dillard
feb5380b28
Security hardening: CSRF, rate limiting, session/password policy, audit log
...
Fixes critical pre-existing issues found during review: bulk_action.php had no
auth check at all (unauthenticated download/delete of any qrcode) and built a
table name from unwhitelisted user input (SQL injection); the QR generator
classes wrote files from unvalidated filename/format, allowing path traversal
and arbitrary file writes. Also pins chillerlan/php-qrcode to 5.0.5 since
master now requires PHP 8.4, breaking the PHP 8.3 build.
- CSRF tokens on all POST forms and the bulk_action.php JSON endpoint
- Login rate limiting (5 attempts / 15 min) via new login_attempts table
- Hardened sessions: httponly/samesite cookies, 30 min idle timeout,
session regeneration on login
- Forced password change for the default superadmin/superadmin account
- Server-side validation in Users/DynamicQrcode/Qrcode classes
- Audit log table for auth, user, and qrcode actions
- Checked-in db schema (db/init.sql, migrations/) instead of relying on an
opaque prebuilt db image
- Production docker-compose with Nginx + php-fpm instead of the PHP dev server
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com >
2026-07-08 15:00:33 +02:00
268a6a3f65
Remove unnecessary extra information from documentation
2025-09-02 21:56:03 +02:00
812db2bf9b
Delete support section from index.html
2025-09-02 21:53:41 +02:00
48d7fefd02
Remove donation button from README
2025-09-02 21:52:03 +02:00
27a5dbd466
Merge pull request #144 from CLAlberto/master
...
fix(read.php): replace deprecated FILTER_SANITIZE_STRING for PHP 8.3 …
2025-05-08 08:56:07 +02:00
2c3f2bb030
fix(read.php): replace deprecated FILTER_SANITIZE_STRING for PHP 8.3 compatibility
...
### Problem
The usage of `FILTER_SANITIZE_STRING` in `read.php` causes a deprecation warning in PHP 8.1 and breaks functionality entirely in PHP 8.3, as the constant was removed.
### Solution
This commit replaces:
```php
filter_input(INPUT_GET, 'id', FILTER_SANITIZE_STRING);
with a safer and future-proof alternative:
$id = filter_input(INPUT_GET, 'id', FILTER_UNSAFE_RAW);
$id = trim(strip_tags($id));
> _Thanks for maintaining this project! Happy to contribute._ 😊
2025-05-06 16:16:22 +02:00
e4d3af69b5
Merge pull request #143 from angelosleebos/patch-1
...
Make environment variables compatible for other platforms
2025-04-14 12:19:34 +02:00
938d934b51
Merge pull request #142 from rafinou62/patch-1
...
Update read.php prevent SQL Injection & XSS attacks
2025-04-14 12:18:32 +02:00
cee6f4d3d5
Make environment variables compatible for other platforms
...
Make environment variables compatible for other platforms
2025-04-07 01:11:17 +02:00
1465ce02ad
Update read.php prevent SQL Injection & XSS attacks
2025-03-26 17:04:33 +01:00
ba57334142
edit demo url
2025-03-22 15:51:02 +01:00
615d983828
config rollback
2025-03-20 23:38:55 +01:00
b245694824
Merge remote-tracking branch 'origin/master'
2025-03-19 23:40:50 +01:00
378968576f
bug fix Class Qrcode not found
2025-03-19 23:40:36 +01:00
0d4368575b
Merge pull request #136 from MickGe/patch-1
...
add cookies secure flags
2025-02-09 16:16:53 +01:00
05e80a075a
add cookies secure flags
2025-02-07 11:35:24 +01:00
92a1f17dbe
updated readme and docs
2025-01-21 22:41:14 +01:00
d1505e1e08
updated readme
2025-01-12 23:50:15 +01:00
f05c073ad4
Local setup eliminated and documentation updated
2025-01-12 23:48:49 +01:00
79d9ac71a3
Merge remote-tracking branch 'origin/master'
2025-01-12 19:48:31 +01:00
ffc5b64967
Merge pull request #130 from Shineson1001/feature/129-QRCodeGeneratorSwitch
...
🐛 Global switch for the QR code generator (#129 )
2025-01-02 12:04:55 +01:00
869dd2c799
🐛 Global switch for the QR code generator ( #129 )
2024-12-31 20:48:56 +01:00
531820e2a8
Revert "Revert "Instead using external API (api.qrserver.com) .. use chillerlan/php-qrcode""
...
This reverts commit 630bbf3aea
2024-12-23 18:52:11 +01:00
630bbf3aea
Revert "Instead using external API (api.qrserver.com) .. use chillerlan/php-qrcode"
...
This reverts commit 9b65bb8020
2024-12-23 18:49:05 +01:00
8238a81494
Merge pull request #128 from Shineson1001/feature/116-EventIncorrectTimeZone
...
🐛 Event: Incorrect Time Zone
2024-12-20 20:02:32 +01:00
cc45f0659c
🐛 Event: Incorrect Time Zone
...
- Add "Time zone" input field.
- 24-Hour time format.
- Set Min-Year and Max-Year dynamically
2024-12-19 22:34:42 +01:00
ad37224890
Merge pull request #127 from Shineson1001/feature/88-SelfHostedQRCodeGenerator
...
Instead using external API (api.qrserver.com) .. use chillerlan/php-qrcode
2024-12-15 16:35:29 +01:00
9b65bb8020
Instead using external API (api.qrserver.com) .. use chillerlan/php-qrcode
2024-12-15 14:36:39 +01:00
97481c2444
Merge pull request #126 from Shineson1001/feature/2FA-QRCodes
...
Add 2FA QR Code
2024-12-14 09:17:50 +01:00
8151de4b9a
Add 2FA QR Code
...
Save your 2FA secrets to QR-Code.
2024-12-13 23:42:57 +01:00
477d7803f0
available plugins
2024-10-20 16:32:58 +02:00
8cc5294a84
Update README.md
2024-10-20 11:07:12 +02:00
e6aac416d9
bug fix in helpers.php
2024-04-21 12:55:03 +02:00
e84f853d80
edit readme
2024-04-21 12:38:35 +02:00
7d5a4b889c
bug fix
2024-04-18 20:54:04 +02:00
c157815ca8
fix in bulk action
2024-04-18 20:44:22 +02:00
2d9b6162e1
readme
2024-04-18 20:35:04 +02:00
096c239715
bug fix in read.php, bump version in footer, NEW: bulk delete
2024-04-18 20:33:20 +02:00
5bdcb8e2bf
bug fix database prefix in Qrcode class
2024-03-11 15:43:16 +01:00
98ae82a040
bug fix bulk download
2024-03-04 14:36:18 +01:00
15b5ece4f9
Merge pull request #94 from tranmh/xss_static_qrcode
...
Fix Security: Stored Cross Site Scripting for static QR code
2024-03-01 09:58:29 +01:00
b03238b4c3
Fix Security: Stored Cross Site Scripting for static QR code, see https://github.com/giandonatoinverso/PHP-Dynamic-Qr-code/issues/93
2024-03-01 08:03:31 +01:00
2287d98455
Merge pull request #92 from tranmh/fix_remove_DATABASE_PREFIX_for_getOne
...
Inconsistency of using DATABASE_PREFIX with getOne()
2024-02-29 00:25:17 +01:00
3e43b72eec
Inconsistency of using DATABASE_PREFIX with getOne()
2024-02-28 16:56:39 +01:00
5488ad0a84
Merge pull request #91 from tranmh/mixed_content_blocked
...
fix: mixed content blocked for http and https
2024-02-28 14:16:21 +01:00
9710ae0673
fix mixed content blocked for http and https: Mixed Content: The page at ' https://localhost/qrcode/dynamic_qrcodes.php ' was loaded over HTTPS, but requested an insecure stylesheet ' http://code.ionicframework.com/ionicons/2.0.1/css/ionicons.min.css '. This request has been blocked; the content must be served over HTTPS.
2024-02-28 13:55:44 +01:00
893b883dbf
Merge pull request #90 from tranmh/fix_case_sensitive_filename
...
Fix case sensitive filename
2024-02-27 13:25:17 +01:00
60620e15dd
fix: case sensitive for filename
2024-02-27 13:18:52 +01:00
ec786d2956
fix: case sensitive for filename
2024-02-27 13:18:01 +01:00
a4d8455e5a
increased size of column link - dynamic qrcode
...
increased size of column link - dynamic qrcode
2024-02-14 23:58:00 +01:00
5ac338945d
Update README.md
...
updated php version requirement
2024-01-03 00:43:50 +01:00
6e213483a4
Update README.md
2023-10-30 17:02:13 +01:00
8a926ac0f3
bug fix redirect url with docker installation
2023-10-17 23:24:34 +02:00
0360176490
bug fix
2023-10-17 00:41:15 +02:00
57930cf9db
bug fix and documentation
2023-10-16 22:57:16 +02:00
6682a207b2
updated documentation
2023-10-16 22:24:15 +02:00
c326a30afc
updated documentation
2023-10-16 20:56:06 +02:00
28545c2245
Refactoring docker image building, NEW: added docker compose support
...
Signed-off-by: giandonato.inverso@edempg.it <giandonato.inverso@studenti.unimi.it >
2023-10-16 19:49:29 +02:00
1085a13d38
readme updated
...
Signed-off-by: giandonato.inverso@edempg.it <giandonato.inverso@studenti.unimi.it >
2023-10-16 13:15:53 +02:00
13a807ac85
readme updated
...
Signed-off-by: giandonato.inverso@edempg.it <giandonato.inverso@studenti.unimi.it >
2023-10-16 13:15:07 +02:00
876b6736b6
refactoring of table database, added script for upgrading to versions >= 2.0, added multi-user support
...
Signed-off-by: giandonato.inverso@edempg.it <giandonato.inverso@studenti.unimi.it >
2023-10-16 13:10:57 +02:00
e36c26a37a
readme updated
...
Signed-off-by: giandonato.inverso@edempg.it <giandonato.inverso@studenti.unimi.it >
2023-10-16 01:43:56 +02:00
a2ce4b38b6
eliminazione file superflui, spostamento file read.php all'interno del progetto, aggiunta astrazione classe Qrcode, miglioramento download bulk, refactoring generale
...
Signed-off-by: giandonato.inverso@edempg.it <giandonato.inverso@studenti.unimi.it >
2023-10-16 01:41:27 +02:00
12e358b87c
Bug fix login.php
...
removed .min extension adminlte js file
2023-09-16 14:51:04 +02:00
617d08c13d
paypal donations
2023-09-05 23:31:38 +02:00
5612558ad1
Update README.md
2023-09-05 23:29:51 +02:00
e827b55f6b
Merge remote-tracking branch 'origin/master'
2023-08-22 17:15:09 +02:00
3ea78d6a84
doc update
...
Signed-off-by: giandonato.inverso@edempg.it <Zannabianca20>
2023-08-22 17:14:52 +02:00
e947153e74
Update Dockerfile
2023-01-25 18:51:10 +01:00
4e3cfeeaa3
Merge pull request #52 from AyhamAl-Ali/fix/db_prefix
...
🚀 Fix DB Prefix in `read.php`
2023-01-25 18:50:15 +01:00
f750d7aaca
Fix DB Prefix
2023-01-25 20:47:52 +03:00
c6cb83638a
Merge pull request #45 from chilluniverse/patch-1
...
DATABASE_HOST
2022-10-14 10:36:59 +02:00
7e70ca94d8
DATABASE_HOST
...
In the docker-compose.yml is the Database_Host defined as "mariadb". If Host is not changed in the environment.php to "mariadb" as well the setup will fail
2022-10-14 01:26:06 +02:00
7d7c326795
new version dockerfile
2022-09-28 16:23:44 +02:00
16327a0e0a
new version dockerfile
2022-09-28 16:22:18 +02:00
53955af19c
Merge pull request #37 from 0xRenegade/feature/download-multiple-qr-img-at-once
...
Error Message for no qrcodes selected.
2022-09-24 22:43:16 +02:00
4aab7d637a
Error Message for no qrcodes selected.
2022-09-24 15:40:56 -05:00
a6b2b29352
Merge pull request #36 from 0xRenegade/feature/download-multiple-qr-img-at-once
...
Feature/download multiple qr img at once
2022-09-24 22:26:36 +02:00
dac89ba0b2
download multiple qrcodes at once feature
2022-09-24 15:14:20 -05:00
f064d8f1ef
add base_url() function in helpers, works with https and port number
2022-09-24 14:32:04 -05:00
cccf3ada43
adds in custom.css for, well, custom styles.
2022-09-24 13:09:17 -05:00
b5aec38e45
Merge pull request #35 from 0xRenegade/issue-30/update-docker-yml-for-db-prefix
...
Issue 30/update docker yml for db prefix
2022-09-24 19:44:31 +02:00
654d395369
Merge pull request #33 from 0xRenegade/QOL/ignore-env-and-use-example-instead
...
QOL/ignore env and use example instead
2022-09-24 19:44:23 +02:00
f410322119
update docker-compose.yml for database prefix option
2022-09-24 12:19:40 -05:00
cbc5246163
update docs for this change
2022-09-24 11:52:34 -05:00
d99e8132c9
update main gitignore to add in environment.php
2022-09-24 11:44:02 -05:00
99a361c0be
move env to example, so we don't run into merge conflicts constantly
2022-09-24 11:42:17 -05:00
64974c6c51
Merge pull request #1 from giandonatoinverso/master
...
sync master branch with remote
2022-09-24 11:28:55 -05:00
52e2347644
Merge pull request #31 from 0xRenegade/renegade/general-fixes
...
general fixes, fixed database prefix during install
2022-09-24 11:53:34 +02:00
304b808bb6
set static attribute of class rather than non-DRY code
2022-09-24 00:24:03 -05:00
9f376bd3c9
remove error_log debugging
2022-09-24 00:05:50 -05:00
fca443b6cc
updated MysqliDb class functions to handle prefix properly.
2022-09-23 23:44:01 -05:00
1f64d4cad7
if this feature is accepted in Pull Request, will need to add this back
2022-09-23 23:02:05 -05:00
b7b090f6c5
Merge branch 'renegade/general-fixes' of github.com:0xRenegade/PHP-Dynamic-Qr-code into renegade/general-fixes
2022-09-23 23:01:05 -05:00
52d890597d
some queries are manually entered, which aren't picked up by 'prefix' class attribute in database class
2022-09-23 22:59:53 -05:00
40ab7b256d
Merge branch 'master' into renegade/general-fixes
2022-09-23 21:05:16 -05:00
bbf115c2ae
added in prefix by default, oops.
2022-09-23 21:00:41 -05:00
b433a83578
Issue #30 : Fixes database_prefix option during install
2022-09-23 20:55:55 -05:00
c005b52211
Update config.php
2022-09-24 03:24:15 +02:00
e61c38473c
Update docker-compose.yml
2022-09-24 03:23:41 +02:00
1243b32de1
Update environment.php
2022-09-24 03:23:20 +02:00
a20810d650
missing scroll bar on documentation page sidebar
2022-09-23 20:09:22 -05:00
c4d5440453
Update add_dynamic_form.php
...
added support for http url
2022-09-10 11:50:19 +02:00
975fde9c35
Update MysqliDb.php
...
fix deprecated implode()
2022-09-05 20:40:26 +02:00
af363723b2
Merge pull request #25 from nirpt/master
...
docker build now supports app release version code.
2022-08-29 14:09:34 +02:00
e2ff6e585b
Docker build with app version added.
2022-08-29 12:32:20 +02:00
389123fe15
Merge remote-tracking branch 'origin/master'
...
# Conflicts:
# docker/README.md
2022-08-28 13:22:12 +02:00
a519d7bfe6
Update README.md
2022-08-28 12:33:14 +02:00
a98c89075d
doc update
...
Signed-off-by: giandonato.inverso@edempg.it <Zannabianca20>
2022-08-28 12:04:48 +02:00
00d7dfdb0b
new installation process via script, elimination of data entry form for installation
...
Signed-off-by: giandonato.inverso@edempg.it <Zannabianca20>
2022-08-28 11:57:31 +02:00
08ac31210c
Minor refactor and cleanup
2022-08-28 11:29:20 +02:00
fef45c401a
configuration file modification, docker environment variable support
2022-08-28 11:24:32 +02:00
21b779c581
Merge pull request #23 from nirpt/master
...
docker support added
2022-08-28 10:47:05 +02:00
618030e9d3
docker support added
2022-08-28 10:24:07 +02:00
59cee36c3a
Update README.md
2022-06-17 11:49:06 +02:00
88028393cd
Update README.md
2022-06-17 11:48:44 +02:00
de377902be
Merge pull request #16 from neoteknic/patch-1
...
Fix php 8.1 warning in form field
2022-02-22 16:55:19 +01:00
ee711a5796
Update filters.php
...
Fix php 8.1 warning in form field
2022-02-22 16:22:13 +01:00
e599aed16f
Add files via upload
2020-09-08 18:43:51 +02:00
0d77e8f3a4
Add files via upload
2020-09-08 18:42:29 +02:00
6ed9018086
Add files via upload
2020-09-08 18:41:51 +02:00
8cee68e091
Add files via upload
2020-09-08 18:30:32 +02:00
4615be4280
Add files via upload
2020-09-08 18:28:26 +02:00
6e7b7cfa77
Add files via upload
2020-09-08 18:22:57 +02:00
74f92ca2fa
Add files via upload
2020-09-08 18:20:38 +02:00
2dc2e2fe16
Add files via upload
2020-09-08 18:17:08 +02:00
37dc9baa97
Add files via upload
2020-09-08 18:15:54 +02:00
0337838319
Add files via upload
2020-09-08 18:13:36 +02:00
c544e0c7b5
Add files via upload
2020-09-08 18:11:37 +02:00
087e3e83b5
Add files via upload
2020-09-08 18:09:19 +02:00
2ae9f32cb8
Add files via upload
2020-09-08 18:06:28 +02:00
5924afa3dc
Add files via upload
2020-09-08 17:59:49 +02:00
b302e0cce1
Add files via upload
2020-09-08 17:59:21 +02:00
1f9fa672c6
Update README.md
2020-09-08 17:31:01 +02:00
bd610dc68f
Update README.md
2020-09-08 17:29:26 +02:00
dd9d5ae2fb
Update README.md
2020-09-08 17:26:41 +02:00
0e62c29f11
Update README.md
2020-09-08 17:25:38 +02:00
14610fe212
Update README.md
2020-09-08 17:24:07 +02:00
8bcb852ea9
Update README.md
2020-09-08 17:23:38 +02:00
0bfe40eafe
Update README.md
2020-09-08 17:23:17 +02:00
1e6bc3af4e
Update README.md
2020-09-08 17:23:02 +02:00
fa9e6730cc
Update README.md
2020-09-08 17:22:41 +02:00
6709776cc5
Update README.md
2020-09-08 17:22:25 +02:00
df04139a05
Update README.md
2020-09-08 17:21:33 +02:00
4a377b635c
Update README.md
2020-09-08 17:21:07 +02:00
8262550a10
Update README.md
2020-09-08 17:20:39 +02:00
31ab8efc05
Update README.md
2020-09-08 17:20:20 +02:00
3ee55c9b17
Update README.md
2020-09-08 17:20:05 +02:00
93cd20c49d
Update README.md
2020-09-08 17:18:41 +02:00
eff10b3ee6
Update README.md
2020-09-08 17:17:36 +02:00
6de33ea45c
Update README.md
2020-09-08 17:14:57 +02:00
34bfee494e
Update README.md
2020-09-08 17:13:33 +02:00
3f8209a6a6
Update README.md
2020-09-08 17:13:06 +02:00
2b93634d3a
Update README.md
2020-09-08 17:12:50 +02:00
c698fc34f1
Update README.md
2020-09-08 17:12:34 +02:00
93d362aba2
Update README.md
2020-09-08 17:12:01 +02:00
8fe055a5b1
Update README.md
2020-09-08 17:11:45 +02:00
8a64294455
Update README.md
2020-09-08 17:11:27 +02:00
854b0ca77d
Update README.md
2020-09-08 17:10:01 +02:00
7c707f865c
Update README.md
2020-09-08 17:09:36 +02:00
439d136f54
Update README.md
2020-09-08 17:09:15 +02:00
d0f2d526f1
Update README.md
2020-09-08 17:08:42 +02:00
9c855a19bb
Update README.md
2020-09-08 17:07:06 +02:00
a7e532867a
Update README.md
2020-09-08 17:06:25 +02:00
67e6d85da9
Update README.md
2020-09-08 17:05:43 +02:00
35c72f6199
Initial commit
2020-09-08 16:56:05 +02:00
dillard
Giandonato Inverso