dillard
3afe3b7698
Fixes critical pre-existing issues found during review: bulk_action.php had no auth check at all (unauthenticated download/delete of any qrcode) and built a table name from unwhitelisted user input (SQL injection); the QR generator classes wrote files from unvalidated filename/format, allowing path traversal and arbitrary file writes. Also pins chillerlan/php-qrcode to 5.0.5 since master now requires PHP 8.4, breaking the PHP 8.3 build. - CSRF tokens on all POST forms and the bulk_action.php JSON endpoint - Login rate limiting (5 attempts / 15 min) via new login_attempts table - Hardened sessions: httponly/samesite cookies, 30 min idle timeout, session regeneration on login - Forced password change for the default superadmin/superadmin account - Server-side validation in Users/DynamicQrcode/Qrcode classes - Audit log table for auth, user, and qrcode actions - Checked-in db schema (db/init.sql, migrations/) instead of relying on an opaque prebuilt db image - Production docker-compose with Nginx + php-fpm instead of the PHP dev server
33 lines
1.2 KiB
PHP
33 lines
1.2 KiB
PHP
|
|
<nav class="main-header navbar navbar-expand navbar-white navbar-light">
|
|
<!-- Left navbar links -->
|
|
<ul class="navbar-nav">
|
|
<li class="nav-item">
|
|
<a class="nav-link" data-widget="pushmenu" href="#" role="button"><i class="fas fa-bars"></i></a>
|
|
</li>
|
|
</ul>
|
|
|
|
<!-- Right navbar links -->
|
|
<ul class="navbar-nav ml-auto">
|
|
<!-- Notifications Dropdown Menu -->
|
|
<li class="nav-item dropdown">
|
|
<a class="nav-link" data-toggle="dropdown" href="#">
|
|
<i class="fas fa-user"></i>
|
|
</a>
|
|
<div class="dropdown-menu dropdown-menu-lg dropdown-menu-right">
|
|
<div class="dropdown-divider"></div>
|
|
<a href="./change_password.php" class="dropdown-item">
|
|
<i class="fas fa-key"></i> Change password
|
|
</a>
|
|
<div class="dropdown-divider"></div>
|
|
<a href="./logout.php" class="dropdown-item">
|
|
<i class="fas fa-sign-out-alt"></i> Logout
|
|
</a>
|
|
</div>
|
|
</li>
|
|
<li class="nav-item">
|
|
<a class="nav-link" data-widget="control-sidebar" data-slide="true" href="#" role="button"><i
|
|
class="fas fa-th-large"></i></a>
|
|
</li>
|
|
</ul>
|
|
</nav> |