Security hardening: fix SQLi, XSS, file upload, and migrate DB to RDS

- Fix all SQL injection vulnerabilities across Service_model, User_model,
  Module_model, Log_model, and Admin controller using parameterized queries
- Add htmlspecialchars() to all user-controlled output in admin views
  (bookings, services, workers, service categories, login form)
- Fix XSS in AJAX worker response and manage-booking-cancelled view
- Add file extension whitelist (jpg, jpeg, png, gif, webp) to all uploads
- Remove webshell (pentest2.php) from assets/img/profiles/
- Stop logging plaintext passwords on failed login attempts
- Migrate database.php hostname from localhost to AWS RDS endpoint
- Fix dropdown styling (white-on-white) in worker calendar view

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Ubuntu
2026-05-07 13:00:32 +00:00
co-authored by Claude Opus 4.6
parent 307f17faa6
commit 420bcb37fd
20 changed files with 205 additions and 194 deletions
@@ -36,14 +36,14 @@
<a href="<?php echo SITEURL;?>bookings/update-booking/<?php echo $resultItem->booking_id ;?>"><i class="fas fa-edit"></i></a>
| <a href="<?php echo site_url().'bookings/booking-process?delete-booking='.$resultItem->booking_id;?>" onclick="return confirm('Valóban törölni szeretnéd?');"><i class="fas fa-trash-alt" style="font-size: 14px;color:#585858;"></i></a>
</td>
<td>#<?php echo $resultItem->booking_id;?></td>
<td><?php echo $resultItem->guest_name;?></td>
<td><?php echo $resultItem->guest_email;?></td>
<td><?php echo $resultItem->guest_phone;?></td>
<td><?php echo $resultItem->worker_name;?></td>
<td style="min-width:85px;"><?php echo $resultItem->booking_date;?></td>
<td><?php echo $resultItem->booking_start_time;?></td>
<td><?php echo $resultItem->booking_finish_time;?></td>
<td>#<?php echo htmlspecialchars($resultItem->booking_id, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo htmlspecialchars($resultItem->guest_name, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo htmlspecialchars($resultItem->guest_email, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo htmlspecialchars($resultItem->guest_phone, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo htmlspecialchars($resultItem->worker_name, ENT_QUOTES, 'UTF-8');?></td>
<td style="min-width:85px;"><?php echo htmlspecialchars($resultItem->booking_date, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo htmlspecialchars($resultItem->booking_start_time, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo htmlspecialchars($resultItem->booking_finish_time, ENT_QUOTES, 'UTF-8');?></td>
<td><?php
if(!empty($resultItem->services)){
echo '<table class="tableInTable">';
@@ -55,10 +55,10 @@
echo '</tr>';
foreach($resultItem->services as $serviceItem){
echo '<tr>';
echo '<td>'.$serviceItem->service_type.'</td>';
echo '<td>'.$serviceItem->service_name.'</td>';
echo '<td>'.$serviceItem->service_price.'</td>';
echo '<td>'.$serviceItem->service_time.'</td>';
echo '<td>'.htmlspecialchars($serviceItem->service_type, ENT_QUOTES, 'UTF-8').'</td>';
echo '<td>'.htmlspecialchars($serviceItem->service_name, ENT_QUOTES, 'UTF-8').'</td>';
echo '<td>'.htmlspecialchars($serviceItem->service_price, ENT_QUOTES, 'UTF-8').'</td>';
echo '<td>'.htmlspecialchars($serviceItem->service_time, ENT_QUOTES, 'UTF-8').'</td>';
echo '</tr>';
}
echo '</table>';
@@ -21,8 +21,8 @@
| <a href="<?php echo site_url().'services/service-category-process?delete-service-category='.$resultItem->service_category_id;?>" onclick="return confirm('Valóban törölni szeretnéd?');"><i class="fas fa-trash-alt" style="font-size: 14px;color:#585858;"></i></a>
</td>
<td>#<?php echo $resultItem->service_category_id;?></td>
<td><?php echo $resultItem->serv_cat_slug;?></td>
<td><?php echo $resultItem->serv_cat_name;?></td>
<td><?php echo htmlspecialchars($resultItem->serv_cat_slug, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo htmlspecialchars($resultItem->serv_cat_name, ENT_QUOTES, 'UTF-8');?></td>
</tr>
<?php
}
@@ -29,23 +29,23 @@
?>
<tr>
<td>
<a href="<?php echo SITEURL;?>services/update-service/<?php echo $resultItem->service_id;?>"><i class="fas fa-edit"></i></a>
<a href="<?php echo SITEURL;?>services/update-service/<?php echo htmlspecialchars($resultItem->service_id, ENT_QUOTES, 'UTF-8');?>"><i class="fas fa-edit"></i></a>
| <a href="<?php echo site_url().'services/service-process?delete-service='.$resultItem->service_id;?>" onclick="return confirm('Valóban törölni szeretnéd?');"><i class="fas fa-trash-alt" style="font-size: 14px;color:#585858;"></i></a>
</td>
<td>#<?php echo $resultItem->service_id;?></td>
<td><?php echo $resultItem->service_type;?></td>
<td><?php echo $resultItem->service_category_no;?></td>
<td><?php echo $resultItem->service_category_en;?></td>
<td><?php echo $resultItem->service_category_hu;?></td>
<td><?php echo $resultItem->service_name_no;?></td>
<td><?php echo $resultItem->service_name_en;?></td>
<td><?php echo $resultItem->service_name_hu;?></td>
<td><?php echo $resultItem->service_description_no;?></td>
<td><?php echo $resultItem->service_description_en;?></td>
<td><?php echo $resultItem->service_description_hu;?></td>
<td><?php echo $resultItem->service_price;?></td>
<td><?php echo $resultItem->service_time;?></td>
<td><?php echo $resultItem->serv_cat_name;?></td>
<td>#<?php echo htmlspecialchars($resultItem->service_id, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo htmlspecialchars($resultItem->service_type, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo htmlspecialchars($resultItem->service_category_no, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo htmlspecialchars($resultItem->service_category_en, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo htmlspecialchars($resultItem->service_category_hu, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo htmlspecialchars($resultItem->service_name_no, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo htmlspecialchars($resultItem->service_name_en, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo htmlspecialchars($resultItem->service_name_hu, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo htmlspecialchars($resultItem->service_description_no, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo htmlspecialchars($resultItem->service_description_en, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo htmlspecialchars($resultItem->service_description_hu, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo htmlspecialchars($resultItem->service_price, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo htmlspecialchars($resultItem->service_time, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo htmlspecialchars($resultItem->serv_cat_name, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->is_enabled?'igen':'nem';?></td>
</tr>
<?php
@@ -5,22 +5,22 @@
<input type="hidden" name="booking_id" value="<?php echo $selectedItem->booking_id;?>">
<div class="formRow">
<label class="formTitle">Vendég neve</label>
<input type="text" class="formInputBox" name="guest_name" value="<?php echo $selectedItem->guest_name;?>">
<input type="text" class="formInputBox" name="guest_name" value="<?php echo htmlspecialchars($selectedItem->guest_name, ENT_QUOTES, 'UTF-8');?>">
</div>
<div class="formRow">
<label class="formTitle">Email</label>
<input type="text" class="formInputBox" name="guest_email" value="<?php echo $selectedItem->guest_email;?>">
<input type="text" class="formInputBox" name="guest_email" value="<?php echo htmlspecialchars($selectedItem->guest_email, ENT_QUOTES, 'UTF-8');?>">
</div>
<div class="formRow">
<label class="formTitle">Telefon</label>
<input type="text" class="formInputBox" name="guest_phone" value="<?php echo $selectedItem->guest_phone;?>">
<input type="text" class="formInputBox" name="guest_phone" value="<?php echo htmlspecialchars($selectedItem->guest_phone, ENT_QUOTES, 'UTF-8');?>">
</div>
<div class="formRow">
<label class="formTitle">Dolgozó</label>
<select class="formDropdownBox" style="padding:0;" name="worker_id" id="worker_id">
<?php
foreach($workers as $workerItem){
echo '<option value="'.$workerItem->worker_id.'" '.($workerItem->worker_id == $selectedItem->worker_id?'selected':'').'>'.$workerItem->worker_name.'</option>';
echo '<option value="'.htmlspecialchars($workerItem->worker_id, ENT_QUOTES, 'UTF-8').'" '.($workerItem->worker_id == $selectedItem->worker_id?'selected':'').'>'.htmlspecialchars($workerItem->worker_name, ENT_QUOTES, 'UTF-8').'</option>';
}
?>
</select>
@@ -4,11 +4,11 @@
<input type="hidden" name="service_category_id" value="<?php echo $selectedItem->service_category_id;?>">
<div class="formRow">
<label class="formTitle">Kategória slug</label>
<input type="text" class="formInputBox" name="serv_cat_slug" value="<?php echo $selectedItem->serv_cat_slug;?>">
<input type="text" class="formInputBox" name="serv_cat_slug" value="<?php echo htmlspecialchars($selectedItem->serv_cat_slug, ENT_QUOTES, 'UTF-8');?>">
</div>
<div class="formRow">
<label class="formTitle">Kategória név</label>
<input type="text" class="formInputBox" name="serv_cat_name" value="<?php echo $selectedItem->serv_cat_name;?>">
<input type="text" class="formInputBox" name="serv_cat_name" value="<?php echo htmlspecialchars($selectedItem->serv_cat_name, ENT_QUOTES, 'UTF-8');?>">
</div>
<div class="formRow">
@@ -1,7 +1,7 @@
<div class="mainContentContainer" style="top:100px">
<div class="pageTitle"><?php echo $pageTitle;?></div>
<form method="post" action="<?php echo base_url();?>services/service-process">
<input type="hidden" name ="service_id" value="<?php echo $selectedItem->service_id;?>">
<input type="hidden" name ="service_id" value=\"<?php echo htmlspecialchars($selectedItem->service_id, ENT_QUOTES, 'UTF-8');?>\">
<div class="formRow">
<label class="formTitle">Típus</label>
<select class="formDropdownBox" style="padding:0;" name="service_type">
@@ -11,47 +11,47 @@
</div>
<div class="formRow">
<label class="formTitle">Kategória (NO)</label>
<input type="text" class="formInputBox" name="service_category_no" value="<?php echo $selectedItem->service_category_no;?>">
<input type="text" class="formInputBox" name="service_category_no" value=\"<?php echo htmlspecialchars($selectedItem->service_category_no, ENT_QUOTES, 'UTF-8');?>\">
</div>
<div class="formRow">
<label class="formTitle">Kategória (EN)</label>
<input type="text" class="formInputBox" name="service_category_en" value="<?php echo $selectedItem->service_category_en;?>">
<input type="text" class="formInputBox" name="service_category_en" value=\"<?php echo htmlspecialchars($selectedItem->service_category_en, ENT_QUOTES, 'UTF-8');?>\">
</div>
<div class="formRow">
<label class="formTitle">Kategória (HU)</label>
<input type="text" class="formInputBox" name="service_category_hu" value="<?php echo $selectedItem->service_category_hu;?>">
<input type="text" class="formInputBox" name="service_category_hu" value=\"<?php echo htmlspecialchars($selectedItem->service_category_hu, ENT_QUOTES, 'UTF-8');?>\">
</div>
<div class="formRow">
<label class="formTitle">Megnevezés (NO)</label>
<input type="text" class="formInputBox" name="service_name_no" value="<?php echo $selectedItem->service_name_no;?>">
<input type="text" class="formInputBox" name="service_name_no" value=\"<?php echo htmlspecialchars($selectedItem->service_name_no, ENT_QUOTES, 'UTF-8');?>\">
</div>
<div class="formRow">
<label class="formTitle">Megnevezés (EN)</label>
<input type="text" class="formInputBox" name="service_name_en" value="<?php echo $selectedItem->service_name_en;?>">
<input type="text" class="formInputBox" name="service_name_en" value=\"<?php echo htmlspecialchars($selectedItem->service_name_en, ENT_QUOTES, 'UTF-8');?>\">
</div>
<div class="formRow">
<label class="formTitle">Megnevezés (HU)</label>
<input type="text" class="formInputBox" name="service_name_hu" value="<?php echo $selectedItem->service_name_hu;?>">
<input type="text" class="formInputBox" name="service_name_hu" value=\"<?php echo htmlspecialchars($selectedItem->service_name_hu, ENT_QUOTES, 'UTF-8');?>\">
</div>
<div class="formRow">
<label class="formTitle">Leírás (NO)</label>
<input type="text" class="formInputBox" name="service_description_no" value="<?php echo $selectedItem->service_description_no;?>">
<input type="text" class="formInputBox" name="service_description_no" value=\"<?php echo htmlspecialchars($selectedItem->service_description_no, ENT_QUOTES, 'UTF-8');?>\">
</div>
<div class="formRow">
<label class="formTitle">Leírás (EN)</label>
<input type="text" class="formInputBox" name="service_description_en" value="<?php echo $selectedItem->service_description_en;?>">
<input type="text" class="formInputBox" name="service_description_en" value=\"<?php echo htmlspecialchars($selectedItem->service_description_en, ENT_QUOTES, 'UTF-8');?>\">
</div>
<div class="formRow">
<label class="formTitle">Leírás (HU)</label>
<input type="text" class="formInputBox" name="service_description_hu" value="<?php echo $selectedItem->service_description_hu;?>">
<input type="text" class="formInputBox" name="service_description_hu" value=\"<?php echo htmlspecialchars($selectedItem->service_description_hu, ENT_QUOTES, 'UTF-8');?>\">
</div>
<div class="formRow">
<label class="formTitle">Szolgáltatás ára</label>
<input type="number" class="formInputBox" name="service_price" value="<?php echo $selectedItem->service_price;?>">
<input type="number" class="formInputBox" name="service_price" value=\"<?php echo htmlspecialchars($selectedItem->service_price, ENT_QUOTES, 'UTF-8');?>\">
</div>
<div class="formRow">
<label class="formTitle">Szolgáltatás időtartama</label>
<input type="time" class="formInputBox" name="service_time" value="<?php echo $selectedItem->service_time;?>">
<input type="time" class="formInputBox" name="service_time" value=\"<?php echo htmlspecialchars($selectedItem->service_time, ENT_QUOTES, 'UTF-8');?>\">
</div>
<div class="formRow">
<label class="formTitle">Szolgáltatás kategória</label>
@@ -59,7 +59,7 @@
<?php
if(!empty($serviceCategories)){
foreach($serviceCategories as $serviceCategoryItem){
echo '<option value="'.$serviceCategoryItem->service_category_id.'" '.($selectedItem->service_category_id == $serviceCategoryItem->service_category_id?' selected':'').'>'.$serviceCategoryItem->serv_cat_name.'</option>';
echo '<option value="'.$serviceCategoryItem->service_category_id.'" '.($selectedItem->service_category_id == $serviceCategoryItem->service_category_id?' selected':'').'>'.htmlspecialchars($serviceCategoryItem->serv_cat_name, ENT_QUOTES, 'UTF-8').'</option>';
}
}
?>
@@ -1,10 +1,10 @@
<div class="mainContentContainer" style="top:100px">
<div class="pageTitle"><?php echo $pageTitle;?></div>
<form method="post" action="<?php echo base_url();?>workers/worker-process" enctype="multipart/form-data">
<input type="hidden" name ="worker_id" value="<?php echo $selectedItem->worker_id;?>">
<input type="hidden" name ="worker_id" value=\"<?php echo htmlspecialchars($selectedItem->worker_id, ENT_QUOTES, 'UTF-8');?>\">
<div class="formRow">
<label class="formTitle">Név</label>
<input type="text" class="formInputBox" name="worker_name" value="<?php echo $selectedItem->worker_name;?>">
<input type="text" class="formInputBox" name="worker_name" value=\"<?php echo htmlspecialchars($selectedItem->worker_name, ENT_QUOTES, 'UTF-8');?>\">
</div>
<div class="formRow">
<img src="<?php echo SITEURL.'assets/img/workers/'.$selectedItem->worker_profile_img;?>" width="100px">
@@ -15,7 +15,7 @@
</div>
<div class="formRow">
<label class="formTitle">Leírás</label>
<input type="text" class="formInputBox" name="worker_info" value="<?php echo $selectedItem->worker_info;?>">
<input type="text" class="formInputBox" name="worker_info" value=\"<?php echo htmlspecialchars($selectedItem->worker_info, ENT_QUOTES, 'UTF-8');?>\">
</div>
<div class="formRow">
<label class="formTitle">Beauty</label>
@@ -66,11 +66,11 @@
</div>
<div class="formRow">
<label class="formTitle">Google Calendar ID</label>
<input type="text" class="formInputBox" name="google_calendar_id" value="<?php echo isset($selectedItem->google_calendar_id) ? $selectedItem->google_calendar_id : '';?>">
<input type="text" class="formInputBox" name="google_calendar_id" value=\"<?php echo htmlspecialchars(isset($selectedItem->google_calendar_id) ? $selectedItem->google_calendar_id : '', ENT_QUOTES, 'UTF-8');?>\">
</div>
<div class="formRow">
<label class="formTitle">ntfy Topic</label>
<input type="text" class="formInputBox" name="ntfy_topic" value="<?php echo isset($selectedItem->ntfy_topic) ? $selectedItem->ntfy_topic : '';?>">
<input type="text" class="formInputBox" name="ntfy_topic" value=\"<?php echo htmlspecialchars(isset($selectedItem->ntfy_topic) ? $selectedItem->ntfy_topic : '', ENT_QUOTES, 'UTF-8');?>\">
</div>
<div class="formRow">
<input type="submit" class="submitButton" name="updateWorker" value="Módosítás">
+3
View File
@@ -34,6 +34,9 @@
width: 100%; background: #2a2a2a; color: #fff; border: 1px solid #555; padding: 6px 8px;
border-radius: 3px; font-size: 13px; box-sizing: border-box;
}
.cal-wrap select option, #calModalBox select option {
background: #2a2a2a; color: #fff;
}
#calModalBox textarea { height: 60px; resize: vertical; }
.cal-modal-btns { display: flex; gap: 10px; margin-top: 16px; }
.cal-btn-save { background: #5cb85c; color: #fff; border: none; padding: 8px 18px; border-radius: 3px; cursor: pointer; font-size: 14px; }
@@ -22,17 +22,17 @@
?>
<tr>
<td>
<a href="<?php echo SITEURL;?>workers/update-worker/<?php echo $resultItem->worker_id;?>"><i class="fas fa-edit"></i></a>
| <a href="<?php echo SITEURL;?>workers/worker-calendar/<?php echo $resultItem->worker_id;?>"><i class="fas fa-calendar-alt"></i></a>
<a href="<?php echo SITEURL;?>workers/update-worker/<?php echo htmlspecialchars($resultItem->worker_id, ENT_QUOTES, 'UTF-8');?>"><i class="fas fa-edit"></i></a>
| <a href="<?php echo SITEURL;?>workers/worker-calendar/<?php echo htmlspecialchars($resultItem->worker_id, ENT_QUOTES, 'UTF-8');?>"><i class="fas fa-calendar-alt"></i></a>
| <a href="<?php echo site_url().'workers/worker-process?delete-worker='.$resultItem->worker_id;?>" onclick="return confirm('Valóban törölni szeretnéd?');"><i class="fas fa-trash-alt" style="font-size: 14px;color:#585858;"></i></a>
</td>
<td>#<?php echo $resultItem->worker_id;?></td>
<td>#<?php echo htmlspecialchars($resultItem->worker_id, ENT_QUOTES, 'UTF-8');?></td>
<td><img src="<?php echo SITEURL.'assets/img/'.$resultItem->worker_profile_img;?>" style="width:50px;margin:0;" /></td>
<td><?php echo $resultItem->worker_name;?></td>
<td><?php echo $resultItem->worker_info;?></td>
<td><?php echo htmlspecialchars($resultItem->worker_name, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo htmlspecialchars($resultItem->worker_info, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->is_beauty?'igen':'nem';?></td>
<td><?php echo $resultItem->is_barber?'igen':'nem';?></td>
<td><?php echo $resultItem->serv_cat_name;?></td>
<td><?php echo htmlspecialchars($resultItem->serv_cat_name, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->is_active?'igen':'nem';?></td>
</tr>
<?php
+2 -2
View File
@@ -14,10 +14,10 @@
</div>
<form method="post" action="<?php echo site_url().'login'?>">
<div class="login-row">
<label class="login-labels"><i class="fas fa-user-tie"></i></label><input type="text" class="loginform-text username" placeholder="Felhasználó név" name="username" id="username" value="<?php echo $username;?>">
<label class="login-labels"><i class="fas fa-user-tie"></i></label><input type="text" class="loginform-text username" placeholder="Felhasználó név" name="username" id="username" value="<?php echo htmlspecialchars($username, ENT_QUOTES, 'UTF-8');?>">
</div>
<div class="login-row">
<label class="login-labels"><i class="fas fa-key"></i></label><input type="password" class="loginform-text password" placeholder="Jelszó" name="password" id="password" value="<?php echo $password;?>">
<label class="login-labels"><i class="fas fa-key"></i></label><input type="password" class="loginform-text password" placeholder="Jelszó" name="password" id="password" value="<?php echo htmlspecialchars($password, ENT_QUOTES, 'UTF-8');?>">
</div>
<div class="login-row">
<input type="hidden" name="remember" value="off">
+3 -3
View File
@@ -14,9 +14,9 @@
}
$messages = array(
'no' => 'Din bestilling den <strong>'.$booking->booking_date.'</strong> kl. <strong>'.date('H:i', strtotime($booking->booking_start_time)).'</strong> med <strong>'.$worker->worker_name.'</strong> er avbestilt.',
'en' => 'Your booking on <strong>'.$booking->booking_date.'</strong> at <strong>'.date('H:i', strtotime($booking->booking_start_time)).'</strong> with <strong>'.$worker->worker_name.'</strong> has been cancelled.',
'hu' => 'A <strong>'.$booking->booking_date.'</strong> <strong>'.date('H:i', strtotime($booking->booking_start_time)).'</strong>-os foglalásod <strong>'.$worker->worker_name.'</strong>-nál törölve lett.',
'no' => 'Din bestilling den <strong>'.$booking->booking_date.'</strong> kl. <strong>'.date('H:i', strtotime($booking->booking_start_time)).'</strong> med <strong>'.htmlspecialchars($worker->worker_name, ENT_QUOTES, 'UTF-8').'</strong> er avbestilt.',
'en' => 'Your booking on <strong>'.$booking->booking_date.'</strong> at <strong>'.date('H:i', strtotime($booking->booking_start_time)).'</strong> with <strong>'.htmlspecialchars($worker->worker_name, ENT_QUOTES, 'UTF-8').'</strong> has been cancelled.',
'hu' => 'A <strong>'.$booking->booking_date.'</strong> <strong>'.date('H:i', strtotime($booking->booking_start_time)).'</strong>-os foglalásod <strong>'.htmlspecialchars($worker->worker_name, ENT_QUOTES, 'UTF-8').'</strong>-nál törölve lett.',
);
$titles = array(