- Session cookies are HttpOnly + SameSite=Lax (Secure on HTTPS), with
strict session-ID mode; the CSRF token from GET api/auth.php must now
accompany every state-changing request (X-CSRF-Token header, or a csrf
body field for the sendBeacon progress save), rotated at login.
- Failed sign-ins are throttled per username and IP via login_attempts
(created lazily, so existing installs need no migration): 5 failures a
username / 20 an IP inside 15 minutes answer 429 with Retry-After.
- A video's sibling .srt now appears as a CC button in the player;
captions.php converts it to WebVTT (comma timestamps, legacy encodings,
and the already-VTT files with out-of-spec 6-digit fractions).
- Plyr and Inter ship in assets/vendor/ instead of coming from CDNs, and
anime.js is gone along with all scripted animations and the motion
setting — the app now runs with no internet access at all.
- .htaccess denies direct access to videos/, includes/, config.php and
schema.sql, so video URLs cannot bypass login on Apache.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SePf61iazhCLJBefdRLBDm
The boot guard reported every failed resource behind a full-screen
#boot-error panel. Cloudflare injects beacon.min.js at the edge, and ad
blockers and filtering DNS block it routinely, so a blocked analytics
script painted "CourseHub failed to start" over an app that had started
fine.
Mark the resources we actually ship with data-boot-critical and ignore
the rest, and stop showing the panel once app.js has a UI on screen —
that also keeps a late unhandled rejection (a dropped fetch in loadMeta,
a flaky scan) from covering a running app. A genuine failure of app.js
itself still reports as before.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TD5SRevPpgFguCwzNv9ZR7
A browser or CDN holding an assets/app.js from before the shell's element
IDs were renamed runs it against the newer index.php, where it grabs
btn-logout/btn-rescan/nav-user/nav-username/app — all now null — and throws
before it can unhide #app-shell. The result is a blank page whose only clue
is a TypeError in the console.
- index.php: asset() stamps local css/js with the file mtime, so a deploy is
a new URL and a stale copy can't be paired with a newer shell.
- index.php: install an error handler ahead of every other script (capture
phase, so failed resource loads are caught too) that paints uncaught
errors, rejections and load failures into a #boot-error panel. It works
even when app.js itself is what failed, which is this case.
- includes/db.php: add a register_shutdown_function fatal handler, since
set_exception_handler never sees parse errors, exhausted memory or a
failed require — those were ending requests with an empty body. Both
handlers flush partial output and answer in JSON; display_errors stays off
so a warning can't corrupt a JSON body.
- New optional DEBUG config flag adds exception type, file:line and trace to
those responses. config.php is gitignored, so installs without the setting
default to false.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014oyi9DMdhALrGz989MNNZJ
Scans nested course folders for mp4s, tracks per-user resume position
and per-folder progress. SPA frontend with hash routing over a JSON API;
range-request streaming via stream.php.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Harwinder Sekhon