4 Commits

Author	SHA1	Message	Date
myron	d12baebcbc	Fix security issues from code review: remove plaintext password comment, enable TLS verification, harden booking ref entropy, fix XSS/injection in signature emails, fix broken waiver link, consolidate duplicated auth/file-serving logic, add missing document view links, sync schema.sql with live DB	2026-07-04 14:01:33 -05:00
myron	72ba4743f9	simplify: cache dirname(__DIR__), use str_starts_with, drop finfo object for mime_content_type()	2026-06-23 16:35:17 +00:00
myron	bb21fca399	Security: block direct upload access, fix view-doc path traversal guard ... - uploads/.htaccess: deny all direct web access to uploaded customer docs - admin/view-doc.php: add realpath() path-traversal check (mirrors view-doc.php) - admin/view-doc.php: remove dead double-query (result was always overwritten) - .gitignore: uploads/* wildcard so .htaccess can be tracked	2026-06-13 14:20:41 +00:00
myron	072272104e	Migrate to parkerslingshotrentals.com domain ... - db.php: SITE_URL -> https://www.parkerslingshotrentals.com - db.php: add ADMIN_PHONE (817) 266-2022 - index.html, contact.php, admin/index.php: fix placeholder phone 555-0199 -> 266-2022 - admin/view-doc.php: new secure doc viewer (URL-token auth, bookings table) - upload-docs.php, view-doc.php: added from subdomain (already used db.php/bookings)	2026-06-08 17:23:40 +00:00