...
|           |-- post/          # DeletePostCmd, EditPostCmd, ListPostsCmd, NewPostCmd
|           |-- theme/         # ActivateThemeCmd, DeactivateThemeCmd, ...
|           |-- topic/         # DeleteTopicCmd, EditTopicCmd, ListTopicsCmd, NewTopicCmd
|           +-- user/          # DeleteUserCmd, EditUserCmd, ListUsersCmd, NewUserCmd
|
|   +-- validator/             # Validators - Scriptlog\Validator (5 files)
|       |-- PostValidator.php
|       |-- FileUploadValidator.php
|       |-- ProtectedPostValidator.php
|       |-- CompositeValidator.php
|       +-- ValidationResult.php
|
|   +-- controller/             # Request controllers - Scriptlog\Controller (20 files)
|       |-- PostController.php
|       |-- UserController.php
|       |-- CommentController.php
|       |-- TopicController.php
|       |-- MediaController.php
|       |-- PageController.php
|       |-- MenuController.php
|       |-- PluginController.php
|       |-- ThemeController.php
|       |-- ConfigurationController.php
|       |-- ReplyController.php
|       |-- DownloadController.php
|       |-- DownloadAdminController.php
|       |-- ExportController.php
|       |-- ImportController.php
|       |-- LanguageController.php
|       |-- LocaleController.php
|       |-- SearchController.php
|       |-- TranslationController.php
|       |-- ApiController.php
|       |
|       +-- api/               # API Controllers - Scriptlog\Controller\Api (12 files)
|           |-- ApiController.php        # Public API info endpoint (GET /api/v1)
|           |-- PostsApiController.php
|           |-- CategoriesApiController.php
|           |-- CommentsApiController.php
|           |-- ArchivesApiController.php
|           |-- SearchApiController.php
|           |-- GdprApiController.php
|           |-- MediaApiController.php
|           |-- ProtectedPostApiController.php
|           |-- LanguagesApiController.php
|           |-- TranslationsApiController.php
|           +-- QueryApiController.php
|
|   +-- model/                # Data models - Scriptlog\Model (9 files)
|       |-- PostModel.php
|       |-- FrontContentModel.php
|       |-- TopicModel.php
|       |-- TagModel.php
|       |-- PageModel.php
|       |-- CommentModel.php
|       |-- GalleryModel.php
|       |-- ArchivesModel.php
|       +-- DownloadModel.php
|
|   +-- utility/              # Utility functions (224 files, dash-lowercase)
|       |-- app-config.php
|       |-- app-url.php
|       |-- csrf-defender.php
|       |-- remove-xss.php
|       |-- email-validation.php
|       +-- ...
|
|   +-- vendor/              # Composer dependencies
|
|-- benchmark/               # Performance benchmarks
|
|-- public/                  # Public web root
|   +-- themes/              # Theme templates
|       |-- blog/            # Default theme
|       |-- restoblog/
|       |-- tastybites/
|       +-- valdur/
|   +-- files/               # Uploaded files
|       |-- pictures/
|       |-- audio/
|       |-- video/
|       +-- docs/
|   +-- cache/               # Cache directory
|   +-- log/                 # Log directory
|
|-- docs/                    # Documentation
|   |-- dev-docs/            # Developer documentation (Markdown + HTML)
|   |   |-- DEVELOPER_GUIDE.md
|   |   |-- TESTING_GUIDE.md
|   |   |-- THEME_DEVELOPER_GUIDE.md
|   |   |-- PLUGIN_DEVELOPER_GUIDE.md
|   |   |-- API_DOCUMENTATION.md
|   |   |-- DATABASE_SCHEMA_GUIDE.md
|   |   |-- API_OPENAPI.yaml
|   |   +-- API_OPENAPI.json
|   +-- user-docs/           # End-user documentation
|
|-- tests/                   # PHPUnit test suites
|
|-- e2e/                     # End-to-end tests
|
+-- install/                  # Installation wizard
    |-- index.php
    |-- setup-db.php
    |-- validate-db.php
    |-- update-step.php
    |-- finish.php
    +-- include/
        |-- dbtable.php
        |-- setup.php
        +-- settings.php

Tip: Use APP_ROOT, APP_ADMIN, APP_PUBLIC, and other constants defined in lib/common.php for path handling.

Core Components lib/core/ ...

Bootstrap

Initializes application and sets up services

Bootstrap.php
Dispatcher

URL routing and request dispatching

Dispatcher.php
DbFactory

PDO database connection factory

DbFactory.php
Authentication

auth, sessions and access control

Authentication.php

Layered Namespaces (PSR-4)

Every class lives in a Scriptlog\* namespace. Backward compatibility is provided by class_alias() entries in lib/autoload-aliases.php and the lazy map in lib/autoload-aliases-map.php.

Layer Directory Namespace Files
Controllerlib/controller/Scriptlog\Controller20
API Controllerlib/controller/api/Scriptlog\Controller\Api12
Servicelib/service/Scriptlog\Service24
DTOlib/dto/Scriptlog\Dto5
DAOlib/dao/Scriptlog\Dao19
Modellib/model/Scriptlog\Model9
Handlerlib/handler/Scriptlog\Handler13 (+ 35 admin commands)
Validatorlib/validator/Scriptlog\Validator5
Corelib/core/Scriptlog\Core102
Utilitylib/utility/(global functions)224

Route Patterns

PHP lib/core/Bootstrap.php :: defineRoutingRules()
$rules = [
    'home'     => "/",
    'category' => "/category/(?'category'[\w\-]+)",
    'archive'  => "/archive/[0-9]{2}/[0-9]{4}",
    'archives' => "/archives",
    'blog'     => "/blog([^/]*)",
    'page'     => "/page/(?'page'[^/]+)",
    'single'   => "/post/(?'id'\d+)/(?'post'[\w\-]+)",
    'tag'      => "/tag/(?'tag'[\w\- ]+)",
    'search'   => "/search",
    'privacy'  => "/privacy",
    'locale'   => "/locale",
    'download' => "/download/(?'identifier'[a-f0-9\-]+)",
    'download_file' => "/download/(?'identifier'[a-f0-9\-]+)/file"
];

Key Application Constants

Constant Value Description
APP_TITLE'Scriptlog'Application title
APP_VERSION'1.8.1'Current application version
API_VERSION'v1'REST API version
DSDirectory separatorPlatform-specific path separator
APP_ROOTApplication rootRoot directory of the application
APP_ADMIN'admin'Admin directory name
APP_PUBLIC'public'Public web root
APP_LIBRARY'lib'Library directory
APP_THEME'public/themes'Themes directory
APP_PLUGIN'admin/plugins'Plugin directory
APP_IMAGE'public/files/pictures'Image directory
SCRIPTLOGHMAC hashSecurity constant for direct access prevention

User Levels & Access Control

Level Permissions
administratorFull access - all features
managerPLUGINS, THEMES, CONFIG, PAGES, NAVIGATION, TOPICS, COMMENTS, MEDIALIB, REPLY, POSTS
editorTOPICS, POSTS
authorCOMMENTS, MEDIALIB, REPLY, POSTS
contributorPOSTS
subscriberDASHBOARD only

Every authenticated level can reach the dashboard. The mapping is enforced per action in Authentication::checkAccessByLevel() (lib/core/Authentication.php), which resolves each ActionConst to the list of roles allowed to perform it.

Access Control Implementation

PHP admin/privacy.php
if (false === $authenticator->userAccessControl(ActionConst::PRIVACY)) {
    direct_page('index.php?load=403&forbidden=' . forbidden_id(), 403);
}

Security Features

CSRF Protection via CSRFGuard class
XSS Prevention with Sanitize class
SQL Injection Prevention (PDO)
Cookie Encryption (Defuse)