|
|
88f3c1f964
|
refactor: extract inline CSS/JS from views into separate asset files (20+ files)
Phase A — HTML removed from PHP files:
- RateLimitMiddleware.php: heredoc moved to views/errors/429.php
- public/index.php: inline HTML replaced with View::error()
- AuthMiddleware.php: <script> redirect replaced with <meta refresh>
Phase B — Inline CSS/JS extracted from views:
- CSS: landing.css (459 lines), legal.css (shared by terms+privacy)
- JS: 17 new files extracted from ~20 view files
- main.js (layout sidebar + notifications)
- dashboard-chart.js, server-show.js, server-services.js
- nginx-manager.js, database-manager.js
- terminal.js, team-show.js, team-index.js
- server-list.js, server-permissions.js (shared by edit+create)
- server-ssl.js, server-processes.js, system-users.js
- admin-users.js, audit-log.js, admin-notifications.js, admin-security.js
- notifications.js
Total: -3264 lines from views, +288 lines in new assets
|
2026-06-14 08:04:01 -04:00 |
|
|
|
a5eb101d98
|
security: fix auth bypass, XSS, IDOR, command injection, session hardening, rate limiting
- Phase 1: Require authentication for API register endpoint; restrict role creation
- Phase 2: Add $fillable whitelist to Server model to prevent mass assignment
- Phase 3: Fix XSS via escapeHtml in sidebar, JSON_HEX_TAG in script embeds
- Phase 4: Add canView() checks to TerminalController history/clearHistory
- Phase 5: escapeshellarg() on certbot params, sanitize service names, regex-based command blocklist, suppress exception messages
- Phase 6: SESSION_SECURE=true, SameSite=Strict, logout via POST+CSRF, chmod 640 .env
- Phase 7: DB-based rate limiting replacing session-based, applied to API login/register
|
2026-06-14 07:32:18 -04:00 |
|
