myron/parkerslingshotrentals
1
0
Fork 0
mirror of https://github.com/myronblair/parkerslingshotrentals synced 2026-07-28 09:02:29 -05:00
Code Issues Packages Projects Releases Wiki Activity

Fix security issues from code review: remove plaintext password comment, enable TLS verification, harden booking ref entropy, fix XSS/injection in signature emails, fix broken waiver link, consolidate duplicated auth/file-serving logic, add missing document view links, sync schema.sql with live DB

Browse Source
This commit is contained in:
Myron Blair
2026-07-04 14:01:33 -05:00
parent 72ba4743f9
commit d12baebcbc
8 changed files with 75 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
db/schema.sql
+11
View File
@@ -56,11 +56,22 @@ CREATE TABLE `bookings` (
`waiver_name` varchar(160) DEFAULT NULL,
`waiver_sig` mediumtext DEFAULT NULL,
`insurance_verified` tinyint(1) NOT NULL DEFAULT 0,
`insurance_file` varchar(255) DEFAULT NULL,
`deposit_received` tinyint(1) NOT NULL DEFAULT 0,
`license_verified` tinyint(1) NOT NULL DEFAULT 0,
`license_file` varchar(255) DEFAULT NULL,
`helmet_provided` tinyint(1) NOT NULL DEFAULT 0,
`safety_course` tinyint(1) NOT NULL DEFAULT 0,
`operational_course` tinyint(1) NOT NULL DEFAULT 0,
`slingshot_returned` tinyint(1) NOT NULL DEFAULT 0,
`returned_at` datetime DEFAULT NULL,
`square_payment_id` varchar(64) DEFAULT NULL,
`square_payment_status` varchar(20) DEFAULT NULL,
`square_refund_id` varchar(64) DEFAULT NULL,
`square_customer_id` varchar(64) DEFAULT NULL,
`square_card_id` varchar(64) DEFAULT NULL,
`card_last4` varchar(4) DEFAULT NULL,
`card_brand` varchar(20) DEFAULT NULL,
`created_at` datetime NOT NULL DEFAULT current_timestamp(),
`updated_at` datetime NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
PRIMARY KEY (`id`),