remco/Atomcms-edit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
40 Commits 1 Branch 0 Tags
0c6c558a59d722ef6806e9fa1d9bb3123313323f
Commit Graph

13 Commits

Author SHA1 Message Date
root 0c6c558a59 Add radio embed widget, SSE real-time, song history, moderation panel, and Auto DJ 
- Embed widget: standalone iframe player with dark/light/transparent themes, copy-paste embed code admin page
- Real-time SSE: streaming now-playing/listeners/dj events, replaces polling in radio-player and embed
- Song history: auto-records song changes to radio_song_plays table, Filament resource to view
- DJ moderation: unified panel for shouts approval, song request queue, DJ applications
- Auto DJ: playlist management with round-robin playback when no DJ is live
- Refactored radio-player Alpine component to use EventSource API with auto-reconnect
 2026-05-24 14:07:32 +02:00
root 5476dce882 Add multi-step radio wizard with Shoutcast/Icecast/AzureCast support and multi-language translations 
- New 5-step RadioWizardController with session-based wizard flow
- Enhanced RadioStreamService with Shoutcast/Icecast/ AzureCast auto-detection
- Connection test functionality for stream, now-playing, and listeners
- Wizard views for all 5 steps with step indicator navigation
- All 21 language files updated with wizard translation keys (NL/EN + placeholders)
- Wizard link added to existing radio setup page
- Routes registered under /admin/radio/wizard/*
 2026-05-24 13:12:57 +02:00
root 2d8beaa531 chore: fix code style with Laravel Pint 2026-05-23 19:05:37 +02:00
root 7e8313a55b chore: improve code quality - PHPStan level 5, add #[\Override] attributes, fix return types 2026-05-23 18:44:16 +02:00
root 14a40b9bb2 fix: standardize password min length to 8 across all auth endpoints 2026-05-23 17:11:23 +02:00
root 76bce1d092 feat: add customizable Nitro client loading overlay with Filament settings 
Add full Client Login Effect section to Theme & Buttons page with:
- Enable toggle, 30+ animation effects, customizable colors/logo/text
- 6 loading bar styles (sliding, dots, pulse, double, spinner, skeleton)
- Optimized to single DB query via WebsiteSetting::whereIn
- Overlay covers Nitro v3 internal loading (5s min, 15s fallback)
 2026-05-22 21:09:33 +02:00
root 1fe8d10c90 fix: replace route closures with controllers, add Argon2id password migration 
- Replace closures in web.php and auth.php with dedicated controllers
  (LoginRedirectController, LogoutController, TwoFactorChallengeController,
  EmailVerificationController) to fix route caching issues
- Add migration to increase password column to VARCHAR(255) for Argon2id support
- Fix 500 error caused by route cache incompatibility with closures
 2026-05-20 23:40:18 +02:00
root 75b78c17fa refactor: improve security, split routes, add API resources and FormRequests 
- Fix timing attack vulnerability in AuthController
- Split web.php (316 lines) into 7 focused route files
- Add 8 API Resources for consistent response formatting
- Add 8 FormRequest classes for centralized validation
- Use Resources instead of manual array mapping in controllers
 2026-05-20 23:03:16 +02:00
root b1739cabbf fix(security): eliminate remaining critical vulnerabilities 
- SystemFixService: removed ALL shell_exec/sudo calls (30+ instances), replaced with
  safe PHP alternatives (mkdir, chmod, disk_total_space, Artisan calls)
- InstallationController: added ALLOWED_SETTINGS whitelist to prevent arbitrary
  settings manipulation via request data
- ExceptionHandler: removed dangerous npm run build execution and hardcoded
  chown/chmod paths from auto-recovery
- AuthController: fixed user enumeration timing attack by running Hash::make()
  even when user doesn't exist (constant-time comparison)
- DDoSDetectionCommand: added IP validation (FILTER_VALIDATE_IP) before blocking
  to prevent iptables manipulation with spoofed/malicious IPs
- trackRequest: now validates IP before storing in cache
 2026-05-19 19:46:38 +02:00
root 7f59024bef fix(security): patch critical security vulnerabilities 
- Remove User::$guarded = [] to prevent mass assignment attacks
- Enable SQL strict mode and disable emulated prepares (SQL injection prevention)
- Switch password hashing from bcrypt to argon2id (stronger algorithm)
- Enable session encryption to protect session data at rest
- Restrict TrustProxies to localhost only (prevent IP spoofing)
- Restrict CORS allowed_methods via env variable instead of wildcard
- Add PayPal amount mismatch detection to prevent payment manipulation
- Add double-capture prevention (idempotency check)
- Add expected_amount column to transactions table for verification
 2026-05-19 19:37:15 +02:00
root 05fc7b04bc refactor: add return type hints to all controller methods 
Added proper return types (View, RedirectResponse, JsonResponse, Collection)
to 40+ controller methods across 16 controllers. Also added missing
imports for Illuminate response types and tightened parameter types
(e.g. InstallationController::showStep now uses int instead of mixed).
 2026-05-19 19:28:21 +02:00
root 81e99933e4 refactor: improve code quality across controllers and services 
- DRY FurniEditorController: extract duplicate try/catch blocks into handleApiError(),
  formatItemData(), buildUpdateData(), buildInsertData(), castValue() methods
- ProfileController: replace 45 lines of manual date formatting with Carbon's diffForHumans()
- Replace custom Password rule (180 lines) with Laravel's built-in Password::min() rule
- RadioController: extract RadioStreamService and RadioScheduleService, reducing from 608 to 323 lines
- Add RadioSettings enum to replace magic strings throughout radio feature
- Add CurrencyTypes::columnName() helper method
- Add consistent return types (JsonResponse, View, RedirectResponse) to all controller methods
 2026-05-19 19:16:59 +02:00
root 9d73f82529 Initial commit 2026-05-09 17:32:17 +02:00