myron/jarvis
1
0
Fork 0
mirror of https://github.com/myronblair/jarvis synced 2026-07-28 00:34:35 -05:00
Code Issues Packages Projects Releases Wiki Activity

Document ChuckCo Time Keeper code review fixes and admin login rate limiting

Browse Source
This commit is contained in:
Myron Blair
2026-07-05 19:17:14 -05:00
parent 0b1a19d9de
commit cfb5b2a3f9
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
public_html/admin/downloads/INFRASTRUCTURE-REFERENCE.md
+3 -1
View File
@@ -1,5 +1,5 @@
# INFRASTRUCTURE REFERENCE — COMPLETE SYSTEM MAP
**Last Updated:** 2026-07-05
**Last Updated:** 2026-07-06
**Owner:** Myron Blair — myronblair@outlook.com
---
@@ -402,6 +402,8 @@ See Section 7 for full JARVIS details.
| **DB** | `workt_track_db` / `workt_track_user` / `ZWCNMRP2N5NVPsghmve5aRS9` |
| **Linked from Blair HQ** | `web.orbishosting.com` dashboard's "Websites" card has direct links to the admin login and the all-workers overview page (site-wide token `972f82cbf7832fdb2cffcdcc84129a4af69e30bd`) |
| **Note** | Built 2026-07-05. `includes/config.php` (DB creds, admin password hash, site token) lives outside `public_html`/webroot and is intentionally NOT in the git repo. |
| **Admin login rate limiting** | Added 2026-07-06 — `login_attempts` table (`ip_address`, `attempts`, `last_attempt`) in `workt_track_db`; 5 failed attempts locks that IP out for 15 minutes. |
| **Code review (2026-07-06)** | 5 findings fixed and deployed: `w.php` mark_paid now rejects any `week_start` that isn't the true current week (was trusting client input); `admin/worker.php` no longer double-HTML-escapes the page title; `all.php` now shows a Paid/Unpaid badge per worker for the displayed week; `s.php`/`p.php`/`all.php` validate the `week` param before building dates (malformed input used to throw an uncaught DateTime exception); admin login rate-limited (see above). |
---