pguzman/Rosary
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Consolidate schema, add CSRF protection, and add login rate-limiting

Browse Source 
Six fixes from a codebase review:

- Consolidate the ad hoc install.php + migrate_v2..v6.php chain into one
  canonical schema.sql (structure reference) plus a simplified install.php
  that creates all tables and seeds site_settings, the superadmin account,
  and the standard prayer library. The six migrate_v*.php scripts are
  deleted — their cumulative effect is now fully captured in schema.sql.

- Delete the two root-level setup.php/novena_group.php files that existed
  only to redirect to their admin/ equivalents of the same name; confirmed
  unreferenced by any link or .htaccess rule.

- Decouple includes/build_slides.php from data/prayers.php's implicit
  `global $opening, $mysteries, ...` contract. data/prayers.php now
  explicitly returns its arrays; build_slides.php loads them through a
  small memoized get_prayer_data() and destructures them by key.

- Add CSRF protection (includes/csrf.php: csrf_token/csrf_field/csrf_verify)
  across every POST-handling endpoint — 10 form pages and 7 API endpoints —
  plus token wiring in the JS/inline scripts that call the FormData- and
  JSON-body API endpoints (builder.js, setup.js, and the inline scripts in
  admin/audio.php, admin/novena_group.php, and index.php).

- Stop round-tripping the SMTP password in plaintext through the settings
  form: the field now renders blank with a "currently set" hint, and a
  blank submission leaves the stored password unchanged instead of
  clearing it.

- Add login rate-limiting: users.failed_login_attempts / locked_until
  columns, is_locked_out()/record_login_failure()/record_login_success()
  helpers in includes/auth.php, and lockout handling in login.php (5
  failed attempts locks the account for 15 minutes). README documents the
  one manual ALTER TABLE needed to add these columns to an existing
  production database.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Philip Guzman III
2026-09-15 09:34:10 -07:00
parent 8c047f5b28
commit 9622f9aeca
37 changed files with 459 additions and 767 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/audio.php
+4
View File
@@ -6,6 +6,7 @@
*/
require_once __DIR__ . '/../config/db.php';
require_once __DIR__ . '/../includes/auth.php';
require_once __DIR__ . '/../includes/csrf.php';
require_auth();
if (!has_role('admin')) {
@@ -182,6 +183,7 @@ foreach ($AUDIO_KEYS as $keys) {
padding:16px 20px; font-size:14px; color:#0c4a6e; margin-bottom:28px; }
.help-note strong { display:block; margin-bottom:6px; }
</style>
<meta name="csrf-token" content="<?= htmlspecialchars(csrf_token()) ?>">
<script>var BASE_URL = '<?= BASE_URL ?>';</script>
</head>
<body>
@@ -341,6 +343,7 @@ foreach ($AUDIO_KEYS as $keys) {
var fd = new FormData();
fd.append('key', key);
fd.append('audio', file);
fd.append('csrf_token', document.querySelector('meta[name="csrf-token"]').content);
fetch(BASE_URL + '/api/upload_audio.php', { method: 'POST', body: fd })
.then(function (r) { return r.json(); })
@@ -365,6 +368,7 @@ foreach ($AUDIO_KEYS as $keys) {
var fd = new FormData();
fd.append('key', key);
fd.append('csrf_token', document.querySelector('meta[name="csrf-token"]').content);
fetch(BASE_URL + '/api/delete_audio.php', { method: 'POST', body: fd })
.then(function (r) { return r.json(); })
admin/builder.php
+2
View File
@@ -6,6 +6,7 @@
*/
require_once __DIR__ . '/../config/db.php';
require_once __DIR__ . '/../includes/auth.php';
require_once __DIR__ . '/../includes/csrf.php';
require_role('superuser');
@@ -72,6 +73,7 @@ $page_title = $session ? 'Edit: ' . htmlspecialchars($session['name']) : 'Rosary
<title><?= $page_title ?> — <?= htmlspecialchars($site_name) ?></title>
<link rel="stylesheet" href="<?= BASE_URL ?>/assets/css/setup.css">
<link rel="stylesheet" href="<?= BASE_URL ?>/assets/css/builder.css?v=1">
<meta name="csrf-token" content="<?= htmlspecialchars(csrf_token()) ?>">
</head>
<body>
admin/index.php
+4
View File
@@ -4,6 +4,7 @@
*/
require_once __DIR__ . '/../config/db.php';
require_once __DIR__ . '/../includes/auth.php';
require_once __DIR__ . '/../includes/csrf.php';
require_auth();
@@ -15,6 +16,7 @@ $site_name = get_setting('site_name', APP_NAME);
// Handle deletions
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
csrf_verify();
if (isset($_POST['delete_group_id'])) {
$gid = (int)$_POST['delete_group_id'];
// Verify ownership or admin
@@ -200,6 +202,7 @@ $novena_created = isset($_GET['novena_created']) ? (int)$_GET['novena_created']
<?php if ($is_admin || (int)$row['user_id'] === $uid): ?>
<form method="post" style="display:inline"
onsubmit="return confirm('Delete this entire novena (all 9 days)?')">
<?= csrf_field() ?>
<input type="hidden" name="delete_group_id" value="<?= $row['id'] ?>">
<button type="submit" class="btn btn-sm btn-danger">Delete</button>
</form>
@@ -241,6 +244,7 @@ $novena_created = isset($_GET['novena_created']) ? (int)$_GET['novena_created']
class="btn btn-sm btn-secondary">Edit</a>
<form method="post" style="display:inline"
onsubmit="return confirm('Delete this session?')">
<?= csrf_field() ?>
<input type="hidden" name="delete_id" value="<?= $row['id'] ?>">
<button type="submit" class="btn btn-sm btn-danger">Delete</button>
</form>
admin/novena_group.php
+7
View File
@@ -4,6 +4,7 @@
*/
require_once __DIR__ . '/../config/db.php';
require_once __DIR__ . '/../includes/auth.php';
require_once __DIR__ . '/../includes/csrf.php';
require_auth();
@@ -38,6 +39,7 @@ $is_dm = ($group['mystery_set'] === 'chaplet');
// Handle delete of a single day session
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['delete_day_id'])) {
csrf_verify();
$did = (int)$_POST['delete_day_id'];
$pdo->prepare('DELETE FROM sessions WHERE id = ? AND novena_group_id = ?')->execute([$did, $gid]);
@@ -56,6 +58,7 @@ $save_error = '';
$save_success = false;
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['save_group'])) {
csrf_verify();
$g_name = trim($_POST['g_name'] ?? '');
$g_photo = trim($_POST['g_photo'] ?? '') ?: null;
$g_public = isset($_POST['is_public']) ? 1 : 0;
@@ -128,6 +131,7 @@ $mystery_labels = [
<link rel="icon" type="image/svg+xml" href="<?= BASE_URL ?>/favicon.svg">
<title><?= htmlspecialchars($group['name']) ?> — <?= htmlspecialchars($site_name) ?></title>
<link rel="stylesheet" href="<?= BASE_URL ?>/assets/css/setup.css">
<meta name="csrf-token" content="<?= htmlspecialchars(csrf_token()) ?>">
<script>var BASE_URL = '<?= BASE_URL ?>';</script>
</head>
<body>
@@ -172,6 +176,7 @@ $mystery_labels = [
<section class="card" style="margin-bottom:32px">
<h2 class="card-title">Novena Details</h2>
<form method="post">
<?= csrf_field() ?>
<input type="hidden" name="save_group" value="1">
<div class="form-grid">
@@ -289,6 +294,7 @@ $mystery_labels = [
class="btn btn-sm btn-primary">Present</a>
<form method="post" style="display:inline"
onsubmit="return confirm('Delete Day <?= $d ?>?')">
<?= csrf_field() ?>
<input type="hidden" name="delete_day_id" value="<?= $ses['id'] ?>">
<button type="submit" class="btn btn-sm btn-danger">Delete</button>
</form>
@@ -320,6 +326,7 @@ $mystery_labels = [
if (!file) return;
var fd = new FormData();
fd.append('photo', file);
fd.append('csrf_token', document.querySelector('meta[name="csrf-token"]').content);
photoStatus.textContent = 'Uploading\u2026';
fetch(BASE_URL + '/api/upload_photo.php', { method: 'POST', body: fd })
admin/prayers.php
+5
View File
@@ -5,6 +5,7 @@
*/
require_once __DIR__ . '/../config/db.php';
require_once __DIR__ . '/../includes/auth.php';
require_once __DIR__ . '/../includes/csrf.php';
require_role('admin');
@@ -18,6 +19,7 @@ $msg = '';
$msg_type = 'success';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
csrf_verify();
$action = $_POST['action'] ?? '';
if ($action === 'delete') {
@@ -185,6 +187,7 @@ $filter = $_GET['filter'] ?? 'all';
<?php if (!$is_standard): ?>
<?php if ($p['is_global']): ?>
<form method="post" class="action-form">
<?= csrf_field() ?>
<input type="hidden" name="action" value="toggle_global">
<input type="hidden" name="prayer_id" value="<?= $p['id'] ?>">
<input type="hidden" name="new_global" value="0">
@@ -192,6 +195,7 @@ $filter = $_GET['filter'] ?? 'all';
</form>
<?php else: ?>
<form method="post" class="action-form">
<?= csrf_field() ?>
<input type="hidden" name="action" value="toggle_global">
<input type="hidden" name="prayer_id" value="<?= $p['id'] ?>">
<input type="hidden" name="new_global" value="1">
@@ -201,6 +205,7 @@ $filter = $_GET['filter'] ?? 'all';
<?php if ($p['use_count'] == 0): ?>
<form method="post" class="action-form"
onsubmit="return confirm('Delete &quot;<?= htmlspecialchars(addslashes($p['name'])) ?>&quot;?')">
<?= csrf_field() ?>
<input type="hidden" name="action" value="delete">
<input type="hidden" name="prayer_id" value="<?= $p['id'] ?>">
<button class="btn btn-sm btn-danger">Delete</button>
admin/profile.php
+6
View File
@@ -4,6 +4,7 @@
*/
require_once __DIR__ . '/../config/db.php';
require_once __DIR__ . '/../includes/auth.php';
require_once __DIR__ . '/../includes/csrf.php';
require_auth();
@@ -31,6 +32,7 @@ if (!$profile) {
// ── Handle form submissions ───────────────────────────────────────────────────
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
csrf_verify();
$action = $_POST['action'] ?? '';
// ── Update profile ───────────────────────────────────────────────────────
@@ -179,6 +181,7 @@ $role_labels = ['superadmin'=>'Superadmin','admin'=>'Admin','superuser'=>'Superu
<div class="profile-section">
<h3>Display Name</h3>
<form method="post">
<?= csrf_field() ?>
<input type="hidden" name="action" value="update_profile">
<div class="form-group">
<label for="display_name">Display Name</label>
@@ -195,6 +198,7 @@ $role_labels = ['superadmin'=>'Superadmin','admin'=>'Admin','superuser'=>'Superu
<div class="profile-section">
<h3>Email Address</h3>
<form method="post">
<?= csrf_field() ?>
<input type="hidden" name="action" value="update_email">
<div class="form-group">
<label>Current Email</label>
@@ -216,6 +220,7 @@ $role_labels = ['superadmin'=>'Superadmin','admin'=>'Admin','superuser'=>'Superu
<div class="profile-section">
<h3>Change Password</h3>
<form method="post">
<?= csrf_field() ?>
<input type="hidden" name="action" value="change_password">
<div class="form-group">
<label for="cur_pass">Current Password</label>
@@ -239,6 +244,7 @@ $role_labels = ['superadmin'=>'Superadmin','admin'=>'Admin','superuser'=>'Superu
<div class="profile-section" id="limit-section">
<h3>Rosary Limit</h3>
<form method="post">
<?= csrf_field() ?>
<input type="hidden" name="action" value="update_limit">
<div class="form-group">
<label for="rosary_limit">Limit (-1 = unlimited)</label>
admin/settings.php
+16 -3
View File
@@ -5,6 +5,7 @@
require_once __DIR__ . '/../config/db.php';
require_once __DIR__ . '/../includes/auth.php';
require_once __DIR__ . '/../includes/mailer.php';
require_once __DIR__ . '/../includes/csrf.php';
require_role('superadmin');
@@ -15,16 +16,23 @@ $error = '';
// Save settings
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
csrf_verify();
$action = $_POST['action'] ?? 'save';
if ($action === 'save') {
$keys = ['site_name','site_url','smtp_host','smtp_port','smtp_user','smtp_pass','smtp_from','smtp_from_name',
// smtp_pass is handled separately: the form always renders it blank
// (see below), so a blank submission means "leave it unchanged",
// not "clear it".
$keys = ['site_name','site_url','smtp_host','smtp_port','smtp_user','smtp_from','smtp_from_name',
'donate_enabled','donate_type','donate_handle','donate_label'];
foreach ($keys as $k) {
if (isset($_POST[$k])) {
set_setting($k, trim($_POST[$k]));
}
}
if (!empty($_POST['smtp_pass'])) {
set_setting('smtp_pass', trim($_POST['smtp_pass']));
}
$message = 'Settings saved.';
$site_name = get_setting('site_name', APP_NAME); // refresh
}
@@ -53,7 +61,7 @@ $settings = [
'smtp_host' => get_setting('smtp_host'),
'smtp_port' => get_setting('smtp_port', '587'),
'smtp_user' => get_setting('smtp_user'),
'smtp_pass' => get_setting('smtp_pass'),
'smtp_pass_set' => get_setting('smtp_pass') !== '',
'smtp_from' => get_setting('smtp_from'),
'smtp_from_name' => get_setting('smtp_from_name', 'Rosary Presenter'),
'donate_enabled' => get_setting('donate_enabled', '0'),
@@ -105,6 +113,7 @@ $settings = [
<h2 style="margin-bottom:24px">Site Settings</h2>
<form method="post">
<?= csrf_field() ?>
<input type="hidden" name="action" value="save">
<div class="settings-section">
@@ -155,9 +164,12 @@ $settings = [
<div class="pass-wrap">
<input type="password" id="smtp_pass" name="smtp_pass"
autocomplete="new-password"
value="<?= htmlspecialchars($settings['smtp_pass']) ?>">
placeholder="<?= $settings['smtp_pass_set'] ? '•••••••• (leave blank to keep current)' : '' ?>">
<button type="button" class="pass-toggle" onclick="togglePass()">Show</button>
</div>
<p class="help-text">
<?= $settings['smtp_pass_set'] ? '&#x2713; A password is currently set. Leave blank to keep it.' : 'No password set.' ?>
</p>
</div>
<div class="form-group">
<label for="smtp_from">From Email</label>
@@ -223,6 +235,7 @@ $settings = [
<h3>Test Email</h3>
<p class="help-text">Send a test email to <strong><?= htmlspecialchars($user['email']) ?></strong> to verify your SMTP settings.</p>
<form method="post">
<?= csrf_field() ?>
<input type="hidden" name="action" value="test_email">
<button type="submit" class="btn btn-secondary">Send Test Email</button>
</form>
admin/setup.php
+3
View File
@@ -4,6 +4,7 @@
*/
require_once __DIR__ . '/../config/db.php';
require_once __DIR__ . '/../includes/auth.php';
require_once __DIR__ . '/../includes/csrf.php';
require_auth();
@@ -46,6 +47,7 @@ $page_title = $session ? 'Edit Session' : 'New Session';
<link rel="icon" type="image/svg+xml" href="<?= BASE_URL ?>/favicon.svg">
<title><?= $page_title ?> — <?= htmlspecialchars($site_name) ?></title>
<link rel="stylesheet" href="<?= BASE_URL ?>/assets/css/setup.css">
<meta name="csrf-token" content="<?= htmlspecialchars(csrf_token()) ?>">
<script>var BASE_URL = '<?= BASE_URL ?>';</script>
</head>
<body>
@@ -80,6 +82,7 @@ $page_title = $session ? 'Edit Session' : 'New Session';
<div id="form-message" class="alert" style="display:none"></div>
<form id="session-form" novalidate>
<?= csrf_field() ?>
<?php if ($session): ?>
<input type="hidden" name="id" value="<?= (int)$session['id'] ?>">
<?php endif; ?>
admin/users.php
+7
View File
@@ -5,6 +5,7 @@
require_once __DIR__ . '/../config/db.php';
require_once __DIR__ . '/../includes/auth.php';
require_once __DIR__ . '/../includes/mailer.php';
require_once __DIR__ . '/../includes/csrf.php';
require_role('admin');
@@ -18,6 +19,7 @@ $errors = [];
// ── Handle actions ───────────────────────────────────────────────────────────
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
csrf_verify();
$action = $_POST['action'] ?? '';
// ── Create user ──────────────────────────────────────────────────────────
@@ -250,6 +252,7 @@ $role_colors = [
<div class="create-panel" id="create-panel">
<h3 style="margin:0 0 16px">Create New User</h3>
<form method="post">
<?= csrf_field() ?>
<input type="hidden" name="action" value="create_user">
<div class="mini-form">
<div class="form-group">
@@ -331,6 +334,7 @@ $role_colors = [
<?php endif; ?>
<?php if (!$u['email_confirmed']): ?>
<form method="post" style="display:inline">
<?= csrf_field() ?>
<input type="hidden" name="action" value="resend_confirmation">
<input type="hidden" name="target_id" value="<?= $u['id'] ?>">
<button type="submit" class="btn btn-sm"
@@ -343,6 +347,7 @@ $role_colors = [
<?php if ((int)$u['id'] !== $uid && ($is_super || $u['role'] !== 'superadmin')): ?>
<form method="post" style="display:inline"
onsubmit="return confirm('Delete user <?= htmlspecialchars(addslashes($u['username'])) ?>? Their sessions will remain.')">
<?= csrf_field() ?>
<input type="hidden" name="action" value="delete_user">
<input type="hidden" name="target_id" value="<?= $u['id'] ?>">
<button type="submit" class="btn btn-sm btn-danger">Delete</button>
@@ -352,6 +357,7 @@ $role_colors = [
<!-- Edit Panel -->
<div class="edit-panel" id="edit-<?= $u['id'] ?>">
<form method="post" style="margin-bottom:16px">
<?= csrf_field() ?>
<input type="hidden" name="action" value="update_user">
<input type="hidden" name="target_id" value="<?= $u['id'] ?>">
<div class="mini-form">
@@ -388,6 +394,7 @@ $role_colors = [
</form>
<form method="post">
<?= csrf_field() ?>
<input type="hidden" name="action" value="reset_password">
<input type="hidden" name="target_id" value="<?= $u['id'] ?>">
<div class="mini-form">