Myron Blair 3bf7fe7620 Move db.php secrets out of webroot; switch to universal Square account ...

db.php: replace with a require shim pointing to db-secrets.php outside
public_html (DB password, admin hash, CyberMail key, Square token were all
sitting in a web-reachable file, only protected by .htaccess).

index.html: update the Web Payments SDK App ID/Location ID to the new
unified Square account shared with tomtomgames.com and tomsjavajive.com.

2026-07-05 15:46:25 +00:00

admin

Fix security issues from code review: remove plaintext password comment, enable TLS verification, harden booking ref entropy, fix XSS/injection in signature emails, fix broken waiver link, consolidate duplicated auth/file-serving logic, add missing document view links, sync schema.sql with live DB

2026-07-04 14:01:33 -05:00

config

Add rewrite-based deny rules for db/ and config/ (htaccess Deny directives are ignored on this LiteSpeed vhost)

2026-07-04 19:06:17 +00:00

db

Add rewrite-based deny rules for db/ and config/ (htaccess Deny directives are ignored on this LiteSpeed vhost)

2026-07-04 19:06:17 +00:00

uploads

Security: block direct upload access, fix view-doc path traversal guard

2026-06-13 14:20:41 +00:00

.gitignore

Security: block direct upload access, fix view-doc path traversal guard

2026-06-13 14:20:41 +00:00

.htaccess

Block public access to .git directory (leaked GitHub PAT, same issue found on sibling sites)

2026-07-04 16:04:05 -05:00

availability.php

Fix: blocked dates enforce on date input; fix CORS + no-cache on availability endpoint

2026-05-22 22:15:41 +00:00

contact.php

Fix security issues from code review: remove plaintext password comment, enable TLS verification, harden booking ref entropy, fix XSS/injection in signature emails, fix broken waiver link, consolidate duplicated auth/file-serving logic, add missing document view links, sync schema.sql with live DB

2026-07-04 14:01:33 -05:00

db.php

Move db.php secrets out of webroot; switch to universal Square account

2026-07-05 15:46:25 +00:00

index.html

Move db.php secrets out of webroot; switch to universal Square account

2026-07-05 15:46:25 +00:00

robots.txt

Initial commit

2026-05-22 12:52:49 +00:00

sitemap.xml

Initial commit

2026-05-22 12:52:49 +00:00

upload-docs.php

Fix security issues from code review: remove plaintext password comment, enable TLS verification, harden booking ref entropy, fix XSS/injection in signature emails, fix broken waiver link, consolidate duplicated auth/file-serving logic, add missing document view links, sync schema.sql with live DB

2026-07-04 14:01:33 -05:00

view-doc.php

Fix security issues from code review: remove plaintext password comment, enable TLS verification, harden booking ref entropy, fix XSS/injection in signature emails, fix broken waiver link, consolidate duplicated auth/file-serving logic, add missing document view links, sync schema.sql with live DB

2026-07-04 14:01:33 -05:00

waiver.php

Fix security issues from code review: remove plaintext password comment, enable TLS verification, harden booking ref entropy, fix XSS/injection in signature emails, fix broken waiver link, consolidate duplicated auth/file-serving logic, add missing document view links, sync schema.sql with live DB

2026-07-04 14:01:33 -05:00

S

Description

Mirror of github.com/myronblair/parkerslingshotrentals

187 KiB

Languages

PHP 70.1%

HTML 29.9%