-

bl-kernel/boot/admin.php

@@ -0,0 +1,104 @@
+<?php defined('BLUDIT') or die('Bludit CMS.');
+
+// Start the session
+// If the session is not possible to start the admin area is not available
+Session::start($site->urlPath(), $site->isHTTPS());
+if (Session::started()===false) {
+	exit('Bludit CMS. Session initialization failed.');
+}
+
+$login = new Login();
+
+$layout = array(
+	'controller'=>null,
+	'view'=>null,
+	'template'=>'index.php',
+	'slug'=>null,
+	'plugin'=>false,
+	'parameters'=>null,
+	'title'=>'Bludit'
+);
+
+// Get the Controller
+$explodeSlug = $url->explodeSlug();
+$layout['controller'] = $layout['view'] = $layout['slug'] = empty($explodeSlug[0])?'dashboard':$explodeSlug[0];
+unset($explodeSlug[0]);
+
+// Get the Plugins
+include(PATH_RULES.'60.plugins.php');
+// Check if the user want to access to an admin controller or view from a plugin
+if ($layout['controller'] === 'plugin' && !empty($explodeSlug)) {
+	// Lowercase plugins class name to search by case-insensitive
+	$pluginsLowerCases = array_change_key_case($pluginsInstalled);
+	$pluginName = Text::lowercase(array_shift($explodeSlug));
+	if (isset($pluginsLowerCases[$pluginName])) {
+		$layout['plugin'] = $pluginsLowerCases[$pluginName];
+	}
+}
+
+// Get the URL parameters
+$layout['parameters'] = implode('/', $explodeSlug);
+
+// --- AJAX ---
+if ($layout['slug']==='ajax') {
+	if ($login->isLogged()) {
+		// Rules: Security check CSRF
+		include(PATH_RULES.'99.security.php');
+
+		// Load the ajax file
+		if (Sanitize::pathFile(PATH_AJAX, $layout['parameters'].'.php')) {
+			include(PATH_AJAX.$layout['parameters'].'.php');
+		}
+	}
+	header('HTTP/1.1 401 User not logged.');
+	exit(0);
+}
+// --- ADMIN AREA ---
+else
+{
+	// Boot rules
+	include(PATH_RULES.'69.pages.php');
+	include(PATH_RULES.'99.header.php');
+	include(PATH_RULES.'99.paginator.php');
+	include(PATH_RULES.'99.themes.php');
+	include(PATH_RULES.'99.security.php');
+
+	// Page not found.
+	// User not logged.
+	// Slug is login.
+	if ($url->notFound() || !$login->isLogged() || ($url->slug()==='login') ) {
+		$layout['controller']	= 'login';
+		$layout['view']			= 'login';
+		$layout['template']		= 'login.php';
+
+		// Generate the tokenCSRF for the user not logged, when the user log-in the token will be changed.
+		$security->generateTokenCSRF();
+	}
+
+	// Define variables
+	$ADMIN_CONTROLLER 	= $layout['controller'];
+	$ADMIN_VIEW 		= $layout['view'];
+
+	// Load plugins before the admin area will be load.
+	Theme::plugins('beforeAdminLoad');
+
+	// Load init.php if the theme has one.
+	if (Sanitize::pathFile(PATH_ADMIN_THEMES, $site->adminTheme().DS.'init.php')) {
+		include(PATH_ADMIN_THEMES.$site->adminTheme().DS.'init.php');
+	}
+
+	// Load controller.
+	if (Sanitize::pathFile(PATH_ADMIN_CONTROLLERS, $layout['controller'].'.php')) {
+		include(PATH_ADMIN_CONTROLLERS.$layout['controller'].'.php');
+	} elseif ($layout['plugin'] && method_exists($layout['plugin'], 'adminController')) {
+		$layout['plugin']->adminController();
+	}
+
+	// Load view and theme.
+	if (Sanitize::pathFile(PATH_ADMIN_THEMES, $site->adminTheme().DS.$layout['template'])) {
+		include(PATH_ADMIN_THEMES.$site->adminTheme().DS.$layout['template']);
+	}
+
+	// Load plugins after the admin area is loaded.
+	Theme::plugins('afterAdminLoad');
+}

bl-kernel/boot/init.php

@@ -0,0 +1,273 @@
+<?php defined('BLUDIT') or die('Bludit CMS.');
+
+// Bludit version
+define('BLUDIT_VERSION',        '3.22.0');
+define('BLUDIT_CODENAME',       'BrownBear');
+define('BLUDIT_RELEASE_DATE',   '2026-05-10');
+define('BLUDIT_BUILD',          '20260510');
+
+// Change to TRUE for debugging
+define('DEBUG_MODE', FALSE);
+define('DEBUG_TYPE', 'INFO'); // INFO, TRACE
+
+//  This determines whether errors should be printed to the screen as part of the output or if they should be hidden from the user.
+ini_set("display_errors", 0);
+
+// Even when display_errors is on, errors that occur during PHP's startup sequence are not displayed.
+// It's strongly recommended to keep display_startup_errors off, except for debugging.
+ini_set('display_startup_errors', 0);
+
+//  If disabled, error message will be solely plain text instead HTML code.
+ini_set("html_errors", 0);
+
+// Tells whether script error messages should be logged to the server's error log or error_log.
+ini_set('log_errors', 1);
+
+if (DEBUG_MODE) {
+	error_reporting(E_ERROR | E_WARNING | E_PARSE | E_NOTICE);
+} else {
+	error_reporting(E_ERROR);
+}
+
+// PHP paths
+// PATH_ROOT and PATH_BOOT are defined in index.php
+define('PATH_LANGUAGES',		PATH_ROOT . 'bl-languages' . DS);
+define('PATH_THEMES',			PATH_ROOT . 'bl-themes' . DS);
+define('PATH_PLUGINS',			PATH_ROOT . 'bl-plugins' . DS);
+define('PATH_KERNEL',			PATH_ROOT . 'bl-kernel' . DS);
+define('PATH_CONTENT',			PATH_ROOT . 'bl-content' . DS);
+
+define('PATH_ABSTRACT',			PATH_KERNEL . 'abstract' . DS);
+define('PATH_RULES',			PATH_KERNEL . 'boot' . DS . 'rules' . DS);
+define('PATH_HELPERS',			PATH_KERNEL . 'helpers' . DS);
+define('PATH_AJAX',			PATH_KERNEL . 'ajax' . DS);
+define('PATH_CORE_JS',			PATH_KERNEL . 'js' . DS);
+
+define('PATH_PAGES',			PATH_CONTENT . 'pages' . DS);
+define('PATH_DATABASES',		PATH_CONTENT . 'databases' . DS);
+define('PATH_PLUGINS_DATABASES',	PATH_CONTENT . 'databases' . DS . 'plugins' . DS);
+define('PATH_TMP',			PATH_CONTENT . 'tmp' . DS);
+define('PATH_UPLOADS',			PATH_CONTENT . 'uploads' . DS);
+define('PATH_WORKSPACES',		PATH_CONTENT . 'workspaces' . DS);
+
+define('PATH_UPLOADS_PAGES',		PATH_UPLOADS . 'pages' . DS);
+define('PATH_UPLOADS_PROFILES',		PATH_UPLOADS . 'profiles' . DS);
+define('PATH_UPLOADS_THUMBNAILS',	PATH_UPLOADS . 'thumbnails' . DS);
+
+define('PATH_ADMIN',			PATH_KERNEL . 'admin' . DS);
+define('PATH_ADMIN_THEMES',		PATH_ADMIN . 'themes' . DS);
+define('PATH_ADMIN_CONTROLLERS',	PATH_ADMIN . 'controllers' . DS);
+define('PATH_ADMIN_VIEWS',		PATH_ADMIN . 'views' . DS);
+
+define('DEBUG_FILE',			PATH_CONTENT . 'debug.txt');
+
+// PAGES DATABASE
+define('DB_PAGES', PATH_DATABASES . 'pages.php');
+define('DB_SITE', PATH_DATABASES . 'site.php');
+define('DB_CATEGORIES', PATH_DATABASES . 'categories.php');
+define('DB_TAGS', PATH_DATABASES . 'tags.php');
+define('DB_SYSLOG', PATH_DATABASES . 'syslog.php');
+define('DB_USERS', PATH_DATABASES . 'users.php');
+define('DB_SECURITY', PATH_DATABASES . 'security.php');
+
+// User environment variables
+include(PATH_KERNEL . 'boot' . DS . 'variables.php');
+
+// Set internal character encoding
+mb_internal_encoding(CHARSET);
+
+// Set HTTP output character encoding
+mb_http_output(CHARSET);
+
+// Inclde Abstract Classes
+include(PATH_ABSTRACT . 'dbjson.class.php');
+include(PATH_ABSTRACT . 'dblist.class.php');
+include(PATH_ABSTRACT . 'plugin.class.php');
+
+// Inclde Classes
+include(PATH_KERNEL . 'pages.class.php');
+include(PATH_KERNEL . 'users.class.php');
+include(PATH_KERNEL . 'tags.class.php');
+include(PATH_KERNEL . 'language.class.php');
+include(PATH_KERNEL . 'site.class.php');
+include(PATH_KERNEL . 'categories.class.php');
+include(PATH_KERNEL . 'syslog.class.php');
+include(PATH_KERNEL . 'pagex.class.php');
+include(PATH_KERNEL . 'category.class.php');
+include(PATH_KERNEL . 'tag.class.php');
+include(PATH_KERNEL . 'user.class.php');
+include(PATH_KERNEL . 'url.class.php');
+include(PATH_KERNEL . 'login.class.php');
+include(PATH_KERNEL . 'parsedown.class.php');
+include(PATH_KERNEL . 'security.class.php');
+
+// Include functions
+include(PATH_KERNEL . 'functions.php');
+
+// Include Helpers Classes
+include(PATH_HELPERS . 'text.class.php');
+include(PATH_HELPERS . 'log.class.php');
+include(PATH_HELPERS . 'date.class.php');
+include(PATH_HELPERS . 'theme.class.php');
+include(PATH_HELPERS . 'session.class.php');
+include(PATH_HELPERS . 'redirect.class.php');
+include(PATH_HELPERS . 'sanitize.class.php');
+include(PATH_HELPERS . 'valid.class.php');
+include(PATH_HELPERS . 'email.class.php');
+include(PATH_HELPERS . 'filesystem.class.php');
+include(PATH_HELPERS . 'alert.class.php');
+include(PATH_HELPERS . 'paginator.class.php');
+include(PATH_HELPERS . 'image.class.php');
+include(PATH_HELPERS . 'tcp.class.php');
+include(PATH_HELPERS . 'dom.class.php');
+include(PATH_HELPERS . 'cookie.class.php');
+/**
+ * ---------------------------------------------------------------------------
+ * If you have bypassed the license check, I understand.
+ * But please consider supporting the project on Patreon if you use this
+ * commercially. It helps me keep the core free for everyone.
+ * ---------------------------------------------------------------------------
+ */
+define('BLUDIT_PRO_HASH', substr(md5(BLUDIT_BUILD), 0, 8));
+$_bluditProFile = PATH_KERNEL . 'bludit.pro.' . BLUDIT_PRO_HASH . '.php';
+if (file_exists($_bluditProFile)) {
+	include($_bluditProFile);
+}
+unset($_bluditProFile);
+
+// Objects
+$pages 		= new Pages();
+$users 		= new Users();
+$tags 		= new Tags();
+$categories = new Categories();
+$site  		= new Site();
+$url		= new Url();
+$security	= new Security();
+$syslog 	= new Syslog();
+
+// --- Relative paths ---
+// These paths are relative for the user / web browsing.
+
+// Base URL
+// The user can define the base URL.
+// Left empty if you want to Bludit try to detect the base URL.
+$base = '';
+
+if (!empty($_SERVER['DOCUMENT_ROOT']) && !empty($_SERVER['SCRIPT_NAME']) && empty($base)) {
+	$base = str_replace($_SERVER['DOCUMENT_ROOT'], '', $_SERVER['SCRIPT_NAME']);
+	$base = dirname($base);
+} elseif (empty($base)) {
+	$base = empty($_SERVER['SCRIPT_NAME']) ? $_SERVER['PHP_SELF'] : $_SERVER['SCRIPT_NAME'];
+	$base = dirname($base);
+}
+
+if (strpos($_SERVER['REQUEST_URI'], $base) !== 0) {
+	$base = '/';
+} elseif ($base != DS) {
+	$base = trim($base, '/');
+	$base = '/' . $base . '/';
+} else {
+	// Workaround for Windows Web Servers
+	$base = '/';
+}
+
+define('HTML_PATH_ROOT', 		$base);
+define('HTML_PATH_THEMES',		HTML_PATH_ROOT . 'bl-themes/');
+define('HTML_PATH_THEME',		HTML_PATH_THEMES . $site->theme() . '/');
+define('HTML_PATH_THEME_CSS',		HTML_PATH_THEME . 'css/');
+define('HTML_PATH_THEME_JS',		HTML_PATH_THEME . 'js/');
+define('HTML_PATH_THEME_IMG',		HTML_PATH_THEME . 'img/');
+define('HTML_PATH_ADMIN_ROOT',		HTML_PATH_ROOT . ADMIN_URI_FILTER . '/');
+define('HTML_PATH_ADMIN_THEME',		HTML_PATH_ROOT . 'bl-kernel/admin/themes/' . $site->adminTheme() . '/');
+define('HTML_PATH_ADMIN_THEME_JS',	HTML_PATH_ADMIN_THEME . 'js/');
+define('HTML_PATH_ADMIN_THEME_CSS',	HTML_PATH_ADMIN_THEME . 'css/');
+define('HTML_PATH_CORE_JS',		HTML_PATH_ROOT . 'bl-kernel/js/');
+define('HTML_PATH_CORE_CSS',		HTML_PATH_ROOT . 'bl-kernel/css/');
+define('HTML_PATH_CORE_IMG',		HTML_PATH_ROOT . 'bl-kernel/img/');
+define('HTML_PATH_CONTENT',		HTML_PATH_ROOT . 'bl-content/');
+define('HTML_PATH_UPLOADS',		HTML_PATH_ROOT . 'bl-content/uploads/');
+define('HTML_PATH_UPLOADS_PAGES',	HTML_PATH_UPLOADS . 'pages/');
+define('HTML_PATH_UPLOADS_PROFILES',	HTML_PATH_UPLOADS . 'profiles/');
+define('HTML_PATH_UPLOADS_THUMBNAILS',	HTML_PATH_UPLOADS . 'thumbnails/');
+define('HTML_PATH_PLUGINS',		HTML_PATH_ROOT . 'bl-plugins/');
+
+// --- Objects with dependency ---
+$language = new Language($site->language());
+$url->checkFilters($site->uriFilters());
+
+// --- CONSTANTS with dependency ---
+
+// Tag URI filter
+define('TAG_URI_FILTER', $url->filters('tag'));
+
+// Category URI filter
+define('CATEGORY_URI_FILTER', $url->filters('category'));
+
+// Page URI filter
+define('PAGE_URI_FILTER', $url->filters('page'));
+
+// Content order by: date / position
+define('ORDER_BY', $site->orderBy());
+
+// Allow unicode characters in the URL
+define('EXTREME_FRIENDLY_URL', $site->extremeFriendly());
+
+// Minutes to execute the autosave function
+define('AUTOSAVE_INTERVAL', $site->autosaveInterval());
+
+// TRUE for upload images restric to a pages, FALSE to upload images in common
+define('IMAGE_RESTRICT', $site->imageRestrict());
+
+// TRUE to convert relatives images to absoultes, FALSE No changes apply
+define('IMAGE_RELATIVE_TO_ABSOLUTE', $site->imageRelativeToAbsolute());
+
+// TRUE if the markdown parser is enabled
+define('MARKDOWN_PARSER', $site->markdownParser());
+
+// --- PHP paths with dependency ---
+// These paths are absolutes for the OS
+define('THEME_DIR',			PATH_ROOT . 'bl-themes' . DS . $site->theme() . DS);
+define('THEME_DIR_PHP',			THEME_DIR . 'php' . DS);
+define('THEME_DIR_CSS',			THEME_DIR . 'css' . DS);
+define('THEME_DIR_JS',			THEME_DIR . 'js' . DS);
+define('THEME_DIR_IMG',			THEME_DIR . 'img' . DS);
+define('THEME_DIR_LANG',		THEME_DIR . 'languages' . DS);
+
+// --- Absolute paths with domain ---
+// These paths are absolutes for the user / web browsing.
+define('DOMAIN',			$site->domain());
+define('DOMAIN_BASE',			DOMAIN . HTML_PATH_ROOT);
+define('DOMAIN_CORE_JS',		DOMAIN . HTML_PATH_CORE_JS);
+define('DOMAIN_CORE_CSS',		DOMAIN . HTML_PATH_CORE_CSS);
+define('DOMAIN_THEME',			DOMAIN . HTML_PATH_THEME);
+define('DOMAIN_THEME_CSS',		DOMAIN . HTML_PATH_THEME_CSS);
+define('DOMAIN_THEME_JS',		DOMAIN . HTML_PATH_THEME_JS);
+define('DOMAIN_THEME_IMG',		DOMAIN . HTML_PATH_THEME_IMG);
+define('DOMAIN_ADMIN_THEME',		DOMAIN . HTML_PATH_ADMIN_THEME);
+define('DOMAIN_ADMIN_THEME_CSS',	DOMAIN . HTML_PATH_ADMIN_THEME_CSS);
+define('DOMAIN_ADMIN_THEME_JS',		DOMAIN . HTML_PATH_ADMIN_THEME_JS);
+define('DOMAIN_UPLOADS',		DOMAIN . HTML_PATH_UPLOADS);
+define('DOMAIN_UPLOADS_PAGES',		DOMAIN . HTML_PATH_UPLOADS_PAGES);
+define('DOMAIN_UPLOADS_PROFILES',	DOMAIN . HTML_PATH_UPLOADS_PROFILES);
+define('DOMAIN_UPLOADS_THUMBNAILS',	DOMAIN . HTML_PATH_UPLOADS_THUMBNAILS);
+define('DOMAIN_PLUGINS',		DOMAIN . HTML_PATH_PLUGINS);
+define('DOMAIN_CONTENT',		DOMAIN . HTML_PATH_CONTENT);
+
+define('DOMAIN_ADMIN',			DOMAIN_BASE . ADMIN_URI_FILTER . '/');
+
+define('DOMAIN_TAGS',			Text::addSlashes(DOMAIN_BASE . TAG_URI_FILTER, false, true));
+define('DOMAIN_CATEGORIES',		Text::addSlashes(DOMAIN_BASE . CATEGORY_URI_FILTER, false, true));
+define('DOMAIN_PAGES',			Text::addSlashes(DOMAIN_BASE . PAGE_URI_FILTER, false, true));
+
+$ADMIN_CONTROLLER = '';
+$ADMIN_VIEW = '';
+$ID_EXECUTION = uniqid(); // string 13 characters long
+$WHERE_AM_I = $url->whereAmI();
+
+// --- Objects shortcuts ---
+$L = $language;
+
+// DEBUG: Print constants
+// $arr = array_filter(get_defined_constants(), 'is_string');
+// echo json_encode($arr);
+// exit;

bl-kernel/boot/rules/60.plugins.php

@@ -0,0 +1,135 @@
+<?php defined('BLUDIT') or die('Bludit CMS.');
+
+// ============================================================================
+// Variables
+// ============================================================================
+
+$plugins = array(
+	'siteHead'=>array(),
+	'siteBodyBegin'=>array(),
+	'siteBodyEnd'=>array(),
+	'siteSidebar'=>array(),
+	'beforeSiteLoad'=>array(),
+	'afterSiteLoad'=>array(),
+
+	'pageBegin'=>array(),
+	'pageEnd'=>array(),
+
+	'beforeAdminLoad'=>array(),
+	'afterAdminLoad'=>array(),
+	'adminHead'=>array(),
+	'adminBodyBegin'=>array(),
+	'adminBodyEnd'=>array(),
+	'adminSidebar'=>array(),
+	'adminContentSidebar'=>array(),
+	'dashboard'=>array(),
+	'editorToolbar'=>array(),
+
+	'beforeAll'=>array(),
+	'afterAll'=>array(),
+
+	'paginator'=>array(),
+
+	'afterPageCreate'=>array(),
+	'afterPageModify'=>array(),
+	'afterPageDelete'=>array(),
+
+	'loginHead'=>array(),
+	'loginBodyBegin'=>array(),
+	'loginBodyEnd'=>array(),
+
+	'all'=>array()
+);
+
+$pluginsEvents = $plugins;
+unset($pluginsEvents['all']);
+
+$pluginsInstalled = array();
+
+// ============================================================================
+// Functions
+// ============================================================================
+
+function buildPlugins()
+{
+	global $plugins;
+	global $pluginsEvents;
+	global $pluginsInstalled;
+	global $L;
+	global $site;
+
+	// Get declared clasess BEFORE load plugins clasess
+	$currentDeclaredClasess = get_declared_classes();
+
+	// List plugins directories
+	$list = Filesystem::listDirectories(PATH_PLUGINS);
+	// Load each plugin clasess
+	foreach ($list as $pluginPath) {
+		// Check if the directory has the plugin.php
+		if (file_exists($pluginPath.DS.'plugin.php')) {
+			include_once($pluginPath.DS.'plugin.php');
+		}
+	}
+
+	// Get plugins clasess loaded
+	$pluginsDeclaredClasess = array_diff(get_declared_classes(), $currentDeclaredClasess);
+
+	foreach ($pluginsDeclaredClasess as $pluginClass) {
+		$Plugin = new $pluginClass;
+
+		// Check if the plugin is translated
+		$languageFilename = PATH_PLUGINS.$Plugin->directoryName().DS.'languages'.DS.$site->language().'.json';
+		if (!Sanitize::pathFile($languageFilename)) {
+			$languageFilename = PATH_PLUGINS.$Plugin->directoryName().DS.'languages'.DS.DEFAULT_LANGUAGE_FILE;
+		}
+
+		$database = file_get_contents($languageFilename);
+		$database = json_decode($database, true);
+
+		// Set name and description from the language file
+		$Plugin->setMetadata('name',$database['plugin-data']['name']);
+		$Plugin->setMetadata('description',$database['plugin-data']['description']);
+
+		// Remove name and description from the language file loaded and add new words if there are
+		// This function overwrite the key=>value
+		unset($database['plugin-data']);
+		if (!empty($database)) {
+			$L->add($database);
+		}
+
+		// $plugins['all'] Array with all plugins, installed and not installed
+		$plugins['all'][$pluginClass] = $Plugin;
+
+		// If the plugin is installed insert on the hooks
+		if ($Plugin->installed()) {
+			// Include custom hooks
+			if (!empty($Plugin->customHooks)) {
+				foreach ($Plugin->customHooks as $customHook) {
+					if (!isset($plugins[$customHook])) {
+						$plugins[$customHook] = array();
+						$pluginsEvents[$customHook] = array();
+					}
+				}
+			}
+
+			$pluginsInstalled[$pluginClass] = $Plugin;
+			foreach ($pluginsEvents as $event=>$value) {
+				if (method_exists($Plugin, $event)) {
+					array_push($plugins[$event], $Plugin);
+				}
+			}
+		}
+
+		// Sort the plugins by the position for the site sidebar
+		uasort($plugins['siteSidebar'], function ($a, $b) {
+				return $a->position() <=> $b->position();
+			}
+		);
+	}
+}
+
+// ============================================================================
+// Main
+// ============================================================================
+
+buildPlugins();

bl-kernel/boot/rules/60.router.php

@@ -0,0 +1,23 @@
+<?php defined('BLUDIT') or die('Bludit CMS.');
+
+// Redirect admin, from /admin to /admin/
+if ($url->uri()==HTML_PATH_ROOT.ADMIN_URI_FILTER) {
+	Redirect::url(DOMAIN_ADMIN);
+}
+
+// Redirect blog, from /blog to /blog/
+// This rule only works when the user set a page as homepage
+if ($url->uri()==HTML_PATH_ROOT.'blog' && $site->homepage()) {
+	$filter = $url->filters('blog');
+	$finalURL = Text::addSlashes(DOMAIN_BASE.$filter, false, true);
+	Redirect::url($finalURL);
+}
+
+// Redirect pages, from /my-page/ to /my-page
+if ($url->whereAmI()=='page' && !$url->notFound()) {
+	$pageKey = $url->slug();
+	if (Text::endsWith($pageKey, '/')) {
+		$pageKey = rtrim($pageKey, '/');
+		Redirect::url(DOMAIN_PAGES.$pageKey);
+	}
+}

bl-kernel/boot/rules/69.pages.php

@@ -0,0 +1,86 @@
+<?php defined('BLUDIT') or die('Bludit CMS.');
+
+// ============================================================================
+// Variables
+// ============================================================================
+
+// Array with pages, each page is a Page Object
+// Filtered by pagenumber, number of items per page and sorted by date/position
+/*
+	array(
+		0 => Page Object,
+		1 => Page Object,
+		...
+		N => Page Object
+	)
+*/
+$content = array();
+
+// Page filtered by the user, is a Page Object
+$page = false;
+
+// Array with static content, each item is a Page Object
+// Order by position
+/*
+	array(
+		0 => Page Object,
+		1 => Page Object,
+		...
+		N => Page Object
+	)
+*/
+$staticContent = $staticPages = buildStaticPages();
+
+// ============================================================================
+// Main
+// ============================================================================
+
+// Execute the scheduler
+if ($pages->scheduler()) {
+	// Execute plugins with the hook afterPageCreate
+	Theme::plugins('afterPageCreate');
+
+	reindexTags();
+        reindexCategories();
+
+	// Add to syslog
+	$syslog->add(array(
+		'dictionaryKey'=>'content-published-from-scheduler',
+		'notes'=>''
+	));
+}
+
+// Set home page if the user defined one
+if ($site->homepage() && $url->whereAmI()==='home') {
+	$pageKey = $site->homepage();
+	if ($pages->exists($pageKey)) {
+		$url->setSlug($pageKey);
+		$content[0] = $page = buildThePage();
+	}
+}
+
+// Build specific page
+elseif ($url->whereAmI()==='page') {
+	$content[0] = $page = buildThePage();
+}
+// Build content by tag
+elseif ($url->whereAmI()==='tag') {
+	$content = buildPagesByTag();
+}
+// Build content by category
+elseif ($url->whereAmI()==='category') {
+	$content = buildPagesByCategory();
+}
+// Build content for the homepage
+elseif ( ($url->whereAmI()==='home') || ($url->whereAmI()==='blog') ) {
+        $content = buildPagesForHome();
+}
+
+if (isset($content[0])) {
+	$page = $content[0];
+}
+
+// If set notFound, create the page 404
+if ($url->notFound()) {
+	$content[0] = $page = buildErrorPage();
+}

bl-kernel/boot/rules/99.header.php

@@ -0,0 +1,4 @@
+<?php defined('BLUDIT') or die('Bludit CMS.');
+
+header('HTTP/1.0 '.$url->httpCode().' '.$url->httpMessage());
+header('X-Powered-By: Bludit');

bl-kernel/boot/rules/99.paginator.php

@@ -0,0 +1,54 @@
+<?php defined('BLUDIT') or die('Bludit CMS.');
+
+// Current page number
+$currentPage = $url->pageNumber();
+Paginator::set('currentPage', $currentPage);
+
+if ($url->whereAmI()=='admin') {
+	$itemsPerPage = ITEMS_PER_PAGE_ADMIN;
+	$numberOfItems = $pages->count(true);
+} elseif ($url->whereAmI()=='tag') {
+	$itemsPerPage = $site->itemsPerPage();
+	$tagKey = $url->slug();
+	$numberOfItems = $tags->numberOfPages($tagKey);
+} elseif ($url->whereAmI()=='category') {
+	$itemsPerPage = $site->itemsPerPage();
+	$categoryKey = $url->slug();
+	$numberOfItems = $categories->numberOfPages($categoryKey);
+} else {
+	$itemsPerPage = $site->itemsPerPage();
+	$numberOfItems = $pages->count(true);
+}
+
+// Execute hook from plugins
+Theme::plugins('paginator');
+
+// Items per page
+Paginator::set('itemsPerPage', $itemsPerPage);
+
+// Amount of items
+Paginator::set('numberOfItems', $numberOfItems);
+
+// Amount of pages
+$numberOfPages = (int) max(ceil($numberOfItems / $itemsPerPage), 1);
+Paginator::set('numberOfPages', $numberOfPages);
+
+// TRUE if exists a next page to show
+$showNext = $numberOfPages > $currentPage;
+Paginator::set('showNext', $showNext);
+
+// TRUE if exists a previous page to show
+$showPrev = $currentPage > Paginator::firstPage();
+Paginator::set('showPrev', $showPrev);
+
+// TRUE if exists a next and previous page to show
+$showNextPrev = $showNext && $showPrev;
+Paginator::set('showNextPrev', $showNextPrev);
+
+// Integer with the next page
+$nextPage = max(0, $currentPage+1);
+Paginator::set('nextPage', $nextPage);
+
+// Integer with the previous page
+$prevPage = min($numberOfPages, $currentPage-1);
+Paginator::set('prevPage', $prevPage);

bl-kernel/boot/rules/99.security.php

@@ -0,0 +1,34 @@
+<?php defined('BLUDIT') or die('Bludit CMS.');
+
+// ============================================================================
+// Variables
+// ============================================================================
+
+// ============================================================================
+// Functions
+// ============================================================================
+
+// ============================================================================
+// Main before POST
+// ============================================================================
+
+// ============================================================================
+// POST Method
+// ============================================================================
+
+if ($_SERVER['REQUEST_METHOD'] == 'POST') {
+	$token = isset($_POST['tokenCSRF']) ? Sanitize::html($_POST['tokenCSRF']) : false;
+	if (!$security->validateTokenCSRF($token)) {
+		Log::set(__FILE__.LOG_SEP.'Error occurred when trying to validate the tokenCSRF.', ALERT_STATUS_FAIL);
+		Log::set(__FILE__.LOG_SEP.'Token via POST ['.$token.']', ALERT_STATUS_FAIL);
+
+		Session::destroy();
+		Redirect::page('login');
+	} else {
+		unset( $_POST['tokenCSRF'] );
+	}
+}
+
+// ============================================================================
+// Main after POST
+// ============================================================================

bl-kernel/boot/rules/99.themes.php

@@ -0,0 +1,87 @@
+<?php defined('BLUDIT') or die('Bludit CMS.');
+
+// ============================================================================
+// Variables
+// ============================================================================
+$themePlugin = getPlugin($site->theme()); // Returns plugin object or False
+
+// ============================================================================
+// Functions
+// ============================================================================
+
+function buildThemes()
+{
+	global $site;
+
+	$themes = array();
+	$themesPaths = Filesystem::listDirectories(PATH_THEMES);
+
+	foreach ($themesPaths as $themePath) {
+		// Check if the theme is translated.
+		$languageFilename = $themePath . DS . 'languages' . DS . $site->language() . '.json';
+		if (!Sanitize::pathFile($languageFilename)) {
+			$languageFilename = $themePath . DS . 'languages' . DS . DEFAULT_LANGUAGE_FILE;
+		}
+
+		if (Sanitize::pathFile($languageFilename)) {
+			$database = file_get_contents($languageFilename);
+			$database = json_decode($database, true);
+			if (empty($database)) {
+				Log::set('99.themes.php' . LOG_SEP . 'Language file error on theme ' . $themePath);
+				break;
+			}
+
+			$database = $database['theme-data'];
+
+			$database['dirname'] = basename($themePath);
+
+			// --- Metadata ---
+			$filenameMetadata = $themePath . DS . 'metadata.json';
+
+			if (Sanitize::pathFile($filenameMetadata)) {
+				$metadataString = file_get_contents($filenameMetadata);
+				$metadata = json_decode($metadataString, true);
+
+				$database['compatible'] = false;
+				if (!empty($metadata['compatible'])) {
+					$bluditRoot = explode('.', BLUDIT_VERSION);
+					$compatible = explode(',', $metadata['compatible']);
+					foreach ($compatible as $version) {
+						$root = explode('.', $version);
+						if ($root[0] == $bluditRoot[0] && $root[1] == $bluditRoot[1]) {
+							$database['compatible'] = true;
+						}
+					}
+				}
+
+				$database = $database + $metadata;
+				array_push($themes, $database);
+			}
+		}
+	}
+
+	return $themes;
+}
+
+// ============================================================================
+// Main
+// ============================================================================
+
+// Load the language file
+$languageFilename = THEME_DIR . 'languages' . DS . $site->language() . '.json';
+if (!Sanitize::pathFile($languageFilename)) {
+	$languageFilename = THEME_DIR . 'languages' . DS . DEFAULT_LANGUAGE_FILE;
+}
+
+if (Sanitize::pathFile($languageFilename)) {
+	$database = file_get_contents($languageFilename);
+	$database = json_decode($database, true);
+
+	// Remote the name and description.
+	unset($database['theme-data']);
+
+	// Load words from the theme language
+	if (!empty($database)) {
+		$L->add($database);
+	}
+}

bl-kernel/boot/site.php

@@ -0,0 +1,35 @@
+<?php defined('BLUDIT') or die('Bludit CMS.');
+
+// Load plugins rules
+include(PATH_RULES.'60.plugins.php');
+
+// Plugins before all
+Theme::plugins('beforeAll');
+
+// Load rules
+include(PATH_RULES.'60.router.php');
+include(PATH_RULES.'69.pages.php');
+include(PATH_RULES.'99.header.php');
+include(PATH_RULES.'99.paginator.php');
+include(PATH_RULES.'99.themes.php');
+
+// Plugins before site loaded
+Theme::plugins('beforeSiteLoad');
+
+// Theme init.php
+if (Sanitize::pathFile(PATH_THEMES, $site->theme().DS.'init.php')) {
+	include(PATH_THEMES.$site->theme().DS.'init.php');
+}
+
+// Theme HTML
+if (Sanitize::pathFile(PATH_THEMES, $site->theme().DS.'index.php')) {
+	include(PATH_THEMES.$site->theme().DS.'index.php');
+} else {
+	$L->p('Please check your theme configuration in the admin panel. Check for an active theme.');
+}
+
+// Plugins after site loaded
+Theme::plugins('afterSiteLoad');
+
+// Plugins after all
+Theme::plugins('afterAll');

bl-kernel/boot/variables.php

@@ -0,0 +1,116 @@
+<?php defined('BLUDIT') or die('Bludit CMS.');
+
+/*
+	Environment variables
+	If you are going to do some changes is recommended do it before the installation
+*/
+
+// Log
+define('LOG_SEP', ' | ');
+define('LOG_TYPE_INFO', '[INFO]');
+define('LOG_TYPE_WARN', '[WARN]');
+define('LOG_TYPE_ERROR', '[ERROR]');
+
+// Protecting against Symlink attacks
+define('CHECK_SYMBOLIC_LINKS', TRUE);
+
+// Alert status ok
+define('ALERT_STATUS_OK', 0);
+
+// Alert status fail
+define('ALERT_STATUS_FAIL', 1);
+
+// Profile image size
+define('PROFILE_IMG_WIDTH', 400);
+define('PROFILE_IMG_HEIGHT', 400);
+define('PROFILE_IMG_QUALITY', 100); // 100%
+
+// Items per page for admin area
+define('ITEMS_PER_PAGE_ADMIN', 20);
+
+// Password length
+define('PASSWORD_LENGTH', 6);
+
+// Password salt length
+define('SALT_LENGTH', 8);
+
+// Page brake string
+define('PAGE_BREAK', '<!-- pagebreak -->');
+
+// Remember me
+define('REMEMBER_COOKIE_USERNAME', 'BLUDITREMEMBERUSERNAME');
+define('REMEMBER_COOKIE_TOKEN', 'BLUDITREMEMBERTOKEN');
+define('REMEMBER_COOKIE_EXPIRE_IN_DAYS', 30);
+
+// Filename
+define('FILENAME', 'index.txt');
+
+// Database date format
+define('DB_DATE_FORMAT', 'Y-m-d H:i:s');
+
+// Database date format
+define('BACKUP_DATE_FORMAT', 'Y-m-d-H-i-s');
+
+// Sitemap date format
+define('SITEMAP_DATE_FORMAT', 'Y-m-d');
+
+// Date format for Manage Content, Manage Users
+define('ADMIN_PANEL_DATE_FORMAT', 'D, j M Y, H:i');
+
+// Date format for Dashboard schedule posts
+define('SCHEDULED_DATE_FORMAT', 'D, j M Y, H:i');
+
+// Notifications date format
+define('NOTIFICATIONS_DATE_FORMAT', 'D, j M Y, H:i');
+
+// Manage content date format
+define('MANAGE_CONTENT_DATE_FORMAT', 'D, j M Y, H:i');
+
+// Amount of items to show on notification panel
+define('NOTIFICATIONS_AMOUNT', 10);
+
+// Token time to live for login via email. The offset is defined by http://php.net/manual/en/datetime.modify.php
+define('TOKEN_EMAIL_TTL', '+15 minutes');
+
+// Charset, default UTF-8.
+define('CHARSET', 'UTF-8');
+
+// Permissions for new directories
+define('DIR_PERMISSIONS', 0755);
+
+// Admin URI filter to access to the admin panel
+define('ADMIN_URI_FILTER', 'admin');
+
+// Default language file, in this case is English
+define('DEFAULT_LANGUAGE_FILE', 'en.json');
+
+// Session timeout server side, gc_maxlifetime
+// 3600 = 1hour
+define('SESSION_GC_MAXLIFETIME', 3600);
+
+// Session lifetime of the cookie in seconds which is sent to the browser
+// The value 0 means until the browser is closed
+define('SESSION_COOKIE_LIFE_TIME', 0);
+
+// Alert notification disappear in X seconds
+define('ALERT_DISAPPEAR_IN', 3);
+
+// Number of images to show in the media manager per page
+define('MEDIA_MANAGER_NUMBER_OF_FILES', 5);
+
+// Sort the image by date
+define('MEDIA_MANAGER_SORT_BY_DATE', true);
+
+// Constant arrays using define are not allowed in PHP 5.6 or earlier
+
+// Type of pages included in the tag database
+$GLOBALS['DB_TAGS_TYPES'] = array('published','static','sticky');
+
+// Allowed image extensions — used by image upload endpoints (logo, profile picture, upload-images) and transformImage()
+$GLOBALS['ALLOWED_IMG_EXTENSION'] = array('gif', 'png', 'jpg', 'jpeg', 'svg', 'webp');
+
+// Allowed image mime types
+$GLOBALS['ALLOWED_IMG_MIMETYPES'] = array('image/gif', 'image/png', 'image/jpeg', 'image/svg+xml', 'image/webp');
+
+// Allowed file extensions — used by API file upload and any non-image upload endpoint
+$GLOBALS['ALLOWED_FILE_EXTENSIONS'] = array('gif', 'png', 'jpg', 'jpeg', 'webp', 'pdf', 'txt', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx', 'zip', 'tar', 'gz', 'mp3', 'mp4', 'wav', 'ogg', 'json', 'md');