register.php was a fully open signup form with no bot defenses — the
likely source of the unconfirmed accounts piling up in admin/users.php.
- Add an always-on honeypot field + timing trap to register.php: either
tripping silently pretends success without creating an account, so a
bot doesn't learn it was caught. No configuration needed.
- Add optional Google reCAPTCHA v3 support (includes/recaptcha.php,
recaptcha_enabled()/verify_recaptcha(), no Composer dependency — a
raw file_get_contents() POST like mailer.php's SMTP socket approach).
A failed check here shows a real, visible error instead of the silent
honeypot path, since a legitimate low-score user deserves a retry.
- Configure it through admin/settings.php's new "Bot Protection" section,
mirroring the existing SMTP pattern exactly: recaptcha_enabled/
recaptcha_site_key/recaptcha_secret_key in site_settings, secret key
masked the same way smtp_pass now is (blank submission keeps it
unchanged). install.php seeds sane defaults so the feature stays off
until explicitly configured — fully backward compatible.
- Add cron/cleanup_unconfirmed.php: deletes accounts still unconfirmed
after 3 days. CLI-only (refuses to run over HTTP, and cron/.htaccess
denies web access to the directory as a second layer) since it's an
unattended, irreversible deletion. Safe by construction — login.php
already refuses login to unconfirmed accounts, so these rows can never
own a session/novena_group/custom_prayer row. Not wired up
automatically; README documents the Hostinger cron job to schedule it.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Six fixes from a codebase review:
- Consolidate the ad hoc install.php + migrate_v2..v6.php chain into one
canonical schema.sql (structure reference) plus a simplified install.php
that creates all tables and seeds site_settings, the superadmin account,
and the standard prayer library. The six migrate_v*.php scripts are
deleted — their cumulative effect is now fully captured in schema.sql.
- Delete the two root-level setup.php/novena_group.php files that existed
only to redirect to their admin/ equivalents of the same name; confirmed
unreferenced by any link or .htaccess rule.
- Decouple includes/build_slides.php from data/prayers.php's implicit
`global $opening, $mysteries, ...` contract. data/prayers.php now
explicitly returns its arrays; build_slides.php loads them through a
small memoized get_prayer_data() and destructures them by key.
- Add CSRF protection (includes/csrf.php: csrf_token/csrf_field/csrf_verify)
across every POST-handling endpoint — 10 form pages and 7 API endpoints —
plus token wiring in the JS/inline scripts that call the FormData- and
JSON-body API endpoints (builder.js, setup.js, and the inline scripts in
admin/audio.php, admin/novena_group.php, and index.php).
- Stop round-tripping the SMTP password in plaintext through the settings
form: the field now renders blank with a "currently set" hint, and a
blank submission leaves the stored password unchanged instead of
clearing it.
- Add login rate-limiting: users.failed_login_attempts / locked_until
columns, is_locked_out()/record_login_failure()/record_login_success()
helpers in includes/auth.php, and lockout handling in login.php (5
failed attempts locks the account for 15 minutes). README documents the
one manual ALTER TABLE needed to add these columns to an existing
production database.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Each prayer in the library has an optional default_bead_type (small/large/
crucifix). Standard prayers get sensible defaults: Our Father=large,
Hail Mary=small, Sign of Cross=crucifix, Divine Mercy beads accordingly.
In the sequence, each step card shows a bead selector (—/○/●/✝) so users
can override the default per step. Adding a prayer pre-fills its default.
Bead library icon hints (○●✝) appear on prayer cards in the library.
Modal now includes a Bead selector for creating/editing prayers.
Remove the separate Bead Markers library section — beads live on prayers.
build_slides: prayer steps with bead_type now get a real bead_index so
the ring advances correctly during presentation.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Bead Markers section in library panel with Small, Large, Crucifix cards
- Bead steps render as amber-tinted cards in the sequence (no attribution)
- migrate_v5.php: adds step_type/bead_type columns, makes prayer_id nullable
- Bead steps produce slides with proper bead+bead_index so the ring advances
during presentation — allows participants to follow along on physical beads
- Prayer steps between beads still show bead_index=null (ring stays on last bead)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace hidden attribute + [hidden] CSS selector with a .modal-open
class toggle. The hidden attribute approach was unreliable because
CSS display:flex was winning the specificity battle. Class-based
show/hide is explicit and not subject to attribute/cascade conflicts.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Layout: replace admin-container wrapper with #builder-page flex column;
add min-height:0 to builder-wrap, builder-body, both panels so the
inner scroll areas actually shrink correctly in a flex column.
Loading...: scripts at end of body mean DOMContentLoaded may have
already fired by the time the listener is registered. Check
document.readyState first and call init() directly if DOM is ready.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Every admin page now shows the Builder link (superuser+) and
Prayers link (admin+) consistently in the header nav.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Superuser+ can now build a custom prayer sequence from scratch:
- Two-panel builder UI: step sequence (left) + searchable prayer library (right)
- 16 standard prayers seeded globally; users can create private custom prayers
- Admin can promote private prayers to global and manage the library
- Four attribution modes per step: Leader/All, Leader only, All together, None
- Optional subject name/pronoun for variable substitution in prayers
- Custom sessions fully presented via the existing presenter (auto-split works)
- migrate_v4.php creates custom_prayers + builder_steps tables
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Full source for loveandrosary.com: slide-based Rosary/novena/Divine Mercy
Chaplet presentation tool with multi-user roles, SVG bead ring, audio uploads,
donate strip, and public session profiles.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
pguzman