security: harden application security baseline

- Fixed SQL injection vulnerabilities with prepared statements
- Added column whitelist protection for dynamic termin updates
- Extracted iCloud credentials into protected config file
- Moved sensitive configuration files out of webroot
- Added authentication and admin checks to PVE APIs
- Added CSRF protection to write operations and APIs
- Disabled debug output in production mode
- Added centralized configuration handling
- Protected sensitive directories with access rules
- Added initial project security documentation

termin_delete.php

@@ -18,6 +18,11 @@ if (!isset($_POST["id"])) {
     die("Kein Termin angegeben.");
 }
 
+// CSRF check
+if (!isset($_POST['csrf_token']) || !isset($_SESSION['csrf_token']) || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
+    die("CSRF validation failed");
+}
+
 $id = intval($_POST["id"]);
 
 $Data->deleteCalendarEvent($id);
@@ -28,17 +33,15 @@ $Data->deleteCalendarEvent($id);
 $pdo->prepare("DELETE FROM changes WHERE termin_id = :id")
     ->execute([':id' => $id]);
 
-//$Data->createChanges($id, $_SESSION["id"], "delete", "", "");
-
 // --------------------------------------------------
 // 3) Termin löschen
 // --------------------------------------------------
 $pdo->prepare("DELETE FROM termine WHERE id = :id")
     ->execute([':id' => $id]);
 
-
 // --------------------------------------------------
 // Weiterleitung
 // --------------------------------------------------
 header("Location: termine.php");
 exit;
+</create_file>