Commit Graph

4 Commits

Author SHA1 Message Date
root 1acd96b78a Optimize queries: fix N+1, SELECT *, and missing eager loading
N+1 fixes:
- Add withCount('furniture') to rare categories sidebar (prevents N queries)
- Add tags and user.permission eager load in ArticleController
- Add rooms and photos.user eager load in ProfileController
- Add user eager load in MediaApiController (API was returning null user data)

SELECT * fixes:
- Replace WebsitePermission::all()->pluck() with direct pluck()
- Replace WebsiteHousekeepingPermission::all()->pluck() with direct pluck()
- Add select(['id', 'public_name']) to ItemBase query in furniItems()
- Add select(['id', 'name']) to help categories query
- Add select(['id', 'name', 'code']) to languages query

Memory/performance:
- Replace full collection load with aggregate queries in getRareStatistics()
- Add limit(50) to open tickets query in TicketController
2026-06-29 18:50:32 +02:00
root f29ba72591 Fix security, performance, and code quality issues across CMS
Security:
- Replace unescaped {!! !!} with Purify::clean() in 15+ Blade templates (XSS)
- Add rate limiting to register (3/hr), upload (10/min), SSE (6/min)
- Add max:5000 validation on article comments
- Remove duplicate exception handler callback

Hardcoded paths:
- Replace ~44 /var/www/ hardcoded paths with env() configs
- CatalogService (13), AutoDetectService (18), Commandocentrum (11), AppServiceProvider (2)

Performance:
- Add 10 missing database indexes (radio_song_requests, help_center_tickets, etc.)
- Replace Cache::flush() with targeted Cache::forget() in RadioSettings
- Cache getCachedCategories() in TicketController (N+1 fix)
- Remove redundant top-3 leaderboard query

Bug fixes:
- Fix undefined $enabled variable → $isOnline in radio index view
- Add getAvatarAttribute() accessor for non-existent avatar column
- Fix User::guilds() from wrong HasMany to HasManyThrough

Code quality:
- Replace file_get_contents with Http::timeout(10) in TraxService
- Remove commented Echo/Pusher boilerplate in bootstrap.js
- Remove TODO/FIXME comments from logo-generator templates
- Replace hardcoded Turnstile CDN URL with config()
- Restore QUEUE_CONNECTION=redis in .env.example files
2026-06-29 18:28:19 +02:00
root 05fc7b04bc refactor: add return type hints to all controller methods
Added proper return types (View, RedirectResponse, JsonResponse, Collection)
to 40+ controller methods across 16 controllers. Also added missing
imports for Illuminate response types and tightened parameter types
(e.g. InstallationController::showStep now uses int instead of mixed).
2026-05-19 19:28:21 +02:00
root 9d73f82529 Initial commit 2026-05-09 17:32:17 +02:00