[bonelifer]

Follow-ups from the maintenance pass (#16): tab contrast, touch targets, doubled labels, forms that needed JavaScript, and an SQL injection and two missing strings in the ACP permission trace.

Accessibility

• Tab contrast: the inactive tabs showed prosilver's grey-blue text (#536482) on its tab colour (#BACCD9), 3.7:1 for small bold text that needs 4.5:1. They now use the board's dark text colour (#28313F), about 8.8:1. A style with dark tabs can change it in an alternative stylesheet.
• Touch targets: article title links in the lists were 13 to 17px high, and the queue's buttons and menus 19 to 21px. All are now at least 24px (WCAG 2.2, 2.5.8).
• Doubled labels: three fields on the posting form (post as, also list in, Markdown) and the ACP field type menu had two labels, the row's own and another wrapped around the field. The wrapping one is gone.

Without JavaScript

• The ACP introduction text box was hidden by the server and shown only by a script, so it couldn't be reached without JavaScript. It's now in the page from the start, and the script hides it while the introduction is off. The inline onClick moved into acp_knowledgebase.js.
• The custom-field filter on a category and the "drafts only" box on Manage Your Articles submit on change. They now get a Go button when JavaScript is off.

Packaging: .gitignore is left out of release archives.

ACP permission trace

• SQL injection: build_auth_option_statement() put a single permission name into SQL without quotes, unlike phpBB's own version of the function. The name comes from the trace page's address (auth=), so a crafted link opened by an administrator could run SQL of its choosing. It's now a quoted string, and the LIKE branch has the space it was missing before LIKE.
• The trace couldn't open: besides the unquoted name, the group and user queries ran IN (...) and user_id = N straight into the next AND (2AND), so every trace stopped on an SQL error.
• Two missing strings: KB_TRACE_GROUP_NEVER_TOTAL_NEVER and its _LOCAL form, shown when a group is set to NEVER and the total is already NEVER, are added in phpBB's own wording. A validation report from Chico Gois's Workspace tool flagged them; testing that fix uncovered the two bugs above.

Tests

New tests/browser/kb_form_access.js checks all of the above on a seeded board, as the administrator, with and without JavaScript. On the code before this change, 7 of its 9 checks fail; the 2 that pass check that the introduction settings still follow the switch with JavaScript on.

New tests/kb_acp_auth_option_statement_test.php runs the option filter against a SQLite table with a single name, a name with SQL in it, a LIKE pattern and a list; three of its four tests fail on the old code. tests/browser/kb_page_sweep.js now also opens the permission trace, which fails with an SQL error on the old code.

Claude ran:

• kb_form_access.js and kb_page_sweep.js on fresh seed-forum SQLite boards for phpBB 3.3.19 and 4.0.0-a3-dev: 9 of 9 checks and 27 of 27 pages on both. With two of the administrator's groups set to NEVER, the trace shows every row in words; without the new strings it showed the raw key.
• axe-core through phpbb-release-tools' page_a11y.py on the index, a category, an article, the posting form, the queue, Manage Your Articles and Recent changes. The tab contrast, touch-target and doubled-label findings are gone. What's left is prosilver's own markup.
• The PHPUnit suite on phpBB 3.3.x and master with the MySQL and PostgreSQL fixtures: 582 tests, none skipped.
• EPV on both branches, phpcs with the 3.3 and 4.0 rulesets, and template_a11y.py: clean.

Not changed: the link boxes on an article page use prosilver's code colour, which axe also flags. Code in forum posts uses the same colour, so it isn't specific to the Knowledge Base.

---

Investigated and written by Claude on behalf of William Jacoby (bonelifer).

🤖 Generated with Claude Code

[bonelifer]

Pushed 8217f5e, which fixes the ACP permission trace:

• build_auth_option_statement() put a single permission name into SQL without quotes. The name comes from the trace page's address (auth=), so a crafted link opened by an administrator could run SQL of its choosing. It's now a quoted string, as in phpBB's own version of the function, and the LIKE branch has its missing space.
• The group and user queries ran the id condition straight into the next AND (2AND), so the trace page never opened.
• KB_TRACE_GROUP_NEVER_TOTAL_NEVER and its _LOCAL form were missing. A validation report from Chico Gois's Workspace tool flagged them; testing that fix uncovered the two SQL bugs.

New tests/kb_acp_auth_option_statement_test.php (three of its four tests fail on the old code), and kb_page_sweep.js now opens the trace (an SQL error on the old code). Claude ran the sweep (27 of 27) and kb_form_access.js (9 of 9) on the phpBB 3.3.19 and 4.0.0-a3-dev boards, PHPUnit on 3.3.x and master (582 tests, none skipped), EPV on both branches and phpcs: all clean. With two of the administrator's groups set to NEVER, the trace now shows every row in words.

The PR description is updated to match.

---

Investigated and written by Claude on behalf of William Jacoby (bonelifer).