3 Commits

Author	SHA1	Message	Date
imre.agent	8a9d865edc	fix(mod_alworkshops): cast hidden_id to int to close SQL injection ... The workshop-application handler assigned $_POST['hidden_id'] straight into $app['user_id'], which is then concatenated unescaped into two SELECT statements (user_id=" . $app['user_id']). An attacker could inject SQL through the hidden_id POST field. user_id is a numeric key everywhere else in this same file (e.g. line 89 already uses (int)$_POST['user_id']); applying the same (int) cast closes the injection with no behaviour change. Assisted-by: claude-code@claude-opus-4-8	2026-07-22 11:02:59 +02:00
LAZAR Imre	a7dc9bcfab	chore: renormalize stored line endings to LF per .gitattributes	2026-07-21 18:46:11 +02:00
LÁZÁR Imre AI Agent	7012528980	feat(cadline): add Cadline-own modules ... 11 Cadline-only modules (mod_al_*, mod_alusers, mod_alworkshops, mod_course_list, mod_webinar*, mod_wsregister). Dropped webshells excluded (mod_al_upload/b8.php, mod_course_list/a1.php); legit module bases kept. Signed-off-by: LÁZÁR Imre <imre@illusion.hu> Assisted-by: claude-code@claude-opus-4-8	2026-07-16 11:34:30 +02:00