- Added authentication checks to pve_action.php and pve_list.php
- Require valid logged-in session before API access
- Restrict Proxmox actions to admin users only
- Return HTTP 401 for unauthenticated requests
- Return HTTP 403 for unauthorized users
- Keep existing API logic unchanged
- Removed hardcoded iCloud username and password from Data.class.php
- Added config/icloud.php for external credential storage
- Protected config directory with Apache access rules
- Updated Data constructor to load credentials from config
- Kept backwards compatibility with existing Data instantiation
- 15 methods migrated from query() to prepare()+execute()
- changeTermin() now uses column whitelist (11 allowed columns)
- setTerminStatus() delegates to changeTermin()
- Added ?: null fallbacks and type hints
- Consistent pattern across all database methods
xBeaTz