Thanakorn 8705be0d1b Enforce roles on admin endpoints and return real status codes ...

- users, SMTP and batch-lock endpoints are owner/admin only
- engines answer 400/403/404/409/500 instead of 200 with an error body;
  database errors no longer leak to the client

2026-09-24 14:53:40 +07:00

..

ac_dashboard

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

accounting

Enforce roles on admin endpoints and return real status codes

2026-09-24 14:53:40 +07:00

assets

Harden sign-in and password reset

2026-09-24 14:53:40 +07:00

contact

Enforce roles on admin endpoints and return real status codes

2026-09-24 14:53:40 +07:00

cron

Fix QA review findings: server-side validation, notes encoding, dashboard totals

2026-09-19 10:58:42 +07:00

dashboard

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

expense

Enforce roles on admin endpoints and return real status codes

2026-09-24 14:53:40 +07:00

finance

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

ics

Enforce roles on admin endpoints and return real status codes

2026-09-24 14:53:40 +07:00

inventory

Enforce roles on admin endpoints and return real status codes

2026-09-24 14:53:40 +07:00

journal

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

login

Harden sign-in and password reset

2026-09-24 14:53:40 +07:00

order

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

po

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

reports

Enforce roles on admin endpoints and return real status codes

2026-09-24 14:53:40 +07:00

revenue

Enforce roles on admin endpoints and return real status codes

2026-09-24 14:53:40 +07:00

setting

Enforce roles on admin endpoints and return real status codes

2026-09-24 14:53:40 +07:00

config.example.php

Harden web root, secrets and realtime auth

2026-09-24 14:53:40 +07:00

dbconn.php

Fix QA review findings: server-side validation, notes encoding, dashboard totals

2026-09-19 10:58:42 +07:00

file.php

Harden web root, secrets and realtime auth

2026-09-24 14:53:40 +07:00

include_ending.php

Harden web root, secrets and realtime auth

2026-09-24 14:53:40 +07:00

include_header.php

Fix timestamps, delete requests, invoice dates and GR quantities

2026-09-17 09:00:15 +07:00

include_master_sidebar.php

Seed Demo Data - Rebranding

2026-08-17 13:12:07 +07:00

include_setting_sidebar.php

Harden web root, secrets and realtime auth

2026-09-24 14:53:40 +07:00

include_sidebar_ac.php

Seed Demo Data - Rebranding

2026-08-17 13:12:07 +07:00

include_sidebar.php

Seed Demo Data - Rebranding

2026-08-17 13:12:07 +07:00

include_topbar.php

Harden web root, secrets and realtime auth

2026-09-24 14:53:40 +07:00

index.php

init wms

2026-02-19 14:48:40 +07:00

preset.php

JSON output

2026-05-13 16:41:28 +07:00

session.php

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00