5 Commits

Author	SHA1	Message	Date
root	f29ba72591	Fix security, performance, and code quality issues across CMS ... Security: - Replace unescaped {!! !!} with Purify::clean() in 15+ Blade templates (XSS) - Add rate limiting to register (3/hr), upload (10/min), SSE (6/min) - Add max:5000 validation on article comments - Remove duplicate exception handler callback Hardcoded paths: - Replace ~44 /var/www/ hardcoded paths with env() configs - CatalogService (13), AutoDetectService (18), Commandocentrum (11), AppServiceProvider (2) Performance: - Add 10 missing database indexes (radio_song_requests, help_center_tickets, etc.) - Replace Cache::flush() with targeted Cache::forget() in RadioSettings - Cache getCachedCategories() in TicketController (N+1 fix) - Remove redundant top-3 leaderboard query Bug fixes: - Fix undefined $enabled variable → $isOnline in radio index view - Add getAvatarAttribute() accessor for non-existent avatar column - Fix User::guilds() from wrong HasMany to HasManyThrough Code quality: - Replace file_get_contents with Http::timeout(10) in TraxService - Remove commented Echo/Pusher boilerplate in bootstrap.js - Remove TODO/FIXME comments from logo-generator templates - Replace hardcoded Turnstile CDN URL with config() - Restore QUEUE_CONNECTION=redis in .env.example files	2026-06-29 18:28:19 +02:00
root	2d8beaa531	chore: fix code style with Laravel Pint	2026-05-23 19:05:37 +02:00
root	75b78c17fa	refactor: improve security, split routes, add API resources and FormRequests ... - Fix timing attack vulnerability in AuthController - Split web.php (316 lines) into 7 focused route files - Add 8 API Resources for consistent response formatting - Add 8 FormRequest classes for centralized validation - Use Resources instead of manual array mapping in controllers	2026-05-20 23:03:16 +02:00
root	b1739cabbf	fix(security): eliminate remaining critical vulnerabilities ... - SystemFixService: removed ALL shell_exec/sudo calls (30+ instances), replaced with safe PHP alternatives (mkdir, chmod, disk_total_space, Artisan calls) - InstallationController: added ALLOWED_SETTINGS whitelist to prevent arbitrary settings manipulation via request data - ExceptionHandler: removed dangerous npm run build execution and hardcoded chown/chmod paths from auto-recovery - AuthController: fixed user enumeration timing attack by running Hash::make() even when user doesn't exist (constant-time comparison) - DDoSDetectionCommand: added IP validation (FILTER_VALIDATE_IP) before blocking to prevent iptables manipulation with spoofed/malicious IPs - trackRequest: now validates IP before storing in cache	2026-05-19 19:46:38 +02:00
root	9d73f82529	Initial commit	2026-05-09 17:32:17 +02:00