Commit Graph

48 Commits

Author SHA1 Message Date
root 51e3876ed9 fix: correct file permissions for www-data access 2026-06-06 19:40:48 +02:00
root 434f58d5aa fix: use systemctl cat instead of list-units for reliable service detection 2026-06-06 16:24:44 +02:00
root ea2160132a Nitro V3 update: CLI-only (Linux), settings via .env
- Moved Nitro V3 update from web UI (Commandocentrum) to CLI-only
- Removed configure paths form and runUpdateNitrov3() from admin panel
- update-Nitrov3.sh now loads .env automatically from its directory
- Added all NITRO_* env vars to .env.example.linux and .env
- Removed configurable paths from database (replaced by .env)
- Updated README and CHANGELOG
2026-06-06 14:11:50 +02:00
root 4f4f40ac99 Fix radio Filament: actions() must receive array not Closure 2026-06-04 21:04:28 +02:00
root be6a578f5e Fix radio Filament: recordActions->actions, toolbarActions->headerActions, EmbedCode statePath 2026-06-04 20:59:40 +02:00
root f7fe86efeb Refactor HotelApiController into 6 focused controllers + FurniEditorController Eloquent migration 2026-06-04 20:32:15 +02:00
root 9b5c655c68 High priority fixes: PayPal env(), RadioApiKey Bearer-only, User restrict, SettingsService TTL, PHPStan config, + fix 7 broke points (forceFill) 2026-06-04 20:17:45 +02:00
root b2bb1811d0 Medium priority fixes: CORS from env, shared HasRadioSettings trait, lazy RconService, validated() fixes, LogoGenerator hardening, DB indexes, user profile consistency, radio rank N+1 fix 2026-06-04 20:05:36 +02:00
root 4b6872e5e0 Low priority fixes: debug comments, Fortify cleanup, badge cost setting, profile query merge, User model fixes, VPN constructor cleanup, PayPal POST, PII removal, Dutch→English translations, duplicate rank check, CHANGELOG 2026-06-04 19:57:01 +02:00
root f76f30e88f Nitro V3 Update: configureerbare paths via Commandocentrum + sudoers fix 2026-06-04 18:56:08 +02:00
root 1f04979ffe Remove all auto-update functionality (commands, services, widgets, blades, translations) 2026-06-03 22:54:39 +02:00
root 1f9af5279a fix: add DEFAULT 0 to last_username_change column, seeder, fillable, and factory 2026-05-27 20:23:06 +02:00
root c0077a6039 Fix session same_site to use env, fix Article model import, remove unused traits 2026-05-26 16:59:49 +02:00
root 45848cb4c5 Remove auto-recovery mechanism that caused race conditions with view cache 2026-05-26 16:05:58 +02:00
root 943d5bfc38 feat: install and configure Inertia.js with React
- Install inertia-laravel, @inertiajs/react, react, @vitejs/plugin-react
- Add HandleInertiaRequests middleware registered in web group
- Create Inertia root template (resources/views/app.blade.php)
- Add React entry point and page components (resources/js/)
- Add Inertia demo route (/inertia-test)
- HomeController reverted to Blade (index page stays original)
- Remove inertia-test2 test route
2026-05-25 15:15:14 +02:00
root 4ce68720bb fix: disable APP_DEBUG in production, fix .htaccess structure, add .gitignore cleanup
- Set APP_DEBUG=false in .env to prevent stack trace leakage
- Use strict comparison (===) for MD5 password migration check
- Fix duplicate rewrite rules and orphaned closing tag in .htaccess
- Remove leftover test files (cookies.txt, ci_test.txt, test-registration.php)
- Remove duplicate package-lock.json (using yarn only)
- Update .gitignore for above files
2026-05-25 14:30:37 +02:00
root 4e07aa3580 fix: register anonymous component path for filament-components view cache 2026-05-24 19:29:48 +02:00
root eea81a3e9a Fix middleware class collision (RadioApiKey -> alias), add missing setup.do and setup.reset routes, fix SSE int type cast 2026-05-24 14:20:22 +02:00
root 261a5e63c6 Fix SSE listeners type cast, replace Blade tab component with Alpine.js tabs in DjModeration, use wire:confirm instead of onclick 2026-05-24 14:15:44 +02:00
root 0c6c558a59 Add radio embed widget, SSE real-time, song history, moderation panel, and Auto DJ
- Embed widget: standalone iframe player with dark/light/transparent themes, copy-paste embed code admin page
- Real-time SSE: streaming now-playing/listeners/dj events, replaces polling in radio-player and embed
- Song history: auto-records song changes to radio_song_plays table, Filament resource to view
- DJ moderation: unified panel for shouts approval, song request queue, DJ applications
- Auto DJ: playlist management with round-robin playback when no DJ is live
- Refactored radio-player Alpine component to use EventSource API with auto-reconnect
2026-05-24 14:07:32 +02:00
root 5476dce882 Add multi-step radio wizard with Shoutcast/Icecast/AzureCast support and multi-language translations
- New 5-step RadioWizardController with session-based wizard flow
- Enhanced RadioStreamService with Shoutcast/Icecast/ AzureCast auto-detection
- Connection test functionality for stream, now-playing, and listeners
- Wizard views for all 5 steps with step indicator navigation
- All 21 language files updated with wizard translation keys (NL/EN + placeholders)
- Wizard link added to existing radio setup page
- Routes registered under /admin/radio/wizard/*
2026-05-24 13:12:57 +02:00
root 2d8beaa531 chore: fix code style with Laravel Pint 2026-05-23 19:05:37 +02:00
root 7e8313a55b chore: improve code quality - PHPStan level 5, add #[\Override] attributes, fix return types 2026-05-23 18:44:16 +02:00
root 6de250f49f fix: remove spatie/laravel-ray (breaks error handler) and fix dontSubmitEmptyLogs for activitylog v5 2026-05-23 18:26:38 +02:00
root ce466028f1 fix: replace undefined bootstrap_path() with base_path() 2026-05-23 17:24:19 +02:00
root 81839c7202 chore: update doctrine/dbal to v4, activitylog to v5, sluggable to v4, roadrunner-http to v4 2026-05-23 17:20:57 +02:00
root 2d5f018ff1 fix: replace shell_exec/exec with Process facade for security 2026-05-23 17:14:38 +02:00
root 14a40b9bb2 fix: standardize password min length to 8 across all auth endpoints 2026-05-23 17:11:23 +02:00
root 574b5d6e17 fix: standardize language to English in README and AlertSettings
feat: add 24 model factories for Help, Shop, Community, Game, User domains

- Translate mixed Dutch/English strings in README.md and AlertSettings.php
- Add HasFactory trait to 23 models
- Create factories for Help (6), Shop (4), Community (5), Game (2), User (7)
2026-05-23 16:57:44 +02:00
root 76bce1d092 feat: add customizable Nitro client loading overlay with Filament settings
Add full Client Login Effect section to Theme & Buttons page with:
- Enable toggle, 30+ animation effects, customizable colors/logo/text
- 6 loading bar styles (sliding, dots, pulse, double, spinner, skeleton)
- Optimized to single DB query via WebsiteSetting::whereIn
- Overlay covers Nitro v3 internal loading (5s min, 15s fallback)
2026-05-22 21:09:33 +02:00
root c53d1bca45 fix: add Cache import, convert DiagnosticResult to array for Livewire 2026-05-21 17:27:40 +02:00
root 17f543e7c9 fix: add missing bootstrap_path() helper function 2026-05-21 17:15:31 +02:00
root 70ebbac9f0 fix: add missing diagnoseSqlUpdates method to EmulatorUpdateService 2026-05-21 16:27:06 +02:00
root a07d216635 fix: update axios, move env() to config, cache config/routes/events/filament 2026-05-21 16:23:56 +02:00
root 1fe8d10c90 fix: replace route closures with controllers, add Argon2id password migration
- Replace closures in web.php and auth.php with dedicated controllers
  (LoginRedirectController, LogoutController, TwoFactorChallengeController,
  EmailVerificationController) to fix route caching issues
- Add migration to increase password column to VARCHAR(255) for Argon2id support
- Fix 500 error caused by route cache incompatibility with closures
2026-05-20 23:40:18 +02:00
root 75b78c17fa refactor: improve security, split routes, add API resources and FormRequests
- Fix timing attack vulnerability in AuthController
- Split web.php (316 lines) into 7 focused route files
- Add 8 API Resources for consistent response formatting
- Add 8 FormRequest classes for centralized validation
- Use Resources instead of manual array mapping in controllers
2026-05-20 23:03:16 +02:00
root 2f30a058a4 feat: add full i18n support to Commandocentrum
- Replace all hardcoded Dutch/English strings with __() translation calls
- Update 13 Blade components to use translation keys
- Update Commandocentrum.php controller with translation calls
- Add comprehensive Dutch (nl.json) and English (en.json) translations
- 150+ translation keys for UI labels, messages, and notifications
- Supports all 21 languages available in the lang/ directory
2026-05-19 21:49:39 +02:00
root c6246615bc refactor: extract inline HTML rendering to Blade components
- Create 12 Blade components for Commandocentrum views
- Reduce Commandocentrum from 1679 to 1192 lines (-29%)
- Move server-info, hotel-status, alert-form, emulator-info/settings/status
- Move nitro-settings/status, backups-list, clothing-status, staff-activity, update-history
- Improve separation of concerns between controller logic and view rendering
2026-05-19 21:24:12 +02:00
root 0bb35d6c8a refactor: centralize GitHub logic into GitHubService
- Create GitHubService with parseUrl, extractRepo, getBranches, getLatestCommit, getLatestRelease, hasUpdates
- Replace duplicated GitHub parsing in EmulatorConfiguration with GitHubService
- Replace fetchGitHubBranches, extractGitHubRepo, getEmulatorRemoteVersion in Commandocentrum
- Reduce code duplication across services and controllers
2026-05-19 21:07:16 +02:00
root cbe189fd96 refactor: extract action classes, add Blade components, reduce Commandocentrum
- Create EmulatorControlAction and NitroControlAction classes
- Extract business logic from Commandocentrum controller methods
- Add Blade components for status cards, diagnostics, and summary cards
- Replace shell_exec with file_get_contents in config reading
- Remove duplicate methods and unused code
- Commandocentrum reduced from 2033 to 1780 lines
2026-05-19 20:57:31 +02:00
root 976b990a8a refactor: fix PHPStan errors, remove unused code, replace shell_exec with Process
- Fix all 54 PHPStan errors (strict comparisons, unused methods, nullsafe)
- Remove unused HasPermissionColumns trait, checkGitHubUpdates, getGitHubLatestCommit
- Replace all 31 shell_exec calls with Process facade in Commandocentrum
- Add helper methods: runCommand, fileExists, dirExists, readFile
- Fix EmulatorJarService and EmulatorSqlService type issues
2026-05-19 20:44:21 +02:00
root f5666c104d refactor: integrate diagnostics into Commandocentrum and split EmulatorUpdateService
- Add DiagnosticRunner integration to Commandocentrum for system health display
- Refactor EmulatorUpdateService from 2524 lines to 395 lines (facade pattern)
- Extract EmulatorStatusService, EmulatorJarService, EmulatorSourceService
- Extract EmulatorBuildService, EmulatorSqlService, EmulatorBackupService
- Add shared EmulatorConfiguration trait for dependency injection
- Preserve backward compatibility on all public methods
2026-05-19 20:20:43 +02:00
root b1739cabbf fix(security): eliminate remaining critical vulnerabilities
- SystemFixService: removed ALL shell_exec/sudo calls (30+ instances), replaced with
  safe PHP alternatives (mkdir, chmod, disk_total_space, Artisan calls)
- InstallationController: added ALLOWED_SETTINGS whitelist to prevent arbitrary
  settings manipulation via request data
- ExceptionHandler: removed dangerous npm run build execution and hardcoded
  chown/chmod paths from auto-recovery
- AuthController: fixed user enumeration timing attack by running Hash::make()
  even when user doesn't exist (constant-time comparison)
- DDoSDetectionCommand: added IP validation (FILTER_VALIDATE_IP) before blocking
  to prevent iptables manipulation with spoofed/malicious IPs
- trackRequest: now validates IP before storing in cache
2026-05-19 19:46:38 +02:00
root 7f59024bef fix(security): patch critical security vulnerabilities
- Remove User::$guarded = [] to prevent mass assignment attacks
- Enable SQL strict mode and disable emulated prepares (SQL injection prevention)
- Switch password hashing from bcrypt to argon2id (stronger algorithm)
- Enable session encryption to protect session data at rest
- Restrict TrustProxies to localhost only (prevent IP spoofing)
- Restrict CORS allowed_methods via env variable instead of wildcard
- Add PayPal amount mismatch detection to prevent payment manipulation
- Add double-capture prevention (idempotency check)
- Add expected_amount column to transactions table for verification
2026-05-19 19:37:15 +02:00
root 05fc7b04bc refactor: add return type hints to all controller methods
Added proper return types (View, RedirectResponse, JsonResponse, Collection)
to 40+ controller methods across 16 controllers. Also added missing
imports for Illuminate response types and tightened parameter types
(e.g. InstallationController::showStep now uses int instead of mixed).
2026-05-19 19:28:21 +02:00
root 81e99933e4 refactor: improve code quality across controllers and services
- DRY FurniEditorController: extract duplicate try/catch blocks into handleApiError(),
  formatItemData(), buildUpdateData(), buildInsertData(), castValue() methods
- ProfileController: replace 45 lines of manual date formatting with Carbon's diffForHumans()
- Replace custom Password rule (180 lines) with Laravel's built-in Password::min() rule
- RadioController: extract RadioStreamService and RadioScheduleService, reducing from 608 to 323 lines
- Add RadioSettings enum to replace magic strings throughout radio feature
- Add CurrencyTypes::columnName() helper method
- Add consistent return types (JsonResponse, View, RedirectResponse) to all controller methods
2026-05-19 19:16:59 +02:00
root 8b6e028ae6 Add migration check command and cleanup orphaned migrations 2026-05-09 18:14:37 +02:00
root 9d73f82529 Initial commit 2026-05-09 17:32:17 +02:00