From 245d09e62ccd2f123b5a871ac0559114f11d60c0 Mon Sep 17 00:00:00 2001
From: Niek Rabelink <niek.rabelink@gmail.com>
Date: Sat, 12 Sep 2026 10:25:49 +0200
Subject: [PATCH] Last security check

---
 admin.php              | 2 +-
 brainstorm_canvas.php  | 8 ++++----
 includes/ai.php        | 5 +++--
 includes/env_badge.php | 2 +-
 jira.php               | 2 +-
 mail.php               | 4 ++--
 planner.php            | 8 ++++----
 7 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/admin.php b/admin.php
index 0af8c3b..c5bf984 100644
--- a/admin.php
+++ b/admin.php
@@ -1232,7 +1232,7 @@ require_once __DIR__ . '/includes/header.php';
                                 <div class="ml-3">
                                     <div class="flex items-center space-x-1.5">
                                         <span class="text-xs font-bold text-slate-900 dark:text-white">30 minuten</span>
-                                        <span class="px-1.5 py-0.2 rounded text-[9px] font-extrabold bg-indigo-100 dark:bg-indigo-900/50 text-indigo-700 dark:text-indigo-300">Aanbevolen</span>
+                                        <span class="px-1.5 py-0.5 rounded text-[9px] font-extrabold bg-indigo-100 dark:bg-indigo-900/50 text-indigo-700 dark:text-indigo-300">Aanbevolen</span>
                                     </div>
                                     <span class="block text-[11px] text-slate-500 dark:text-slate-400 mt-0.5">NIST SP 800-63B & OWASP ASVS v4.0 standaard</span>
                                 </div>
diff --git a/brainstorm_canvas.php b/brainstorm_canvas.php
index 64ebaaf..a174ae3 100644
--- a/brainstorm_canvas.php
+++ b/brainstorm_canvas.php
@@ -693,7 +693,7 @@ async function aiSuggestRoadmapMeta(btn) {
             headers: {'Content-Type': 'application/json'},
             body: JSON.stringify({ 
                 content: firstContent, 
-                session_title: '<?= htmlspecialchars(addslashes($session['title'])) ?>' 
+                session_title: <?= json_encode($session['title']) ?> 
             })
         });
         const data = await res.json();
@@ -741,7 +741,7 @@ async function openAiBreakdownModal(cardId, content) {
     currentBreakdownItems = [];
 
     document.getElementById('breakdownIdeaText').innerText = `"${content}"`;
-    document.getElementById('breakdownSessionLabel').innerText = `Sessie: <?= htmlspecialchars(addslashes($session['title'])) ?> (<?= htmlspecialchars(addslashes($session['theme'])) ?>)`;
+    document.getElementById('breakdownSessionLabel').innerText = "Sessie: " + <?= json_encode($session['title']) ?> + " (" + <?= json_encode($session['theme']) ?> + ")";
     
     const modal = document.getElementById('aiBreakdownModal');
     modal.classList.remove('hidden');
@@ -795,8 +795,8 @@ async function fetchAiBreakdown(content) {
             body: JSON.stringify({
                 session_id: sessionId,
                 content: content,
-                session_title: '<?= htmlspecialchars(addslashes($session['title'])) ?>',
-                theme: '<?= htmlspecialchars(addslashes($session['theme'])) ?>',
+                session_title: <?= json_encode($session['title']) ?>,
+                theme: <?= json_encode($session['theme']) ?>,
             })
         });
 
diff --git a/includes/ai.php b/includes/ai.php
index 0c2a0f5..dd6ab1b 100644
--- a/includes/ai.php
+++ b/includes/ai.php
@@ -131,12 +131,13 @@ function fociz_ai_chat_gemini(array $messages, array $options, array $aiSettings
         $payload['generationConfig']['responseMimeType'] = 'application/json';
     }
 
-    $endpoint = "https://generativelanguage.googleapis.com/v1beta/models/{$model}:generateContent?key=" . urlencode($apiKey);
+    $endpoint = "https://generativelanguage.googleapis.com/v1beta/models/{$model}:generateContent";
 
     $response = fociz_http_request($endpoint, [
         'method'  => 'POST',
         'headers' => [
-            'Content-Type' => 'application/json',
+            'Content-Type'   => 'application/json',
+            'x-goog-api-key' => $apiKey,
         ],
         'body'    => $payload,
         'timeout' => 45,
diff --git a/includes/env_badge.php b/includes/env_badge.php
index 522a096..f34e2ed 100644
--- a/includes/env_badge.php
+++ b/includes/env_badge.php
@@ -56,7 +56,7 @@ $isLive = in_array(strtolower(trim($environment)), ['live', 'production', 'prod'
                 <span>Development</span>
             </span>
 
-            <span class="hidden sm:inline-block text-[9px] font-mono font-bold px-1.5 py-0.2 rounded bg-red-500/20 text-red-300 border border-red-500/30">
+            <span class="hidden sm:inline-block text-[9px] font-mono font-bold px-1.5 py-0.5 rounded bg-red-500/20 text-red-300 border border-red-500/30">
                 DEV
             </span>
         </div>
diff --git a/jira.php b/jira.php
index 26bce61..3418e56 100644
--- a/jira.php
+++ b/jira.php
@@ -191,7 +191,7 @@ $boardsJson = json_encode($boards, JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT
                         class="flex items-center space-x-2 px-3 py-1.5 rounded-xl text-xs font-semibold bg-slate-100 hover:bg-slate-200 dark:bg-slate-800 dark:hover:bg-slate-700 text-slate-700 dark:text-slate-200 border border-slate-200 dark:border-slate-700 transition cursor-pointer shadow-2xs group">
                     <i data-lucide="sliders-horizontal" class="w-3.5 h-3.5 text-indigo-500 group-hover:rotate-12 transition-transform"></i>
                     <span>Filters & Statistieken</span>
-                    <span id="activeFilterBadge" class="hidden px-1.5 py-0.2 rounded-full text-[10px] font-black bg-indigo-600 text-white leading-tight">0</span>
+                    <span id="activeFilterBadge" class="hidden px-1.5 py-0.5 rounded-full text-[10px] font-black bg-indigo-600 text-white leading-tight">0</span>
                     <i data-lucide="chevron-down" id="filtersDrawerChevron" class="w-3.5 h-3.5 transition-transform duration-200"></i>
                 </button>
             </div>
diff --git a/mail.php b/mail.php
index fff8f9b..bb75e8f 100644
--- a/mail.php
+++ b/mail.php
@@ -122,11 +122,11 @@ $jsonMessages = json_encode($messages, JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_Q
         <div class="flex items-center space-x-1.5 bg-slate-100/90 dark:bg-slate-800/60 p-1 rounded-xl border border-slate-200/70 dark:border-slate-700/60 text-xs font-bold w-full sm:w-auto">
             <button onclick="setMailFilter('all')" id="filterBtn_all" class="flex-1 sm:flex-none px-3.5 py-1.5 rounded-lg bg-white dark:bg-slate-900 text-slate-900 dark:text-white shadow-xs transition">
                 <span>Alle Berichten</span>
-                <span class="ml-1 px-1.5 py-0.2 rounded-full text-[10px] bg-slate-100 dark:bg-slate-800 text-slate-600 dark:text-slate-400" id="countAll"><?= count($messages) ?></span>
+                <span class="ml-1 px-1.5 py-0.5 rounded-full text-[10px] bg-slate-100 dark:bg-slate-800 text-slate-600 dark:text-slate-400" id="countAll"><?= count($messages) ?></span>
             </button>
             <button onclick="setMailFilter('unread')" id="filterBtn_unread" class="flex-1 sm:flex-none px-3.5 py-1.5 rounded-lg text-slate-600 dark:text-slate-400 hover:text-slate-900 dark:hover:text-white transition">
                 <span>Ongelezen</span>
-                <span class="ml-1 px-1.5 py-0.2 rounded-full text-[10px] bg-sky-100 dark:bg-sky-900/60 text-sky-700 dark:text-sky-300" id="countUnread"><?= $unreadCount ?></span>
+                <span class="ml-1 px-1.5 py-0.5 rounded-full text-[10px] bg-sky-100 dark:bg-sky-900/60 text-sky-700 dark:text-sky-300" id="countUnread"><?= $unreadCount ?></span>
             </button>
         </div>
 
diff --git a/planner.php b/planner.php
index 53005e7..3727904 100644
--- a/planner.php
+++ b/planner.php
@@ -799,16 +799,16 @@ for ($h = $startHour; $h <= $endHour; $h++) {
                                                 <div class="truncate">
                                                     <div class="flex items-center space-x-1.5 truncate">
                                                         <?php if ($task['source'] === 'JIRA'): ?>
-                                                            <span class="px-1.5 py-0.2 rounded bg-indigo-50 dark:bg-indigo-500/10 border border-indigo-200 dark:border-indigo-500/20 text-indigo-700 dark:text-indigo-400 font-mono text-[9px] font-bold">
+                                                            <span class="px-1.5 py-0.5 rounded bg-indigo-50 dark:bg-indigo-500/10 border border-indigo-200 dark:border-indigo-500/20 text-indigo-700 dark:text-indigo-400 font-mono text-[9px] font-bold">
                                                                 JIRA
                                                             </span>
                                                         <?php elseif ($task['source'] === 'OUTLOOK_MAIL'): ?>
-                                                            <span class="px-1.5 py-0.2 rounded bg-violet-50 dark:bg-violet-500/10 border border-violet-200 dark:border-violet-500/20 text-violet-700 dark:text-violet-400 font-mono text-[9px] font-bold flex items-center space-x-0.5">
+                                                            <span class="px-1.5 py-0.5 rounded bg-violet-50 dark:bg-violet-500/10 border border-violet-200 dark:border-violet-500/20 text-violet-700 dark:text-violet-400 font-mono text-[9px] font-bold flex items-center space-x-0.5">
                                                                 <i data-lucide="mail" class="w-2.5 h-2.5"></i>
                                                                 <span>MAIL</span>
                                                             </span>
                                                         <?php elseif ($task['source'] === 'OUTLOOK' || !empty($task['external_id'])): ?>
-                                                            <span class="px-1.5 py-0.2 rounded bg-sky-50 dark:bg-sky-500/10 border border-sky-200 dark:border-sky-500/20 text-sky-700 dark:text-sky-400 font-mono text-[9px] font-bold flex items-center space-x-0.5">
+                                                            <span class="px-1.5 py-0.5 rounded bg-sky-50 dark:bg-sky-500/10 border border-sky-200 dark:border-sky-500/20 text-sky-700 dark:text-sky-400 font-mono text-[9px] font-bold flex items-center space-x-0.5">
                                                                 <i data-lucide="calendar" class="w-2.5 h-2.5"></i>
                                                                 <span>OUTLOOK</span>
                                                             </span>
@@ -968,7 +968,7 @@ for ($h = $startHour; $h <= $endHour; $h++) {
                                             <?= $wd['short_name'] ?>
                                         </span>
                                         <?php if ($wd['is_today']): ?>
-                                            <span class="px-1.5 py-0.2 rounded-full text-[8px] font-extrabold uppercase bg-indigo-600 text-white shadow-xs">
+                                            <span class="px-1.5 py-0.5 rounded-full text-[8px] font-extrabold uppercase bg-indigo-600 text-white shadow-xs">
                                                 Nu
                                             </span>
                                         <?php endif; ?>
-- 
2.52.0