Security hardening: CSRF, rate limiting, session/password policy, audit log

Fixes critical pre-existing issues found during review: bulk_action.php had no
auth check at all (unauthenticated download/delete of any qrcode) and built a
table name from unwhitelisted user input (SQL injection); the QR generator
classes wrote files from unvalidated filename/format, allowing path traversal
and arbitrary file writes. Also pins chillerlan/php-qrcode to 5.0.5 since
master now requires PHP 8.4, breaking the PHP 8.3 build.

- CSRF tokens on all POST forms and the bulk_action.php JSON endpoint
- Login rate limiting (5 attempts / 15 min) via new login_attempts table
- Hardened sessions: httponly/samesite cookies, 30 min idle timeout,
  session regeneration on login
- Forced password change for the default superadmin/superadmin account
- Server-side validation in Users/DynamicQrcode/Qrcode classes
- Audit log table for auth, user, and qrcode actions
- Checked-in db schema (db/init.sql, migrations/) instead of relying on an
  opaque prebuilt db image
- Production docker-compose with Nginx + php-fpm instead of the PHP dev server

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/lib/Qrcode/Qrcode-intchil.php

@@ -20,6 +20,8 @@ class Qrcode {
     private string $table;
     private string $redirect_url;
 
+    const ALLOWED_FORMATS = ['png', 'gif', 'jpeg', 'jpg', 'svg', 'svgbw', 'eps'];
+
     /**
      *
      */
@@ -43,6 +45,33 @@ class Qrcode {
     {
     }
 
+    /**
+     * Voorkomt path traversal / arbitrary file write via een gemanipuleerde bestandsnaam.
+     */
+    private function sanitizeFilename($filename) {
+        $filename = trim((string) $filename);
+
+        if ($filename === '' || strlen($filename) > 45) {
+            $this->failure('Filename must be between 1 and 45 characters.');
+        }
+
+        if (preg_match('#[\\/\\\\]#', $filename) || strpos($filename, '..') !== false || strpos($filename, "\0") !== false) {
+            $this->failure('Filename cannot contain path separators.');
+        }
+
+        return $filename;
+    }
+
+    private function validateFormat($format) {
+        $format = strtolower((string) $format);
+
+        if (!in_array($format, self::ALLOWED_FORMATS, true)) {
+            $this->failure('Invalid qr code format.');
+        }
+
+        return $format;
+    }
+
     public function getQrcode($id) {
         $db = getDbInstance();
 
@@ -94,6 +123,9 @@ class Qrcode {
     public function addQrcode($input_data, $data_to_db, $data_to_qrcode) {
         $options = $this->setOptions($input_data);
 
+        $data_to_db['filename'] = $this->sanitizeFilename($data_to_db['filename']);
+        $data_to_db['format'] = $this->validateFormat($data_to_db['format']);
+
         $outputInterface = QRGdImagePNG::class;
         $imageFormat = strtolower($data_to_db['format']);
         $fileExt = $imageFormat;
@@ -305,21 +337,23 @@ class Qrcode {
             $this->failure('You cannot create a new qr code with an existing name on the server!');
         
         if ($last_id){
+            audit_log('qrcode_created', $this->table, $last_id);
             $this->success('Qr code added successfully!');
         }
         else {
             $this->failure('Insert failed: ' . $db->getLastError());
         }
     }
-    
+
     /**
      * Edit qr code
-     * 
+     *
      */
     public function editQrcode($input_data, $data_to_db) {
         $db = getDbInstance();
         $old_qrcode = $this->getQrcode($input_data["id"]);
 
+        $data_to_db['filename'] = $this->sanitizeFilename($data_to_db['filename']);
         $data_to_db['qrcode'] = $data_to_db['filename'].'.'.$old_qrcode["format"];
 
         if(!file_exists(SAVED_QRCODE_DIRECTORY.$data_to_db['filename'].'.'.$old_qrcode["format"]) || $data_to_db['filename'] == $input_data["old_filename"]){
@@ -337,6 +371,7 @@ class Qrcode {
             $this->failure('You cannot edit a qr code with an existing name on the server!');
         
         if ($stat){
+            audit_log('qrcode_updated', $this->table, $input_data['id']);
             $this->success('Qr code updated successfully!');
         }
         else {
@@ -344,10 +379,10 @@ class Qrcode {
         }
     }
 
-    
+
     /**
      * Delete qr code
-     * 
+     *
      */
     public function deleteQrcode($id, $async = false) {
         $db = getDbInstance();
@@ -356,7 +391,11 @@ class Qrcode {
 
         $db->where('id', $id);
         $status = $db->delete($this->table);
-        
+
+        if ($status) {
+            audit_log('qrcode_deleted', $this->table, $id);
+        }
+
         try{
             unlink(SAVED_QRCODE_DIRECTORY.$qrcode["filename"].'.'.$qrcode["format"]);
         }