Reported: on the session edit page, the photo preview rendered larger
than the rest of the form and overlapped the upload button below it.
Cause: transform:scale(zoom) only affects paint, not layout — the
preview's wrapper (.photo-preview-wrap, .novena-hero-photo-wrap) never
had overflow:hidden, so a zoomed-in crop visually spilled outside its
intended max-height/max-width box instead of being clipped to it. Cards
elsewhere were already fine (.rosary-card already has overflow:hidden).
Also: photo-crop.js/css had no cache-busting query string on any of their
three <script>/<link> tags, so a browser that loaded a page before this
feature's most recent update could easily keep serving a stale cached
copy indefinitely — added ?v=2 to force a refetch of this round's fix.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Every photo upload (session setup, novena group, Rosary Builder title
photo) gets shown two ways: full-size on the presentation cover slide
(unaffected, stays untouched), and cropped to a fixed box everywhere else
— home page cards, profile cards, the novena day-picker's circular hero
photo, and each admin form's own preview thumbnail. All of those crops
used to just take the image's dead center, with no way to control what
part of the photo that was — cropping out people's heads on portrait
photos.
- New sessions/novena_groups columns: photo_focal_x, photo_focal_y (0-100%),
photo_zoom (1-3x), defaulting to 50/50/1 — today's exact centered/
unzoomed behavior, so this is fully backward compatible until someone
actively repositions a photo.
- New assets/js/photo-crop.js: a reusable drag-to-pan + zoom modal editor.
The crop frame renders with the *exact* CSS recipe used at final render
time (object-position + transform:scale/transform-origin), so the editor
is a truthful live preview, not an approximation. A reference thumbnail
shows the full photo dimmed outside a rectangle marking the current crop.
All math reads actual rendered box dimensions rather than assuming fixed
pixel sizes, so it holds up responsively at any viewport width — caught
and fixed a real mismatch bug here by testing the widget standalone in a
browser before wiring it into any PHP form.
- New includes/photo.php: photo_crop_style() builds the inline style="..."
from a session/group row, used everywhere a crop is displayed.
- Wired into all three upload locations (admin/setup.php,
admin/novena_group.php, admin/builder.php) with a "Reposition" button,
and persisted through api/save_session.php, admin/novena_group.php's
save handler, and api/builder_session.php.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Six fixes from a codebase review:
- Consolidate the ad hoc install.php + migrate_v2..v6.php chain into one
canonical schema.sql (structure reference) plus a simplified install.php
that creates all tables and seeds site_settings, the superadmin account,
and the standard prayer library. The six migrate_v*.php scripts are
deleted — their cumulative effect is now fully captured in schema.sql.
- Delete the two root-level setup.php/novena_group.php files that existed
only to redirect to their admin/ equivalents of the same name; confirmed
unreferenced by any link or .htaccess rule.
- Decouple includes/build_slides.php from data/prayers.php's implicit
`global $opening, $mysteries, ...` contract. data/prayers.php now
explicitly returns its arrays; build_slides.php loads them through a
small memoized get_prayer_data() and destructures them by key.
- Add CSRF protection (includes/csrf.php: csrf_token/csrf_field/csrf_verify)
across every POST-handling endpoint — 10 form pages and 7 API endpoints —
plus token wiring in the JS/inline scripts that call the FormData- and
JSON-body API endpoints (builder.js, setup.js, and the inline scripts in
admin/audio.php, admin/novena_group.php, and index.php).
- Stop round-tripping the SMTP password in plaintext through the settings
form: the field now renders blank with a "currently set" hint, and a
blank submission leaves the stored password unchanged instead of
clearing it.
- Add login rate-limiting: users.failed_login_attempts / locked_until
columns, is_locked_out()/record_login_failure()/record_login_success()
helpers in includes/auth.php, and lockout handling in login.php (5
failed attempts locks the account for 15 minutes). README documents the
one manual ALTER TABLE needed to add these columns to an existing
production database.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Every admin page now shows the Builder link (superuser+) and
Prayers link (admin+) consistently in the header nav.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Full source for loveandrosary.com: slide-based Rosary/novena/Divine Mercy
Chaplet presentation tool with multi-user roles, SVG bead ring, audio uploads,
donate strip, and public session profiles.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
pguzman