dillard
c3c6f167e0
Preset system: qr_presets table (migration 005) plus a presets.php AJAX endpoint (list/save/delete, CSRF-protected, scoped to the logged-in user's own id - presets are personal, never shared across accounts). UI/JS lives in dist/js/qrcode-style-tools.js. Random style button: client-side only, fills foreground/background with a random hex color pair (playful randomize, no contrast/scannability guarantee). Qr scanner (scan_qrcode.php): camera or image upload, decoded entirely client-side via html5-qrcode (CDN, pinned to 2.3.8). PWA: manifest.json + service-worker.js, icons generated from the existing DynamicQRCode_Original.png glyph. The service worker only caches static assets (css/js/images) and deliberately never touches PHP pages, since those carry CSRF tokens and session-specific content that must never be cached. Fixes a gap found while testing: qrcode_options.php is only a shared partial for the static qr forms - the dynamic qr form (form_dynamic_add.php) has its own separate copy of the foreground/background/level/size/filename/format fields (pre-existing structure, not something introduced here). That meant frame_text and the new preset/random-style UI never showed up on the dynamic qr page. Added the same fields there too, verified with a dynamic qr plus frame text (150x180px, the expected +30px padding).
109 lines
4.4 KiB
SQL
109 lines
4.4 KiB
SQL
SET SQL_MODE="NO_AUTO_VALUE_ON_ZERO";
|
|
SET time_zone = "+00:00";
|
|
|
|
/*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */;
|
|
/*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */;
|
|
/*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;
|
|
/*!40101 SET NAMES utf8 */;
|
|
|
|
CREATE TABLE IF NOT EXISTS `users` (
|
|
`id` int(25) NOT NULL AUTO_INCREMENT,
|
|
`username` varchar(50) NOT NULL,
|
|
`password` varchar(255) NOT NULL,
|
|
`series_id` varchar(60) DEFAULT NULL,
|
|
`remember_token` varchar(255) DEFAULT NULL,
|
|
`expires` datetime DEFAULT NULL,
|
|
`type` varchar(10) NOT NULL,
|
|
`must_change_password` tinyint(1) NOT NULL DEFAULT 0,
|
|
`password_changed_at` datetime DEFAULT NULL,
|
|
`can_view_static` tinyint(1) NOT NULL DEFAULT 0,
|
|
`can_view_dynamic` tinyint(1) NOT NULL DEFAULT 0,
|
|
`owner_admin_id` int(25) DEFAULT NULL,
|
|
PRIMARY KEY (`id`),
|
|
UNIQUE KEY `username` (`username`)
|
|
) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=0 ;
|
|
|
|
-- Default super admin account. Credentials: superadmin / superadmin
|
|
-- must_change_password=1 forces a password change on first login (see Fase 1 hardening).
|
|
INSERT INTO `users` (`id`, `username`, `password`, `series_id`, `remember_token`, `expires`, `type`, `must_change_password`, `password_changed_at`) VALUES
|
|
(1, 'superadmin', '$2y$10$xpZc5KC.aU2XHkcqhuZGFuAnqmtL4Unt8MysOyylceq.19XIyoZpG', NULL, NULL, NULL, 'super', 1, NULL);
|
|
|
|
CREATE TABLE IF NOT EXISTS `dynamic_qrcodes` (
|
|
`id` int(10) NOT NULL AUTO_INCREMENT,
|
|
`id_owner` int(25) NULL DEFAULT NULL,
|
|
`filename` varchar(45) NOT NULL,
|
|
`format` varchar(45) DEFAULT NULL,
|
|
`identifier` longtext,
|
|
`link` varchar(500) DEFAULT NULL,
|
|
`qrcode` varchar(60) DEFAULT NULL,
|
|
`scan` int(11) NOT NULL DEFAULT '0',
|
|
`state` varchar(20) NOT NULL DEFAULT 'enable',
|
|
`created_by` int(10) unsigned NOT NULL DEFAULT '0',
|
|
`created_at` timestamp NULL DEFAULT NULL,
|
|
`updated_by` int(10) unsigned NOT NULL DEFAULT '0',
|
|
`updated_at` timestamp NULL DEFAULT NULL,
|
|
PRIMARY KEY (`id`)
|
|
) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=0 ;
|
|
|
|
CREATE TABLE IF NOT EXISTS `static_qrcodes` (
|
|
`id` int(10) NOT NULL AUTO_INCREMENT,
|
|
`id_owner` int(25) NULL DEFAULT NULL,
|
|
`filename` varchar(45) CHARACTER SET utf8 NOT NULL,
|
|
`format` varchar(45) DEFAULT NULL,
|
|
`type` varchar(45) CHARACTER SET utf8 DEFAULT NULL,
|
|
`content` mediumtext CHARACTER SET utf8,
|
|
`qrcode` varchar(60) CHARACTER SET utf8 DEFAULT NULL,
|
|
`state` varchar(20) CHARACTER SET utf8 NOT NULL DEFAULT 'enable',
|
|
`created_by` int(10) unsigned NOT NULL DEFAULT '0',
|
|
`created_at` timestamp NULL DEFAULT NULL,
|
|
`updated_by` int(10) unsigned NOT NULL DEFAULT '0',
|
|
`updated_at` timestamp NULL DEFAULT NULL,
|
|
PRIMARY KEY (`id`)
|
|
) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT=0 ;
|
|
|
|
-- Security hardening (Fase 1): rate limiting on login attempts
|
|
CREATE TABLE IF NOT EXISTS `login_attempts` (
|
|
`id` int(10) unsigned NOT NULL AUTO_INCREMENT,
|
|
`username` varchar(50) NOT NULL,
|
|
`ip_address` varchar(45) NOT NULL,
|
|
`success` tinyint(1) NOT NULL DEFAULT 0,
|
|
`attempted_at` datetime NOT NULL,
|
|
PRIMARY KEY (`id`),
|
|
KEY `username_attempted_at` (`username`, `attempted_at`),
|
|
KEY `ip_attempted_at` (`ip_address`, `attempted_at`)
|
|
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
|
|
|
|
-- Security hardening (Fase 1): audit log of sensitive actions
|
|
CREATE TABLE IF NOT EXISTS `audit_log` (
|
|
`id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
|
|
`user_id` int(25) DEFAULT NULL,
|
|
`username` varchar(50) DEFAULT NULL,
|
|
`action` varchar(50) NOT NULL,
|
|
`target_type` varchar(30) DEFAULT NULL,
|
|
`target_id` varchar(50) DEFAULT NULL,
|
|
`ip_address` varchar(45) DEFAULT NULL,
|
|
`user_agent` varchar(255) DEFAULT NULL,
|
|
`created_at` datetime NOT NULL,
|
|
PRIMARY KEY (`id`),
|
|
KEY `created_at` (`created_at`),
|
|
KEY `user_id` (`user_id`)
|
|
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
|
|
|
|
-- Fase 3 (priority 2): saved color/style presets per user
|
|
CREATE TABLE IF NOT EXISTS `qr_presets` (
|
|
`id` int(10) unsigned NOT NULL AUTO_INCREMENT,
|
|
`user_id` int(25) NOT NULL,
|
|
`name` varchar(50) NOT NULL,
|
|
`foreground` varchar(10) NOT NULL,
|
|
`background` varchar(10) NOT NULL,
|
|
`level` varchar(1) NOT NULL DEFAULT 'L',
|
|
`size` int(10) unsigned NOT NULL DEFAULT 200,
|
|
`created_at` datetime NOT NULL,
|
|
PRIMARY KEY (`id`),
|
|
KEY `user_id` (`user_id`)
|
|
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
|
|
|
|
/*!40101 SET CHARACTER_SET_CLIENT=@OLD_CHARACTER_SET_CLIENT */;
|
|
/*!40101 SET CHARACTER_SET_RESULTS=@OLD_CHARACTER_SET_RESULTS */;
|
|
/*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */;
|