remco/Atomcms-edit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
77 Commits 1 Branch 0 Tags
66cbd46f37eec4e26737c457349da413bf50eefb
Commit Graph

8 Commits

Author SHA1 Message Date
root 261a5e63c6 Fix SSE listeners type cast, replace Blade tab component with Alpine.js tabs in DjModeration, use wire:confirm instead of onclick 2026-05-24 14:15:44 +02:00
root 0c6c558a59 Add radio embed widget, SSE real-time, song history, moderation panel, and Auto DJ 
- Embed widget: standalone iframe player with dark/light/transparent themes, copy-paste embed code admin page
- Real-time SSE: streaming now-playing/listeners/dj events, replaces polling in radio-player and embed
- Song history: auto-records song changes to radio_song_plays table, Filament resource to view
- DJ moderation: unified panel for shouts approval, song request queue, DJ applications
- Auto DJ: playlist management with round-robin playback when no DJ is live
- Refactored radio-player Alpine component to use EventSource API with auto-reconnect
 2026-05-24 14:07:32 +02:00
root 8c49a1138c Add attribute_changes column to activity_log table to fix SQLSTATE[42S22] error 2026-05-23 19:58:48 +02:00
root 1fe8d10c90 fix: replace route closures with controllers, add Argon2id password migration 
- Replace closures in web.php and auth.php with dedicated controllers
  (LoginRedirectController, LogoutController, TwoFactorChallengeController,
  EmailVerificationController) to fix route caching issues
- Add migration to increase password column to VARCHAR(255) for Argon2id support
- Fix 500 error caused by route cache incompatibility with closures
 2026-05-20 23:40:18 +02:00
root b1739cabbf fix(security): eliminate remaining critical vulnerabilities 
- SystemFixService: removed ALL shell_exec/sudo calls (30+ instances), replaced with
  safe PHP alternatives (mkdir, chmod, disk_total_space, Artisan calls)
- InstallationController: added ALLOWED_SETTINGS whitelist to prevent arbitrary
  settings manipulation via request data
- ExceptionHandler: removed dangerous npm run build execution and hardcoded
  chown/chmod paths from auto-recovery
- AuthController: fixed user enumeration timing attack by running Hash::make()
  even when user doesn't exist (constant-time comparison)
- DDoSDetectionCommand: added IP validation (FILTER_VALIDATE_IP) before blocking
  to prevent iptables manipulation with spoofed/malicious IPs
- trackRequest: now validates IP before storing in cache
 2026-05-19 19:46:38 +02:00
root 7f59024bef fix(security): patch critical security vulnerabilities 
- Remove User::$guarded = [] to prevent mass assignment attacks
- Enable SQL strict mode and disable emulated prepares (SQL injection prevention)
- Switch password hashing from bcrypt to argon2id (stronger algorithm)
- Enable session encryption to protect session data at rest
- Restrict TrustProxies to localhost only (prevent IP spoofing)
- Restrict CORS allowed_methods via env variable instead of wildcard
- Add PayPal amount mismatch detection to prevent payment manipulation
- Add double-capture prevention (idempotency check)
- Add expected_amount column to transactions table for verification
 2026-05-19 19:37:15 +02:00
root 8b6e028ae6 Add migration check command and cleanup orphaned migrations 2026-05-09 18:14:37 +02:00
root 9d73f82529 Initial commit 2026-05-09 17:32:17 +02:00