Implement CSRF protection for user invitation and management actions; add QR code generation script; secure internal includes directory with .htaccess

auth/forgot-password.php

@@ -18,11 +18,24 @@ $error = null;
 $submitted = false;
 
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
-    $email = strtolower(trim($_POST['email'] ?? ''));
+    $clientIp = fociz_get_client_ip();
+    $ipRateKey = "forgot_ip_{$clientIp}";
+    $ipLimit = fociz_check_rate_limit($ipRateKey, 5, 900);
 
-    if (empty($email) || !filter_var($email, FILTER_VALIDATE_EMAIL)) {
+    $email = strtolower(trim($_POST['email'] ?? ''));
+    $emailRateKey = "forgot_email_{$email}";
+    $emailLimit = fociz_check_rate_limit($emailRateKey, 3, 900);
+
+    if (!verify_csrf_token($_POST['csrf_token'] ?? null)) {
+        $error = "Sessie verlopen of beveiligingstoken ongeldig. Ververs de pagina en probeer opnieuw.";
+    } elseif (!$ipLimit['allowed'] || !$emailLimit['allowed']) {
+        $retryAfter = max($ipLimit['retry_after'], $emailLimit['retry_after']);
+        $error = "Te veel herstelaanvragen. Probeer het over " . ceil($retryAfter / 60) . " minuten opnieuw.";
+    } elseif (empty($email) || !filter_var($email, FILTER_VALIDATE_EMAIL)) {
         $error = "Vul een geldig e-mailadres in.";
     } else {
+        fociz_hit_rate_limit($ipRateKey, 900);
+        fociz_hit_rate_limit($emailRateKey, 900);
         try {
             $db = get_db_connection();
 
@@ -176,6 +189,7 @@ $pageTitle = "Fociz — Wachtwoord Vergeten";
         </div>
     <?php else: ?>
         <form method="POST" action="/auth/forgot-password.php" class="space-y-4">
+            <input type="hidden" name="csrf_token" value="<?= htmlspecialchars(get_csrf_token()) ?>">
             <div>
                 <label class="block text-xs font-semibold text-slate-700 dark:text-slate-300 mb-1">Uw e-mailadres</label>
                 <div class="relative">