3 Commits

Author	SHA1	Message	Date
root	75b78c17fa	refactor: improve security, split routes, add API resources and FormRequests ... - Fix timing attack vulnerability in AuthController - Split web.php (316 lines) into 7 focused route files - Add 8 API Resources for consistent response formatting - Add 8 FormRequest classes for centralized validation - Use Resources instead of manual array mapping in controllers	2026-05-20 23:03:16 +02:00
root	b1739cabbf	fix(security): eliminate remaining critical vulnerabilities ... - SystemFixService: removed ALL shell_exec/sudo calls (30+ instances), replaced with safe PHP alternatives (mkdir, chmod, disk_total_space, Artisan calls) - InstallationController: added ALLOWED_SETTINGS whitelist to prevent arbitrary settings manipulation via request data - ExceptionHandler: removed dangerous npm run build execution and hardcoded chown/chmod paths from auto-recovery - AuthController: fixed user enumeration timing attack by running Hash::make() even when user doesn't exist (constant-time comparison) - DDoSDetectionCommand: added IP validation (FILTER_VALIDATE_IP) before blocking to prevent iptables manipulation with spoofed/malicious IPs - trackRequest: now validates IP before storing in cache	2026-05-19 19:46:38 +02:00
root	9d73f82529	Initial commit	2026-05-09 17:32:17 +02:00