Conformidade KB: sem inc/includes.php, logo.png, limpeza e JSON_HEX_TAG

- front/*.php não incluem mais ../../../inc/includes.php: no GLPI 11 o
  LegacyFileLoadController boota o core antes do script, e o include
  quebra quando o plugin roda do marketplace dir (KB-PLUGIN-028/010).
- logo.png (512x512) criado a partir de plugin.png: o LogoController só
  reconhece o nome fixo logo.png (KB-INFRA-002).
- Removidos front/test_simple.php e front/login.css.php (deprecated),
  incluindo a firewall strategy correspondente no setup.php (KB-018).
- json_encode com JSON_HEX_TAG|JSON_HEX_AMP em todo dado dinâmico
  embutido em <script> (KB-PLUGIN-003).
- .gitignore padrão KB-018; .DS_Store removidos.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

front/internal.css.php

@@ -1,10 +1,7 @@
 <?php
 
-$_GET["donotcheckversion"] = true;
+// GLPI 11: o core já foi bootado pelo LegacyFileLoadController antes deste
-$dont_check_maintenance_mode = true;
+// arquivo executar — não incluir inc/includes.php (KB-PLUGIN-028)
-
-define('GLPI_AJAX', true);
-include('../../../inc/includes.php');
 
 // FIX: Prevent this script from being stored as the "Return URL" after login
 if (isset($_SESSION['glpi_currentpage']) && strpos($_SESSION['glpi_currentpage'], basename(__FILE__)) !== false) {

front/internal.js.php

@@ -1,10 +1,7 @@
 <?php
 
-$_GET["donotcheckversion"] = true;
+// GLPI 11: o core já foi bootado pelo LegacyFileLoadController antes deste
-$dont_check_maintenance_mode = true;
+// arquivo executar — não incluir inc/includes.php (KB-PLUGIN-028)
-
-define('GLPI_AJAX', true);
-include('../../../inc/includes.php');
 
 // FIX: Prevent this script from being stored as the "Return URL" after login
 if (isset($_SESSION['glpi_currentpage']) && strpos($_SESSION['glpi_currentpage'], basename(__FILE__)) !== false) {
@@ -56,14 +53,14 @@ if (false) {
       ?>
       var $icon = $('link[rel*=icon]');
       $icon.attr('type', null);
-      $icon.attr('href', <?php echo json_encode($faviconUrl) ?>);
+      $icon.attr('href', <?php echo json_encode($faviconUrl, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP) ?>);
       <?php
    endif;
    $pageTitle = PluginButterflyConfig::getConfig('page_title');
    if ($pageTitle):
       ?>
       var $title = $('title');
-      var newTitle = $title.text().replace('GLPI', <?php echo json_encode($pageTitle) ?>);
+      var newTitle = $title.text().replace('GLPI', <?php echo json_encode($pageTitle, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP) ?>);
       $title.text(newTitle);
       <?php
    endif;
@@ -78,7 +75,7 @@ if (false) {
    if ($footerDisplay === 'custom'):
       $footerText = \Glpi\RichText\RichText::getEnhancedHtml($footerText);
       ?>
-      $('div[id^=about_modal_] .copyright').parent().parent().html(<?php echo json_encode($footerText) ?>);
+      $('div[id^=about_modal_] .copyright').parent().parent().html(<?php echo json_encode($footerText, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP) ?>);
       <?php
    endif;
 

front/login.css.php

@@ -1,8 +0,0 @@
-<?php
-// Deprecated endpoint kept for backward compatibility.
-// All login styles are now injected inline from the display_login hook.
-
-header('Content-Type: text/css');
-header('Cache-Control: public, max-age=60');
-
-echo "/* Butterfly plugin: login.css.php is deprecated. */\n";

front/picture.send.php

@@ -4,10 +4,8 @@
  * Works without authentication and is compatible with GLPI 11 routing.
  */
 
-$_GET['donotcheckversion'] = true;
+// GLPI 11: o core já foi bootado pelo LegacyFileLoadController antes deste
-$dont_check_maintenance_mode = true;
+// arquivo executar — não incluir inc/includes.php (KB-PLUGIN-028)
-
-require_once '../../../inc/includes.php';
 
 $rawPath = $_GET['path'] ?? '';
 if ($rawPath === '') {

hook.php

@@ -50,12 +50,12 @@ function plugin_butterfly_display_login() {
       $(function() {
          var $loginInputs = $('#login_name, #inputUsername');
          if ($loginInputs.length) {
-            $loginInputs.attr('placeholder', <?php echo json_encode(__('Login')) ?>);
+            $loginInputs.attr('placeholder', <?php echo json_encode(__('Login'), JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP) ?>);
          }
 
          var $passwordInputs = $('input[type=password], input[name=password]');
          if ($passwordInputs.length) {
-            $passwordInputs.attr('placeholder', <?php echo json_encode(__('Password')) ?>);
+            $passwordInputs.attr('placeholder', <?php echo json_encode(__('Password'), JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP) ?>);
             $passwordInputs.each(function() {
                var $input = $(this);
                var $description = $input.siblings('.form-label-description').first();
@@ -71,14 +71,14 @@ function plugin_butterfly_display_login() {
       ?>
          var $icon = $('link[rel*=icon]');
          $icon.attr('type', null);
-         $icon.attr('href', <?php echo json_encode($faviconUrl) ?>);
+         $icon.attr('href', <?php echo json_encode($faviconUrl, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP) ?>);
       <?php
       endif;
    $pageTitle = PluginButterflyConfig::getConfig('page_title');
    if ($pageTitle) :
       ?>
          var $title = $('title');
-         var newTitle = $title.text().replace('GLPI', <?php echo json_encode($pageTitle) ?>);
+         var newTitle = $title.text().replace('GLPI', <?php echo json_encode($pageTitle, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP) ?>);
          $title.text(newTitle);
       <?php
       endif;
@@ -94,17 +94,17 @@ function plugin_butterfly_display_login() {
       ?>
          var $footerTarget = $('#footer-login, .login-footer').first();
          if ($footerTarget.length) {
-            $footerTarget.html(<?php echo json_encode($footerText) ?>);
+            $footerTarget.html(<?php echo json_encode($footerText, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP) ?>);
          } else {
-            $('a.copyright').parent().html(<?php echo json_encode($footerText) ?>);
+            $('a.copyright').parent().html(<?php echo json_encode($footerText, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP) ?>);
          }
       <?php
       endif;
    if ($loginPicture) :
       ?>
-         var pictureUrl = <?php echo json_encode($pictureUrl); ?>;
+         var pictureUrl = <?php echo json_encode($pictureUrl, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP); ?>;
-         var maxWidth = <?php echo json_encode($maxWidth); ?>;
+         var maxWidth = <?php echo json_encode($maxWidth, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP); ?>;
-         var maxHeight = <?php echo json_encode($maxHeight); ?>;
+         var maxHeight = <?php echo json_encode($maxHeight, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP); ?>;
 
          $('.page-anonymous .glpi-logo').css({
             'background-image': 'url(' + pictureUrl + ')',

setup.php

@@ -29,11 +29,6 @@ function plugin_init_butterfly()
          '#^/front/picture\.send\.php$#',
          \Glpi\Http\Firewall::STRATEGY_NO_CHECK
       );
-      \Glpi\Http\Firewall::addPluginStrategyForLegacyScripts(
-         'butterfly',
-         '#^/front/login\.css\.php$#',
-         \Glpi\Http\Firewall::STRATEGY_NO_CHECK
-      );
       \Glpi\Http\Firewall::addPluginStrategyForLegacyScripts(
          'butterfly',
          '#^/front/internal\.css\.php$#',