Harwinder Sekhon
e3a054e109
- Session cookies are HttpOnly + SameSite=Lax (Secure on HTTPS), with strict session-ID mode; the CSRF token from GET api/auth.php must now accompany every state-changing request (X-CSRF-Token header, or a csrf body field for the sendBeacon progress save), rotated at login. - Failed sign-ins are throttled per username and IP via login_attempts (created lazily, so existing installs need no migration): 5 failures a username / 20 an IP inside 15 minutes answer 429 with Retry-After. - A video's sibling .srt now appears as a CC button in the player; captions.php converts it to WebVTT (comma timestamps, legacy encodings, and the already-VTT files with out-of-spec 6-digit fractions). - Plyr and Inter ship in assets/vendor/ instead of coming from CDNs, and anime.js is gone along with all scripted animations and the motion setting — the app now runs with no internet access at all. - .htaccess denies direct access to videos/, includes/, config.php and schema.sql, so video URLs cannot bypass login on Apache. Claude-Session: https://claude.ai/code/session_01SePf61iazhCLJBefdRLBDm
45 lines
3.5 KiB
Plaintext
45 lines
3.5 KiB
Plaintext
{
|
|
"permissions": {
|
|
"allow": [
|
|
"Read(//usr/bin/**)",
|
|
"Bash(mysql --version)",
|
|
"Bash(mysql -h127.0.0.1 -ucoursehub -pcoursehub coursehub -e \"SELECT \\(SELECT COUNT\\(*\\) FROM users\\) users, \\(SELECT COUNT\\(*\\) FROM folders\\) folders, \\(SELECT COUNT\\(*\\) FROM videos\\) videos, \\(SELECT COUNT\\(*\\) FROM quizzes\\) quizzes, \\(SELECT COUNT\\(*\\) FROM video_progress\\) vp, \\(SELECT COUNT\\(*\\) FROM quiz_progress\\) qp;\")",
|
|
"Bash(python3 *)",
|
|
"Bash(mysql -N -h127.0.0.1 -ucoursehub -pcoursehub coursehub -e \"SELECT id FROM users WHERE username='claude_ui'\")",
|
|
"Bash(mysql -h127.0.0.1 -ucoursehub -pcoursehub coursehub -e 'UPDATE video_progress SET position_seconds=6 WHERE user_id=__TRACKED_VAR__ AND video_id=27')",
|
|
"Bash(curl -s -b jar2.txt __TRACKED_VAR__/api/library.php?view=home)",
|
|
"Bash(mysql -h127.0.0.1 -ucoursehub -pcoursehub coursehub -e \"DELETE FROM users WHERE username='claude_ui';\")",
|
|
"Bash(pkill -f \"php -S 127.0.0.1:8199\")",
|
|
"Bash(mysql -h127.0.0.1 -ucoursehub -pcoursehub coursehub -e \"SELECT u.username, \\(SELECT COUNT\\(*\\) FROM video_progress vp WHERE vp.user_id=u.id\\) vp, \\(SELECT COUNT\\(*\\) FROM quiz_progress qp WHERE qp.user_id=u.id\\) qp FROM users u; SELECT k, v FROM app_meta;\")",
|
|
"Bash(mysql -h127.0.0.1 -ucoursehub -pcoursehub coursehub -e \"SELECT u.username, \\(SELECT COUNT\\(*\\) FROM video_progress vp WHERE vp.user_id=u.id\\) vp, \\(SELECT COUNT\\(*\\) FROM quiz_progress qp WHERE qp.user_id=u.id\\) qp FROM users u;\")",
|
|
"Bash(mysql -h127.0.0.1 -ucoursehub -pcoursehub coursehub -e \"SELECT k, v FROM app_meta;\")",
|
|
"Bash(ps -o pid,args -p 36288)",
|
|
"Bash(/home/harwinder/.local/lib/python3.12/site-packages/nodejs/bin/node --check assets/app.js)",
|
|
"Bash(awk '/^:root/,/^}/{next} /#[0-9A-Fa-f]{6}/{print NR\": \"$0}' assets/style.css)",
|
|
"Bash(mysql -h127.0.0.1 -ucoursehub -pcoursehub coursehub -e \"DELETE FROM users WHERE username='claude_colors';\")",
|
|
"Bash(cd *)",
|
|
"Bash(ffprobe -v error -show_entries format=duration -of csv=p=0 \"videos/Core_MPLS/01_Course/01_Core_MPLS/01_Core_MPLS_Switching_Part_1.mp4\")",
|
|
"Bash(mysql -h127.0.0.1 -ucoursehub -pcoursehub coursehub -e \"SELECT id,parent_id,name,path,depth FROM folders WHERE parent_id IS NULL;\")",
|
|
"Bash(mysql -h127.0.0.1 -ucoursehub -pcoursehub coursehub -e \"SHOW COLUMNS FROM folders;\")",
|
|
"Bash(mysql -h127.0.0.1 -ucoursehub -pcoursehub coursehub -e \"SELECT id, username FROM users;\")",
|
|
"Bash(mysql -h127.0.0.1 -ucoursehub -pcoursehub coursehub -e \"SHOW COLUMNS FROM folders LIKE 'thumbnail%';\")",
|
|
"Bash(php -r ' *)",
|
|
"Read(//tmp/**)",
|
|
"Bash(php -l index.php)",
|
|
"Bash(curl *)",
|
|
"Bash(php -l includes/functions.php)",
|
|
"Bash(node --check assets/app.js)",
|
|
"Bash(command -v deno bun qjs js d8)",
|
|
"Bash(git push *)",
|
|
"Bash(file assets/vendor/*.woff2 assets/vendor/plyr.svg)",
|
|
"Bash(gjs assets/app.js)",
|
|
"Bash(php -S 127.0.0.1:8099 -t /home/harwinder/Development/coursehub)",
|
|
"Bash(mysql -ucoursehub -pcoursehub coursehub -e \"SELECT id, duration_seconds FROM videos WHERE id=61; SELECT COUNT\\(*\\) AS attempts FROM login_attempts; SELECT id, username FROM users WHERE username='claude_smoketest';\")",
|
|
"Bash(mysql -ucoursehub -pcoursehub coursehub -e \"DELETE FROM users WHERE username='claude_smoketest'; DELETE FROM login_attempts; SELECT COUNT\\(*\\) AS users_left FROM users;\")",
|
|
"Bash(kill %1)",
|
|
"Bash(git add *)",
|
|
"Bash(git commit -m ' *)"
|
|
]
|
|
}
|
|
}
|