Commit Graph
3 Commits
Author SHA1 Message Date
UbuntuandClaude Opus 5 baa597a7c5 Guard against null permission_ids in getModulesByPermissionSlug()
modules.permission_ids is NULL for module 8 ("Szerviz kategoriak") on every
environment, and PHP 8.1 deprecates passing null to explode(). The notice was
only visible on prod because its index.php still has the stock
error_reporting(-1), whereas dev was previously changed to
E_ALL & ~E_DEPRECATED & ~E_WARNING & ~E_NOTICE.

- Skip rows whose permission_ids is null or empty. Behaviour-preserving:
  explode(',', null) returned array(''), which matched no permission id, so
  such modules were already excluded. Verified by simulating old vs new
  against the real module rows across six permission-id values including 0,
  '1' and 'admin' - identical results.
- Return early when the slug matches no permission, rather than dereferencing
  null on the next line.

Does not address the wider issue that prod runs ENVIRONMENT='development'
with display_errors=1, so any notice is rendered to real visitors.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 10:49:07 +00:00
UbuntuandClaude Opus 4.6 420bcb37fd Security hardening: fix SQLi, XSS, file upload, and migrate DB to RDS
- Fix all SQL injection vulnerabilities across Service_model, User_model,
  Module_model, Log_model, and Admin controller using parameterized queries
- Add htmlspecialchars() to all user-controlled output in admin views
  (bookings, services, workers, service categories, login form)
- Fix XSS in AJAX worker response and manage-booking-cancelled view
- Add file extension whitelist (jpg, jpeg, png, gif, webp) to all uploads
- Remove webshell (pentest2.php) from assets/img/profiles/
- Stop logging plaintext passwords on failed login attempts
- Migrate database.php hostname from localhost to AWS RDS endpoint
- Fix dropdown styling (white-on-white) in worker calendar view

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-05-07 13:00:32 +00:00
Astral04 68c8245cef add all files 2025-10-04 11:38:07 +02:00