Commit Graph

20 Commits

Author SHA1 Message Date
vk
0639c1a656 Fix all tests (vibe-kanban bba3e2c9)
Fixe alle tests. Frage mich, wenn du nicht weißt, was zu tun ist.
2026-02-11 23:15:49 +01:00
vk
90288ac20e [P0 Security] Mass Assignment Protection – $fillable für alle 18 Models (vibe-kanban 4a764a11)
## Security Audit: Mass Assignment Protection

### Problem
Alle 18 Eloquent Models verwenden `protected $guarded = [];` – das bedeutet **kein Schutz** gegen Mass Assignment. Ein Angreifer könnte über manipulierte Requests sensible Felder wie `accepted`, `sats_paid`, `association_status`, `paid` oder `created_by` direkt setzen.

### Betroffene Dateien und empfohlene Änderungen

Ersetze in **jedem** der folgenden Models `protected $guarded = [];` durch ein explizites `protected $fillable = [...]` Array. Hier die Analyse pro Model:

**Höchstes Risiko (Finanzen & Identity):**

1. **`app/Models/PaymentEvent.php`** – Finanz-kritisch!
   - Sensible Felder (NICHT fillable): `einundzwanzig_pleb_id`, `year`, `amount`, `event_id`, `paid`, `btc_pay_invoice`
   - `$fillable` sollte leer oder minimal sein – alle Felder werden programmatisch gesetzt

2. **`app/Models/EinundzwanzigPleb.php`**
   - Sensible Felder: `association_status`, `application_for`, `nip05_handle`
   - `$fillable = ['npub', 'pubkey', 'email', 'no_email', 'application_text', 'archived_application_text']`

3. **`app/Models/Vote.php`**
   - Sensible Felder: `einundzwanzig_pleb_id`, `project_proposal_id`, `value`
   - `$fillable = ['reason']` – alle anderen Felder müssen programmatisch gesetzt werden

4. **`app/Models/ProjectProposal.php`**
   - Sensible Felder: `einundzwanzig_pleb_id`, `accepted`, `sats_paid`, `slug`
   - `$fillable = ['name', 'support_in_sats', 'description', 'website']`

5. **`app/Models/Election.php`**
   - Sensible Felder: `year`, `candidates`, `end_time`
   - `$fillable` sollte leer sein – nur Admin-gesteuert

**Mittleres Risiko (mit `created_by` auto-fill in boot):**

6. **`app/Models/Venue.php`** – `$fillable = ['name']` (slug & created_by auto-generiert)
7. **`app/Models/MeetupEvent.php`** – `$fillable = ['start']` (meetup_id, created_by, attendees guarded)
8. **`app/Models/CourseEvent.php`** – `$fillable = ['from', 'to']` (course_id, venue_id, created_by guarded)
9. **`app/Models/Course.php`** – `$fillable = ['name', 'description']` (lecturer_id, created_by guarded)
10. **`app/Models/Meetup.php`** – `$fillable = ['name']` (city_id, created_by, slug, github_data, simplified_geojson guarded)
11. **`app/Models/Lecturer.php`** – `$fillable = ['name']` (active, created_by, slug guarded)
12. **`app/Models/City.php`** – `$fillable = ['name']` (country_id, created_by, slug, osm_relation, simplified_geojson guarded)

**Niedrigeres Risiko (Lookup/Reference-Daten):**

13. **`app/Models/Event.php`** – `$fillable = []` (alle Felder: event_id, parent_event_id, pubkey, json, type sind extern gesteuert)
14. **`app/Models/RenderedEvent.php`** – `$fillable = []` (event_id, html, profile_image, profile_name alle system-generiert)
15. **`app/Models/Profile.php`** – `$fillable = ['name', 'display_name', 'picture', 'banner', 'website', 'about']` (pubkey, deleted, nip05, lud16, lud06 guarded)
16. **`app/Models/Category.php`** – `$fillable = ['name']`
17. **`app/Models/Country.php`** – `$fillable = ['name']` (code, language_codes guarded)
18. **`app/Models/Notification.php`** – `$fillable = ['name', 'description']` (einundzwanzig_pleb_id, category guarded)

### Vorgehen
1. Jedes Model öffnen und `$guarded = []` durch das oben definierte `$fillable` Array ersetzen
2. Prüfen, ob bestehende `::create()` oder `::update()` Aufrufe noch funktionieren – ggf. müssen explizite Feld-Zuweisungen ergänzt werden
3. Für jedes geänderte Model einen Pest-Test schreiben, der verifiziert, dass Mass Assignment von sensiblen Feldern blockiert wird
4. `vendor/bin/pint --dirty` ausführen
5. Bestehende Tests laufen lassen: `php artisan test --compact`

### Akzeptanzkriterien
- Kein Model hat mehr `$guarded = []`
- Alle sensiblen Felder (status, paid, accepted, created_by, slug, IDs) sind NICHT in `$fillable`
- Bestehende Features funktionieren weiterhin (Tests grün)
- Neue Tests verifizieren Mass Assignment Protection
2026-02-11 21:13:36 +01:00
HolgerHatGarKeineNode
5b814d631b Add Security Monitoring System with Command, Model, and Service
- 🛡️ Introduce `SecurityMonitor` service for tampering and malicious activity detection.
- 🏷️ Add `SecurityAttempt` model and migration to log, categorize, and query security attempts.
- 🖥️ Create `SecurityAttemptsCommand` for filtering, statistics, and top IP analysis.
-  Add extensive tests to ensure the reliability of security monitoring and logging.
- 🔗 Integrate `SecurityMonitor` into the exception handling pipeline for real-time monitoring.
2026-02-04 13:40:30 +01:00
HolgerHatGarKeineNode
10dac9d02b 🔒 Implement signed media URLs and migrate media storage to private disk
-  Introduce `getSignedMediaUrl` in models for temporary signed URLs
- 🗂️ Migrate media collections to private disk for added security
- 🔧 Add `media:move-to-private` command to streamline migration
- ⚙️ Update views and components to use signed media URLs
- ✏️ Adjust route `media.signed` for signed file access handling
2026-01-25 19:14:49 +01:00
HolgerHatGarKeineNode
4fcbeb9ca6 📂 Add MIME type restrictions for 'main' media collection in ProjectProposal 2026-01-25 18:19:57 +01:00
HolgerHatGarKeineNode
34f8d949d5 Add NIP-05 handle management: Introduce migration, API route, and Livewire updates to support NIP-05 handle verification.
 Enhance Nostr fetcher: Refactor profile data merging logic for improved efficiency and accuracy.
🛠
2026-01-20 13:56:50 +01:00
HolgerHatGarKeineNode
a6c8fb6435 Refactor project-support forms: add admin-only fields, improve Flux form components, and enhance layout for consistency. 🛠️ Remove redundant NostrAuth methods and streamline authorization logic. 2026-01-20 00:49:28 +01:00
HolgerHatGarKeineNode
22d3e6aac1 🛠️ Add Eloquent factories for ProjectProposal and Election models, integrate HasFactory trait, and update tests with NostrAuth for authentication validation. 2026-01-18 22:33:35 +01:00
HolgerHatGarKeineNode
31fb04caaa 🗑️ Remove outdated migration files for einundzwanzig_plebs and pulse tables, restructure directory, and update testing suite with new factories and Livewire tests. 2026-01-18 22:23:23 +01:00
HolgerHatGarKeineNode
b090336c4f 🛠️ Refactor migrations, models, configs, and Blade files to apply consistent formatting, remove unnecessary lines, and improve readability. 2026-01-18 19:50:04 +01:00
fsociety
3055bfa196 🎨 feat(notification): add private disk for PDF uploads and update download route with signed URL. 2024-10-25 20:06:19 +02:00
fsociety
f600c7983c 🚀 feat(dependencies): add spatie/laravel-ciphersweet package for encryption support
 feat(profile): integrate email and fax fields in association profile

🆕 feat(migrations): create blind_indexes table for encrypted data

🔧 feat(model): implement CipherSweet in EinundzwanzigPleb for email encryption

🔧 config: add ciphersweet configuration file for encryption settings

🗄️ migration: add email field to einundzwanzig_plebs table for user data
2024-10-25 16:15:28 +02:00
fsociety
1bf8c66b35 🚀 feat(news): add news management with upload functionality and category selection in the association module 2024-10-25 15:02:23 +02:00
fsociety
ef1d0fdf17 🎨 feat(project): enhance project support form with image upload and validation features.
🗃️ refactor(project): rename project support route for clarity and consistency.
🗑️ chore(project): implement delete confirmation for project proposals in the index view.
🔧 fix(editor): adjust initialization delay for SimpleMDE editor to improve responsiveness.
📸 fix(media): update fallback image URL in ProjectProposal model for better asset management.
2024-10-24 18:05:37 +02:00
fsociety
c6b3593341 🚀 feat(project-support): add project proposal form and listing pages with image uploads and voting functionality 2024-10-23 18:10:14 +02:00
fsociety
0bdd890dd3 feat: add multiple payment events to user profile
- Added logic to handle multiple payment events in a user's profile
- Created a new PaymentEvent model and associated it with the EinundzwanzigPleb model
- Added a new migration for creating the payment_events table in the database
- Updated the profile.blade.php view to display all payment events for a user
2024-09-30 15:14:50 +02:00
fsociety
e76a60c600 close election 2024-09-29 16:51:35 +02:00
fsociety
354680f702 voting system with nostr added 2024-09-29 01:02:04 +02:00
fsociety
a0ef037b2d first copies from portal 2024-09-04 19:37:46 +02:00
fsociety
0769adfba3 Set up a fresh Laravel app 2024-08-29 13:36:49 +02:00