security: harden application security baseline

- Fixed SQL injection vulnerabilities with prepared statements
- Added column whitelist protection for dynamic termin updates
- Extracted iCloud credentials into protected config file
- Moved sensitive configuration files out of webroot
- Added authentication and admin checks to PVE APIs
- Added CSRF protection to write operations and APIs
- Disabled debug output in production mode
- Added centralized configuration handling
- Protected sensitive directories with access rules
- Added initial project security documentation

TODO.md

@@ -0,0 +1,34 @@
+# ANJUMA Dashboard – Sicherheits-Refactoring TODO
+
+## Phase 1 – Schnelle Erfolge (CRITICAL) ✅ COMPLETE
+
+- [x] SQL Injection in Data.class.php fixen (Prepared Statements)
+- [x] iCloud-Credentials auslagern in config/icloud.php
+- [x] .htaccess für config/ und storage/ erstellen
+- [x] config.cfg aus Webroot in config/ verschieben
+- [x] display_errors zentral in config.php steuern (error_reporting nur im Error-Handler)
+- [x] **CSRF-Schutz** für Termin-APIs (create, save, delete)
+- [x] **CSRF-Schutz** für Finance-APIs (save, delete expenses)
+- [x] **CSRF-Schutz** für Invoice-API (create from termin)
+- [x] **Auth-Check in PVE-APIs** (Session-Prüfung ergänzt)
+
+## Phase 2 – Strukturverbesserungen (NÄCHSTE SCHRITTE)
+
+- [ ] PSR-4 Autoloading via Composer einführen
+- [ ] Data.class.php aufteilen in TerminService, UserService, CalendarService, FinanceService
+- [ ] Zentrale Config-Klasse statt globaler define() und require
+- [ ] Repository Pattern für DB-Zugriffe (TerminRepository, UserRepository, etc.)
+- [ ] Template-Engine (Twig oder einfaches PHP-Template-System)
+- [ ] Router einführen (Front Controller Pattern)
+
+## Phase 3 – Langfristig
+
+- [ ] Datenbank-Migrationen (Phinx oder Doctrine Migrations)
+- [ ] Indizes optimieren (EXPLAIN-Analyse der häufigsten Queries)
+- [ ] Unit-Tests für Business-Logik (PHPUnit)
+- [ ] Logging-System (Monolog) statt debugLog() in Datei
+- [ ] CI/CD Pipeline (Gitea Actions)
+- [ ] Docker-Compose für lokale Entwicklung
+- [ ] API-Rate-Limiting für externe APIs (iCloud, Proxmox)
+- [ ] Monitoring (Health-Checks, Alerting)
+</create_file>