Prepares the site for handover to the incoming committee. Three groups of
change: security fixes, a production stability fix, and documentation.
SECURITY
- upload_blog_image.php accepted unauthenticated uploads with no extension
or MIME validation, into a web-served directory. Anyone could upload and
execute a .php file. Now requires a session, checks blog ownership, and
runs through validateFileUpload() with a new blog_image type.
- Added uploads/.htaccess and assets/uploads/.htaccess disabling the PHP
engine, so an upload bypass still cannot execute. Force-added: .gitignore
contains a bare .htaccess rule.
- blog/autosave.php updated posts by blog_id alone, letting any logged-in
member overwrite anyone's post. Now scoped to the author, admin override
retained. It also silently reassigned authorship to the editing admin;
the existing author is now preserved.
- add_to_cart.php took item_price and user_id from POST, so drinks could be
charged at any price to any member's tab, unauthenticated. Price and name
are now looked up server-side from bar_items. Its require paths were also
relative and broken.
- Session cookies now httponly/secure/samesite with strict mode, set in both
.htaccess and .user.ini since php_flag and .user.ini apply under different
SAPIs. The 30 minute idle timeout that login set but never checked is now
enforced. Google login now regenerates the session id.
- Forced HTTPS. Required, because Secure cookies are never sent over plain
HTTP and login would fail silently. LetsEncrypt acme-challenge is exempted
above the redirect so certificate renewal keeps working.
- display_errors off; .htaccess now blocks *.log, error_log, .git and
dotfiles. Debug logs containing member IDs, raw webhook bodies and payment
signatures were publicly fetchable.
- Removed the IKHOKHA_BYPASS_SIGNATURE switch and the logging of raw webhook
bodies, app IDs and signatures. Replaced a hardcoded personal Gmail
recipient with the optional DEVELOPER_EMAIL variable.
- Added auth to fetch_users, fetch_bar_tabs, fetch_drinks, create_bar_tab and
submit_order. Converted get_tab_total to a prepared statement.
- Tightened 11 mkdir(0777) calls to 0755.
- Fixed the validate_login rewrite, which pointed at a nonexistent path and
only worked by falling through to the generic .php rule.
DATABASE STABILITY
openDatabaseConnection() opened a new connection on every call across 73 call
sites, and the server was hitting "Too many connections" in production. It now
returns one shared handle per request, reusing the connection connection.php
already opened. The 40 conn->close() calls in functions.php are removed, since
closing the shared handle breaks every later caller; PHP releases it at end of
request. A liveness check reconnects transparently if anything closes it.
Verified no function was lost (99 before and after), every removed close was
inside a braced block, and no transaction spans a helper that would open a
nested one.
DOCUMENTATION AND TOOLING
- docs/HANDOVER.md: operator guide covering architecture, routing, roles, the
membership lifecycle, payments, backups, POPIA obligations, environment
variables, known issues and a handover checklist.
- docs/FUNCTIONS.md: reference for the helpers in functions.php.
- scripts/backup.sh: nightly database and uploads backup, written outside the
web root, with rotation and verification. Dumps are written to a temp file
and only promoted after passing gzip, CREATE TABLE and completion-marker
checks, so a failed run can never overwrite a good backup.
- .deployignore and .gitattributes added; .gitattributes pins LF on shell
scripts and server config because core.autocrlf is true on Windows.
- Removed leftover debris: src/api/test_log.php and .htaccess1.
All 22 modified PHP files pass php -l. The backup script was tested against a
stub mysqldump for healthy, truncated and failing dumps, and for rotation.
Nothing was run against a live database or web server.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
twotalesanimation
81efab9cb0