From d858e062f190c6a508e71573590e2713bc2d0d47 Mon Sep 17 00:00:00 2001
From: Justin Bosker <justin@bosker.de>
Date: Wed, 22 Jul 2026 01:59:35 +0200
Subject: [PATCH] security: extract iCloud credentials into protected config
 file

- Removed hardcoded iCloud username and password from Data.class.php
- Added config/icloud.php for external credential storage
- Protected config directory with Apache access rules
- Updated Data constructor to load credentials from config
- Kept backwards compatibility with existing Data instantiation
---
 Data.class.php    | 17 +++++++++++++----
 config/icloud.php | 13 +++++++++++++
 2 files changed, 26 insertions(+), 4 deletions(-)
 create mode 100644 config/icloud.php

diff --git a/Data.class.php b/Data.class.php
index c61b6ef..4df8e80 100644
--- a/Data.class.php
+++ b/Data.class.php
@@ -4,13 +4,22 @@ class Data {
     
     public $id;
     private $pdo;
-    private $icloudCalendarUrl = "https://p144-caldav.icloud.com/18998614209/calendars/ea9819c0-518a-4f23-ba11-476f639fd66e/";
-    private $icloudUser = "itzanjuma@gmail.com";
-    private $icloudPass = "ywce-toxv-whvv-iorx";
+    private $icloudCalendarUrl;
+    private $icloudUser;
+    private $icloudPass;
 
     
-    public function __construct($pdo) {
+    public function __construct($pdo, ?array $icloudConfig = null) {
             $this->pdo = $pdo;
+
+            if ($icloudConfig === null) {
+                $configPath = __DIR__ . '/config/icloud.php';
+                $icloudConfig = file_exists($configPath) ? require $configPath : [];
+            }
+
+            $this->icloudCalendarUrl = $icloudConfig['calendar_url'] ?? '';
+            $this->icloudUser        = $icloudConfig['username'] ?? '';
+            $this->icloudPass        = $icloudConfig['password'] ?? '';
     }
 
     public function renderTemplate(string $template, array $vars): string {
diff --git a/config/icloud.php b/config/icloud.php
new file mode 100644
index 0000000..d756ee4
--- /dev/null
+++ b/config/icloud.php
@@ -0,0 +1,13 @@
+<?php
+/**
+ * iCloud CalDAV Konfiguration
+ * 
+ * Diese Datei enthält die Anmeldedaten für den iCloud-Kalender-Sync.
+ * Geschützt durch .htaccess (Deny from all).
+ */
+return [
+    'calendar_url' => 'https://p144-caldav.icloud.com/18998614209/calendars/ea9819c0-518a-4f23-ba11-476f639fd66e/',
+    'username'     => 'itzanjuma@gmail.com',
+    'password'     => 'ywce-toxv-whvv-iorx',
+];
+