xBeaTz/anjuma-dashboard
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6 Commits 2 Branches 0 Tags
develop
Commit Graph
6 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
xBeaTz d97605f801 security: harden application security baseline 
- Fixed SQL injection vulnerabilities with prepared statements
- Added column whitelist protection for dynamic termin updates
- Extracted iCloud credentials into protected config file
- Moved sensitive configuration files out of webroot
- Added authentication and admin checks to PVE APIs
- Added CSRF protection to write operations and APIs
- Disabled debug output in production mode
- Added centralized configuration handling
- Protected sensitive directories with access rules
- Added initial project security documentation
 2026-07-22 02:23:34 +02:00
xBeaTz 28ebf1ff12 security: disable debug error output in production 2026-07-22 02:08:22 +02:00
xBeaTz 882155a7b4 security: protect proxmox api endpoints with session authentication 
- Added authentication checks to pve_action.php and pve_list.php
- Require valid logged-in session before API access
- Restrict Proxmox actions to admin users only
- Return HTTP 401 for unauthenticated requests
- Return HTTP 403 for unauthorized users
- Keep existing API logic unchanged
 2026-07-22 02:03:20 +02:00
xBeaTz d858e062f1 security: extract iCloud credentials into protected config file 
- Removed hardcoded iCloud username and password from Data.class.php
- Added config/icloud.php for external credential storage
- Protected config directory with Apache access rules
- Updated Data constructor to load credentials from config
- Kept backwards compatibility with existing Data instantiation
 2026-07-22 01:59:35 +02:00
xBeaTz 95b1db2309 security: replace raw SQL queries with prepared statements in Data.class.php 
- 15 methods migrated from query() to prepare()+execute()
- changeTermin() now uses column whitelist (11 allowed columns)
- setTerminStatus() delegates to changeTermin()
- Added ?: null fallbacks and type hints
- Consistent pattern across all database methods
 2026-07-22 01:37:21 +02:00
xBeaTz 124f2746ac initial commit 2026-07-22 01:12:45 +02:00