- Session cookies are HttpOnly + SameSite=Lax (Secure on HTTPS), with
strict session-ID mode; the CSRF token from GET api/auth.php must now
accompany every state-changing request (X-CSRF-Token header, or a csrf
body field for the sendBeacon progress save), rotated at login.
- Failed sign-ins are throttled per username and IP via login_attempts
(created lazily, so existing installs need no migration): 5 failures a
username / 20 an IP inside 15 minutes answer 429 with Retry-After.
- A video's sibling .srt now appears as a CC button in the player;
captions.php converts it to WebVTT (comma timestamps, legacy encodings,
and the already-VTT files with out-of-spec 6-digit fractions).
- Plyr and Inter ship in assets/vendor/ instead of coming from CDNs, and
anime.js is gone along with all scripted animations and the motion
setting — the app now runs with no internet access at all.
- .htaccess denies direct access to videos/, includes/, config.php and
schema.sql, so video URLs cannot bypass login on Apache.
Claude-Session: https://claude.ai/code/session_01SePf61iazhCLJBefdRLBDm
The boot guard reported every failed resource behind a full-screen
#boot-error panel. Cloudflare injects beacon.min.js at the edge, and ad
blockers and filtering DNS block it routinely, so a blocked analytics
script painted "CourseHub failed to start" over an app that had started
fine.
Mark the resources we actually ship with data-boot-critical and ignore
the rest, and stop showing the panel once app.js has a UI on screen —
that also keeps a late unhandled rejection (a dropped fetch in loadMeta,
a flaky scan) from covering a running app. A genuine failure of app.js
itself still reports as before.
Claude-Session: https://claude.ai/code/session_01TD5SRevPpgFguCwzNv9ZR7
Course cards go back to the colour-block art that previously sat under the
captured frame, so the UI is unchanged apart from losing the photo.
- Drop thumb.php, generateThumbnails(), captureThumbnail() and
ensureThumbnailColumns(), plus the first-video tracking the scanner only
kept to pick a frame source.
- Drop the ffprobe fallback in probeDuration(); the pure-PHP mvhd parse is
now the only scan-time probe, with the player's report on first play as
the remaining fallback.
- Drop THUMBNAILS_DIR/THUMBNAIL_SEEK_PERCENT from config, the
thumbnail_* columns from schema.sql, the thumbnail counters from scan
output, .thumb img from the stylesheet, and the matching README parts.
Existing databases keep two now-unused folders.thumbnail_* columns; they
are inert and can be dropped by hand if wanted.
Claude-Session: https://claude.ai/code/session_014oyi9DMdhALrGz989MNNZJ
Scanner indexes quiz files found next to videos ([&] questions, "- "
options, "-- Correct" markers; _notsolved twins ignored). Quizzes appear
in the folder content list interleaved with videos by filename order.
New api/quiz.php serves questions without answers and grades attempts
server-side; per-user best/last score and attempts stored in
quiz_progress. Folder/course progress now aggregates videos + quizzes
with partial credit for partial scores.
Scans nested course folders for mp4s, tracks per-user resume position
and per-folder progress. SPA frontend with hash routing over a JSON API;
range-request streaming via stream.php.
Harwinder Sekhon