Merge pull request 'Last security check' (#57) from dev into main

Reviewed-on: #57

admin.php

@@ -1232,7 +1232,7 @@ require_once __DIR__ . '/includes/header.php';
                                 <div class="ml-3">
                                     <div class="flex items-center space-x-1.5">
                                         <span class="text-xs font-bold text-slate-900 dark:text-white">30 minuten</span>
-                                        <span class="px-1.5 py-0.2 rounded text-[9px] font-extrabold bg-indigo-100 dark:bg-indigo-900/50 text-indigo-700 dark:text-indigo-300">Aanbevolen</span>
+                                        <span class="px-1.5 py-0.5 rounded text-[9px] font-extrabold bg-indigo-100 dark:bg-indigo-900/50 text-indigo-700 dark:text-indigo-300">Aanbevolen</span>
                                     </div>
                                     <span class="block text-[11px] text-slate-500 dark:text-slate-400 mt-0.5">NIST SP 800-63B & OWASP ASVS v4.0 standaard</span>
                                 </div>

brainstorm_canvas.php

@@ -693,7 +693,7 @@ async function aiSuggestRoadmapMeta(btn) {
             headers: {'Content-Type': 'application/json'},
             body: JSON.stringify({ 
                 content: firstContent, 
-                session_title: '<?= htmlspecialchars(addslashes($session['title'])) ?>' 
+                session_title: <?= json_encode($session['title']) ?> 
             })
         });
         const data = await res.json();
@@ -741,7 +741,7 @@ async function openAiBreakdownModal(cardId, content) {
     currentBreakdownItems = [];
 
     document.getElementById('breakdownIdeaText').innerText = `"${content}"`;
-    document.getElementById('breakdownSessionLabel').innerText = `Sessie: <?= htmlspecialchars(addslashes($session['title'])) ?> (<?= htmlspecialchars(addslashes($session['theme'])) ?>)`;
+    document.getElementById('breakdownSessionLabel').innerText = "Sessie: " + <?= json_encode($session['title']) ?> + " (" + <?= json_encode($session['theme']) ?> + ")";
     
     const modal = document.getElementById('aiBreakdownModal');
     modal.classList.remove('hidden');
@@ -795,8 +795,8 @@ async function fetchAiBreakdown(content) {
             body: JSON.stringify({
                 session_id: sessionId,
                 content: content,
-                session_title: '<?= htmlspecialchars(addslashes($session['title'])) ?>',
-                theme: '<?= htmlspecialchars(addslashes($session['theme'])) ?>',
+                session_title: <?= json_encode($session['title']) ?>,
+                theme: <?= json_encode($session['theme']) ?>,
             })
         });
 

includes/ai.php

@@ -131,12 +131,13 @@ function fociz_ai_chat_gemini(array $messages, array $options, array $aiSettings
         $payload['generationConfig']['responseMimeType'] = 'application/json';
     }
 
-    $endpoint = "https://generativelanguage.googleapis.com/v1beta/models/{$model}:generateContent?key=" . urlencode($apiKey);
+    $endpoint = "https://generativelanguage.googleapis.com/v1beta/models/{$model}:generateContent";
 
     $response = fociz_http_request($endpoint, [
         'method'  => 'POST',
         'headers' => [
             'Content-Type'   => 'application/json',
+            'x-goog-api-key' => $apiKey,
         ],
         'body'    => $payload,
         'timeout' => 45,

includes/env_badge.php

@@ -56,7 +56,7 @@ $isLive = in_array(strtolower(trim($environment)), ['live', 'production', 'prod'
                 <span>Development</span>
             </span>
 
-            <span class="hidden sm:inline-block text-[9px] font-mono font-bold px-1.5 py-0.2 rounded bg-red-500/20 text-red-300 border border-red-500/30">
+            <span class="hidden sm:inline-block text-[9px] font-mono font-bold px-1.5 py-0.5 rounded bg-red-500/20 text-red-300 border border-red-500/30">
                 DEV
             </span>
         </div>

jira.php

@@ -191,7 +191,7 @@ $boardsJson = json_encode($boards, JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT
                         class="flex items-center space-x-2 px-3 py-1.5 rounded-xl text-xs font-semibold bg-slate-100 hover:bg-slate-200 dark:bg-slate-800 dark:hover:bg-slate-700 text-slate-700 dark:text-slate-200 border border-slate-200 dark:border-slate-700 transition cursor-pointer shadow-2xs group">
                     <i data-lucide="sliders-horizontal" class="w-3.5 h-3.5 text-indigo-500 group-hover:rotate-12 transition-transform"></i>
                     <span>Filters & Statistieken</span>
-                    <span id="activeFilterBadge" class="hidden px-1.5 py-0.2 rounded-full text-[10px] font-black bg-indigo-600 text-white leading-tight">0</span>
+                    <span id="activeFilterBadge" class="hidden px-1.5 py-0.5 rounded-full text-[10px] font-black bg-indigo-600 text-white leading-tight">0</span>
                     <i data-lucide="chevron-down" id="filtersDrawerChevron" class="w-3.5 h-3.5 transition-transform duration-200"></i>
                 </button>
             </div>

mail.php

@@ -122,11 +122,11 @@ $jsonMessages = json_encode($messages, JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_Q
         <div class="flex items-center space-x-1.5 bg-slate-100/90 dark:bg-slate-800/60 p-1 rounded-xl border border-slate-200/70 dark:border-slate-700/60 text-xs font-bold w-full sm:w-auto">
             <button onclick="setMailFilter('all')" id="filterBtn_all" class="flex-1 sm:flex-none px-3.5 py-1.5 rounded-lg bg-white dark:bg-slate-900 text-slate-900 dark:text-white shadow-xs transition">
                 <span>Alle Berichten</span>
-                <span class="ml-1 px-1.5 py-0.2 rounded-full text-[10px] bg-slate-100 dark:bg-slate-800 text-slate-600 dark:text-slate-400" id="countAll"><?= count($messages) ?></span>
+                <span class="ml-1 px-1.5 py-0.5 rounded-full text-[10px] bg-slate-100 dark:bg-slate-800 text-slate-600 dark:text-slate-400" id="countAll"><?= count($messages) ?></span>
             </button>
             <button onclick="setMailFilter('unread')" id="filterBtn_unread" class="flex-1 sm:flex-none px-3.5 py-1.5 rounded-lg text-slate-600 dark:text-slate-400 hover:text-slate-900 dark:hover:text-white transition">
                 <span>Ongelezen</span>
-                <span class="ml-1 px-1.5 py-0.2 rounded-full text-[10px] bg-sky-100 dark:bg-sky-900/60 text-sky-700 dark:text-sky-300" id="countUnread"><?= $unreadCount ?></span>
+                <span class="ml-1 px-1.5 py-0.5 rounded-full text-[10px] bg-sky-100 dark:bg-sky-900/60 text-sky-700 dark:text-sky-300" id="countUnread"><?= $unreadCount ?></span>
             </button>
         </div>
 

planner.php

@@ -799,16 +799,16 @@ for ($h = $startHour; $h <= $endHour; $h++) {
                                                 <div class="truncate">
                                                     <div class="flex items-center space-x-1.5 truncate">
                                                         <?php if ($task['source'] === 'JIRA'): ?>
-                                                            <span class="px-1.5 py-0.2 rounded bg-indigo-50 dark:bg-indigo-500/10 border border-indigo-200 dark:border-indigo-500/20 text-indigo-700 dark:text-indigo-400 font-mono text-[9px] font-bold">
+                                                            <span class="px-1.5 py-0.5 rounded bg-indigo-50 dark:bg-indigo-500/10 border border-indigo-200 dark:border-indigo-500/20 text-indigo-700 dark:text-indigo-400 font-mono text-[9px] font-bold">
                                                                 JIRA
                                                             </span>
                                                         <?php elseif ($task['source'] === 'OUTLOOK_MAIL'): ?>
-                                                            <span class="px-1.5 py-0.2 rounded bg-violet-50 dark:bg-violet-500/10 border border-violet-200 dark:border-violet-500/20 text-violet-700 dark:text-violet-400 font-mono text-[9px] font-bold flex items-center space-x-0.5">
+                                                            <span class="px-1.5 py-0.5 rounded bg-violet-50 dark:bg-violet-500/10 border border-violet-200 dark:border-violet-500/20 text-violet-700 dark:text-violet-400 font-mono text-[9px] font-bold flex items-center space-x-0.5">
                                                                 <i data-lucide="mail" class="w-2.5 h-2.5"></i>
                                                                 <span>MAIL</span>
                                                             </span>
                                                         <?php elseif ($task['source'] === 'OUTLOOK' || !empty($task['external_id'])): ?>
-                                                            <span class="px-1.5 py-0.2 rounded bg-sky-50 dark:bg-sky-500/10 border border-sky-200 dark:border-sky-500/20 text-sky-700 dark:text-sky-400 font-mono text-[9px] font-bold flex items-center space-x-0.5">
+                                                            <span class="px-1.5 py-0.5 rounded bg-sky-50 dark:bg-sky-500/10 border border-sky-200 dark:border-sky-500/20 text-sky-700 dark:text-sky-400 font-mono text-[9px] font-bold flex items-center space-x-0.5">
                                                                 <i data-lucide="calendar" class="w-2.5 h-2.5"></i>
                                                                 <span>OUTLOOK</span>
                                                             </span>
@@ -968,7 +968,7 @@ for ($h = $startHour; $h <= $endHour; $h++) {
                                             <?= $wd['short_name'] ?>
                                         </span>
                                         <?php if ($wd['is_today']): ?>
-                                            <span class="px-1.5 py-0.2 rounded-full text-[8px] font-extrabold uppercase bg-indigo-600 text-white shadow-xs">
+                                            <span class="px-1.5 py-0.5 rounded-full text-[8px] font-extrabold uppercase bg-indigo-600 text-white shadow-xs">
                                                 Nu
                                             </span>
                                         <?php endif; ?>