From cfb5b2a3f907d8aa955fc2ececcc4c4db95462c5 Mon Sep 17 00:00:00 2001 From: Myron Blair Date: Sun, 5 Jul 2026 19:17:14 -0500 Subject: [PATCH] Document ChuckCo Time Keeper code review fixes and admin login rate limiting --- public_html/admin/downloads/INFRASTRUCTURE-REFERENCE.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/public_html/admin/downloads/INFRASTRUCTURE-REFERENCE.md b/public_html/admin/downloads/INFRASTRUCTURE-REFERENCE.md index 60aa5ef..fb9db59 100644 --- a/public_html/admin/downloads/INFRASTRUCTURE-REFERENCE.md +++ b/public_html/admin/downloads/INFRASTRUCTURE-REFERENCE.md @@ -1,5 +1,5 @@ # INFRASTRUCTURE REFERENCE — COMPLETE SYSTEM MAP -**Last Updated:** 2026-07-05 +**Last Updated:** 2026-07-06 **Owner:** Myron Blair — myronblair@outlook.com --- @@ -402,6 +402,8 @@ See Section 7 for full JARVIS details. | **DB** | `workt_track_db` / `workt_track_user` / `ZWCNMRP2N5NVPsghmve5aRS9` | | **Linked from Blair HQ** | `web.orbishosting.com` dashboard's "Websites" card has direct links to the admin login and the all-workers overview page (site-wide token `972f82cbf7832fdb2cffcdcc84129a4af69e30bd`) | | **Note** | Built 2026-07-05. `includes/config.php` (DB creds, admin password hash, site token) lives outside `public_html`/webroot and is intentionally NOT in the git repo. | +| **Admin login rate limiting** | Added 2026-07-06 — `login_attempts` table (`ip_address`, `attempts`, `last_attempt`) in `workt_track_db`; 5 failed attempts locks that IP out for 15 minutes. | +| **Code review (2026-07-06)** | 5 findings fixed and deployed: `w.php` mark_paid now rejects any `week_start` that isn't the true current week (was trusting client input); `admin/worker.php` no longer double-HTML-escapes the page title; `all.php` now shows a Paid/Unpaid badge per worker for the displayed week; `s.php`/`p.php`/`all.php` validate the `week` param before building dates (malformed input used to throw an uncaught DateTime exception); admin login rate-limited (see above). | ---