4 Commits

Include renames

Author	SHA1	Message	Date
jaredandClaude Opus 4.8	d6214a0339	Add schema baseline, fix cron/retention, restore cleanup, correct docs ... - migrations/000_baseline.sql: full schema baseline captured from prod (validated on a throwaway DB: 17 tables/17 FKs), so the schema is reproducible for fresh installs / disaster recovery - create_recurring_tickets cron: send the Matrix ticket-created notification and invalidate the stats cache like the other create paths - create_ticket_api.php + TicketController::create: invalidate the stats cache on create/escalate/reopen so dashboard counts aren't stale - scripts/cleanup_orphan_uploads.php: restored, made safe (24h mtime grace, 9-digit-dir only, skips avatars/symlinks, matches the unique filename column, --dry-run) - cron/cleanup_audit_log.php: enforce the configured audit-log retention (deleteOldLogs was implemented but never called) - README: correct CSRF-rotation, hwmon dedup (no 24h window), SLA (no P3), stats-cache callers, and the project structure/endpoint listing - .env.example: document TRUSTED_PROXIES fail-open risk and .env quoting Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-10 16:11:26 -04:00
jaredandClaude Sonnet 4.6	444dc4bf26	Remove scripts/ directory from repo ... One-off migration scripts and deploy helpers do not belong in the repository. Run them locally or from /tmp as needed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-06 21:47:08 -04:00
jaredandClaude Opus 4.6	bcc163bc77	Audit fixes: security, dead code removal, API consolidation, JS dedup ... Security: - Fix IDOR in delete/update comment (add ticket visibility check) - XSS defense-in-depth in DashboardView active filters - Replace innerHTML with DOM construction in toast.js - Remove redundant real_escape_string in check_duplicates - Add rate limiting to get_template, download_attachment, audit_log, saved_filters, user_preferences endpoints Bug fixes: - Session timeout now reads from config instead of hardcoded 18000 - TicketController uses $GLOBALS['config'] instead of duplicate .env parsing - Add DISCORD_WEBHOOK_URL to centralized config - Cleanup script uses hashmap for O(1) ticket ID lookups Dead code removal (~100 lines): - Remove dead getTicketComments() from TicketModel (wrong bind_param type) - Remove dead getCategories()/getTypes() from DashboardController - Remove ~80 lines dead Discord webhook code from update_ticket API Consolidation: - Create api/bootstrap.php for shared API setup (auth, CSRF, rate limit) - Convert 6 API endpoints to use bootstrap - Extract escapeHtml/getTicketIdFromUrl into shared utils.js - Batch save for user preferences (1 request instead of 7) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-11 14:50:06 -05:00
jaredandClaude Opus 4.5	591fad52cc	Add deployment scripts and preserve uploads folder ... - Add scripts/deploy.sh for safe deployment with uploads preservation - Add scripts/cleanup_orphan_uploads.php to remove orphaned files - Add .gitkeep to uploads folder - Update .gitignore to exclude uploaded files but keep folder structure The deploy script now: - Backs up and restores .env file - Backs up and restores uploads folder contents - Runs database migrations automatically Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-20 15:27:05 -05:00