myron

myron synced commits to refs/heads/main at myron/tomsjavajive from mirror 2026-07-06 04:31:10 -05:00

f84a754370 Fix critical unauthenticated order tampering/IDOR in api/orders.php and reused named-param bug in admin order search

myron synced commits to refs/heads/main at myron/tomtomgames from mirror 2026-07-06 04:30:11 -05:00

abe49a77fa Fix stored XSS in admin gamer overview (unescaped username/alias/email) and undefined-variable logging bug in purchase.php

myron synced commits to refs/heads/main at myron/epictravelexpeditions from mirror 2026-07-06 04:30:11 -05:00

6c7344ec52 Relocate config.php with plaintext secrets outside the webroot; add per-IP rate limiting to the unauthenticated testimonial image upload endpoint

myron synced commits to refs/heads/master at myron/jarvis from mirror 2026-07-05 21:00:09 -05:00

10350cbcd8 Update infrastructure reference: document 2026-07-06 security review and fixes

24bc876c1d Fix code review findings: unauthenticated infra doc + backup file exposure, onclick-attribute XSS breakouts (admin panel and front-end), plaintext calendar passwords, k()->j() typo, wildcard CORS, session cookie hardening (HttpOnly/SameSite)

cfb5b2a3f9 Document ChuckCo Time Keeper code review fixes and admin login rate limiting

0b1a19d9de Update infrastructure reference: fix stale JARVIS port, rotate GitHub PAT reference, add ChuckCo Time Keeper site, FortiGate DNS change, git/repo management section

Compare 4 commits »

myron synced commits to refs/heads/main at myron/web-dashboard from mirror 2026-07-05 20:20:00 -05:00

4c2a640d38 Remove Infrastructure Reference download link (file relocated off public webroot after security review found it was exposed with no auth)

d9b4f0fcb5 Add ChuckCo Time Keeper admin and all-workers links to Websites card

Compare 2 commits »

myron synced commits to refs/heads/main at myron/parkerslingshotrentals from mirror 2026-07-05 14:30:04 -05:00

3bf7fe7620 Move db.php secrets out of webroot; switch to universal Square account

myron synced commits to refs/heads/main at myron/tomtomgames from mirror 2026-07-05 12:10:52 -05:00

674ec71682 Add in-admin refund processing for Square token purchases; commit earlier pending security fixes

myron synced and deleted reference refs/heads/square-migration at myron/tomsjavajive from mirror 2026-07-05 12:10:37 -05:00

myron synced commits to refs/heads/main at myron/tomsjavajive from mirror 2026-07-05 12:10:37 -05:00

3c8e4d1dbc Add in-admin refund processing via Square RefundPayment API

bdd0bd6afa Require admin auth on api/search-customers.php

9771d53b19 Show wallet/gift card discount line on order confirmation page

e02436618c Merge square-migration: Stripe to Square payment processor migration, checkout wallet/gift-card redemption, and related bug fixes

cfbae6e945 Fix duplicate PDO named parameter in api/search-customers.php

Compare 7 commits »

myron synced commits to refs/heads/main at myron/fusionpbx-config from mirror 2026-07-05 12:10:19 -05:00

e44925d828 [fusion] Weekly backup 2026-07-05 — 2 files changed, 2 insertions(+), 2 deletions(-)

myron synced commits to refs/heads/main at myron/proxmox-config from mirror 2026-07-05 10:20:00 -05:00

0bf6bda39e [pve] Weekly backup 2026-07-05 — 20 files changed, 228 insertions(+), 71 deletions(-)

myron synced commits to refs/heads/main at myron/do-server-config from mirror 2026-07-05 04:00:50 -05:00

5fda5a1536 [orbis] Weekly backup 2026-07-05 — 3 files changed, 15 insertions(+), 8 deletions(-)

myron synced commits to refs/heads/main at myron/tomsjavajive from mirror 2026-07-05 04:00:34 -05:00

a0b8bf2a09 security: remove stray !install!! deploy folder, block .py files, move secrets out of webroot

myron synced new reference refs/heads/square-migration to myron/tomsjavajive from mirror 2026-07-05 04:00:34 -05:00

myron synced commits to refs/heads/square-migration at myron/tomsjavajive from mirror 2026-07-05 04:00:34 -05:00

myron synced commits to refs/heads/main at myron/parkerslingshotrentals from mirror 2026-07-04 22:10:06 -05:00

ffebe87210 Block public access to .git directory (leaked GitHub PAT, same issue found on sibling sites)

myron synced commits to refs/heads/main at myron/epictravelexpeditions from mirror 2026-07-04 19:51:18 -05:00

982a5dc5ff Harden .git/db block: use REQUEST_URI matching, direct RewriteRule patterns not reliably honored

0dfcfa2f7e Fix security gaps and dead code found in codebase review

Compare 2 commits »

myron synced commits to refs/heads/main at myron/orbishosting from mirror 2026-07-04 19:50:54 -05:00

013b878b87 security: block public access to .git, legacy, dist, extensions, config dirs

myron synced commits to refs/heads/main at myron/tomsjavajive from mirror 2026-07-04 19:50:36 -05:00

a4ebf26a48 Harden .git/config/includes/db block: RedirectMatch not honored, use mod_rewrite REQUEST_URI matching

186ac0cb6d security: fix unauthenticated file upload/RCE risk, TLS bypass, XSS, and broken gift-card/review columns

Compare 2 commits »

myron synced commits to refs/heads/main at myron/orbis-hosting-portal from mirror 2026-07-04 19:50:22 -05:00

ea58754e62 Fix .git block: RedirectMatch/FilesMatch are not honored on this LiteSpeed vhost, use mod_rewrite instead

8ad58278d0 Block public access to .git directory (leaked live GitHub PAT)

Compare 2 commits »