4 Commits

Author	SHA1	Message	Date
twotalesanimation	b120415d53	Task 10: Harden file upload validation ... Enhanced validateFileUpload() function in functions.php with comprehensive security: - Hardcoded MIME type whitelist per file type (profile_picture, proof_of_payment, document) - Strict file size limits per type (5MB images, 10MB documents) - Extension validation against whitelist - Double extension prevention (e.g., shell.php.jpg) - MIME type verification using finfo - Image validation with getimagesize() - is_uploaded_file() verification - Random filename generation to prevent path traversal Updated file upload handlers: - upload_profile_picture.php - Profile picture uploads (JPEG, PNG, GIF, WEBP, 5MB max) - submit_pop.php - Proof of payment uploads (PDF only, 10MB max) + CSRF validation + audit logging - add_campsite.php - Campsite thumbnail uploads + input validation + CSRF validation + audit logging Security improvements: - All uploads use random filenames to prevent directory traversal - All uploads use secure file permissions (0644) - File validation occurs before move_uploaded_file() - Comprehensive error logging for failed uploads - Audit logging for successful file operations	2025-12-03 13:30:45 +02:00
twotalesanimation	3247d15ce7	Task 9: Add CSRF tokens to form templates and backend processors ... Updated forms with hidden CSRF token fields: - comment_box.php - Comment form - course_details.php - Course booking form - campsites.php - Campsite addition modal form - bar_tabs.php - Bar tab creation modal form - membership_application.php - Membership application form Updated backend processors with CSRF validation: - create_bar_tab.php - Bar tab AJAX processor - add_campsite.php - Campsite form processor - submit_order.php - Order submission processor All forms now require validated CSRF tokens before processing, preventing cross-site request forgery attacks.	2025-12-03 11:47:26 +02:00
twotalesanimation	07d75bc004	More ENV updates	2025-05-23 14:25:27 +02:00
Local Administrator	b83134aca3	Initial commit	2025-04-18 10:32:42 +02:00