2 Commits

Author	SHA1	Message	Date
myron	956defc34b	fix: all code review security findings ... - CORS: replace open regex with explicit hostname allowlist + port whitelist - Exception handler: only expose RuntimeException/InvalidArgumentException messages; PDOException and others return generic 'internal error' - Auth::portalUrl(): allowlist-validate HTTP_HOST before using it in redirect URL — prevents open redirect via Host header injection - _branding.php custom_css: strip HTML tags, js: URLs, @import, expression() instead of just </style> which was trivially bypassable - accounts create: check accounts table as well as users for username uniqueness (TOCTOU fix); wrap user INSERT + provisioning in single transaction so rollback is atomic on failure Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LP9Q4kfCAYAjJnsbHBrViZ	2026-06-21 16:03:26 +00:00
myron	6dd2e3a08d	fix: add all server-only assets and panel files missing from repo ... Previously missing from git (rsync --delete was wiping them on every deploy): - assets/css/nova.css - assets/js/nova.js, features.js, reseller.js, user.js - assets/img/*.svg (favicon, icons, logo, mark) - index.php, _branding.php, errors/404.php, errors/500.php - reseller/index.php, user/index.php Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LP9Q4kfCAYAjJnsbHBrViZ	2026-06-20 05:40:00 +00:00