dillard
3afe3b7698
Fixes critical pre-existing issues found during review: bulk_action.php had no auth check at all (unauthenticated download/delete of any qrcode) and built a table name from unwhitelisted user input (SQL injection); the QR generator classes wrote files from unvalidated filename/format, allowing path traversal and arbitrary file writes. Also pins chillerlan/php-qrcode to 5.0.5 since master now requires PHP 8.4, breaking the PHP 8.3 build. - CSRF tokens on all POST forms and the bulk_action.php JSON endpoint - Login rate limiting (5 attempts / 15 min) via new login_attempts table - Hardened sessions: httponly/samesite cookies, 30 min idle timeout, session regeneration on login - Forced password change for the default superadmin/superadmin account - Server-side validation in Users/DynamicQrcode/Qrcode classes - Audit log table for auth, user, and qrcode actions - Checked-in db schema (db/init.sql, migrations/) instead of relying on an opaque prebuilt db image - Production docker-compose with Nginx + php-fpm instead of the PHP dev server
43 lines
1.3 KiB
PHP
43 lines
1.3 KiB
PHP
<form class="form" action="static_qrcode.php?type=wifi" method="post" id="static_form" enctype="multipart/form-data">
|
|
<?php echo csrf_field(); ?>
|
|
<?php include BASE_PATH.'/forms/qrcode_options.php'; ?>
|
|
<!-- Input forms -->
|
|
<div class="col-sm-12 mb-2">
|
|
<div class="row">
|
|
|
|
<div class="col-6 col-md-3">
|
|
<div class="form-group">
|
|
<label>Encryption *</label>
|
|
<select name="encryption" class="form-control">
|
|
<option value="WPA" Selected>WPA/WPA2</option>
|
|
<option value="WEP">WEP</option>
|
|
<option value="">None</option>
|
|
</select>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="col-6 col-md-3">
|
|
<div class="form-group">
|
|
<label>SSID *</label>
|
|
<input type="text" name="ssid" value="" placeholder="" class="form-control">
|
|
</div>
|
|
</div>
|
|
|
|
<div class="col-6 col-md-3">
|
|
<div class="form-group">
|
|
<label>Password</label>
|
|
<input type="text" name="password" value="" placeholder="" class="form-control">
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="col-sm-12 mb-2">
|
|
<div class="row">
|
|
<div class="col-6 col-md-3">
|
|
<button type="submit" class="btn btn-primary">Submit</button>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
</form>
|