5 Commits

Include renames

Author	SHA1	Message	Date
jared	c90bdc8ac8	style: auto-fix 1340 phpcs PSR-12 violations via phpcbf; exclude MissingNamespace and SideEffects	2026-04-13 20:56:10 -04:00
jaredandClaude Sonnet 4.6	b42597c927	Fix CSS variables, missing utility classes, API hardening, and audit log UX ... - base.css: add --lt-border/--lt-surface aliases so dashboard.css respects theme instead of using hardcoded fallback colors - base.css: add lt-select-sm/lt-input-sm compact size variants (used in 15+ places), lt-msg-danger alias for lt-msg-error, lt-form-hint--warn, lt-font-mono utility class - audit_log.php: cap ?limit= at 500 to prevent DoS via oversized queries - ApiKeysView.php: replace deprecated execCommand('copy') with lt.copy(); add integer casts on api_key_id in id attr and data-id - AuditLogView.php: rebuild pagination with windowed prev/next/ellipsis pattern matching DashboardView; integer cast on user_id select option Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-28 13:22:12 -04:00
jaredandClaude Opus 4.6	bcc163bc77	Audit fixes: security, dead code removal, API consolidation, JS dedup ... Security: - Fix IDOR in delete/update comment (add ticket visibility check) - XSS defense-in-depth in DashboardView active filters - Replace innerHTML with DOM construction in toast.js - Remove redundant real_escape_string in check_duplicates - Add rate limiting to get_template, download_attachment, audit_log, saved_filters, user_preferences endpoints Bug fixes: - Session timeout now reads from config instead of hardcoded 18000 - TicketController uses $GLOBALS['config'] instead of duplicate .env parsing - Add DISCORD_WEBHOOK_URL to centralized config - Cleanup script uses hashmap for O(1) ticket ID lookups Dead code removal (~100 lines): - Remove dead getTicketComments() from TicketModel (wrong bind_param type) - Remove dead getCategories()/getTypes() from DashboardController - Remove ~80 lines dead Discord webhook code from update_ticket API Consolidation: - Create api/bootstrap.php for shared API setup (auth, CSRF, rate limit) - Convert 6 API endpoints to use bootstrap - Extract escapeHtml/getTicketIdFromUrl into shared utils.js - Batch save for user preferences (1 request instead of 7) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-11 14:50:06 -05:00
jaredandClaude Opus 4.5	7575d6a277	Add performance, security, and reliability improvements ... - Consolidate all 20 API files to use centralized Database helper - Add optimistic locking to ticket updates to prevent concurrent conflicts - Add caching to StatsModel (60s TTL) for dashboard performance - Add health check endpoint (api/health.php) for monitoring - Improve rate limit cleanup with cron script and efficient DirectoryIterator - Enable rate limit response headers (X-RateLimit-*) - Add audit logging for workflow transitions - Log Discord webhook failures instead of silencing - Fix visibility check on export_tickets.php - Add database migration system with performance indexes - Fix cron recurring tickets to use assignTicket method Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-30 14:39:13 -05:00
jared	962724d811	better filtering and searching	2026-01-09 11:20:27 -05:00