Mozgasnaplo Changelog

Versioning Scheme Example: 1.12.1

1 --> Major version: Incremented after significant feature additions or front/backend restructuring.
12 --> Minor version: Incremented when adding new features. May also include bug fixes.
1 --> Patch (bugfix): Incremented after bug fixes or minor modifications to existing features.

v3.10.01 - 2025.12.31

Bug Fixes

Import Counter Fix
- Fixed incorrect update counter in XML product import
- Previously, all records were counted as "updated" even when data was unchanged
- Root cause: LastUpdate = NOW() was unconditionally applied on every duplicate key
- Now LastUpdate only updates when actual product data has changed
- Correct counting: new records as inserted, changed records as updated, unchanged records not counted
Real IP Detection Behind Reverse Proxy
- Fixed IP logging when application runs behind nginx reverse proxy
- writeLog(), API import, and traffic gate functions now use getUserIP() instead of $_SERVER['REMOTE_ADDR']
- Properly detects real client IP from X-Forwarded-For and other proxy headers
- Requires nginx configuration: proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

v3.10.00 - 2025.11.18

Installation System

Professional Installation Wizard
- New /installation directory with comprehensive installation wizard
- 6-step installation process: Database → License → Authentication → Application → Property → Complete
- Bootstrap 5-powered modern UI with gradient design and step-by-step progress tracking
- AJAX-powered, no page reloads during installation
Multi-Domain Architecture Support
- Designed for centralized deployment with multiple domains sharing same codebase
- Each domain has its own .env file in domain directory (e.g., /websites/domain.com/.env)
- .env contains ONLY database credentials
- All application settings stored in system_settings database table
Security Features
- Multiple installation prevention checks:
  - .env file existence check in domain directory
  - system_settings table data validation
  - settings_user table population check
- Mandatory license validation with https://lm.patrikmol.com
- Secure .env file creation with chmod 600
- CSP headers with nonce-based inline scripts
- Prepared statements throughout
- Auto-generated 64-character API key
Installation Process
- Database connection testing before installation
- Complete database structure import from SQL template
- Automatic system settings configuration (19 settings covering core, auth, mail, ordering, API, license)
- Default data insertion (visitor company, visitor type, target person)
- Sysadmin user creation for LOCAL/MIX authentication
- Property/site data configuration
License Integration
- Mandatory license key validation during installation
- Real-time validation with license server
- Support for valid, expired, and revoked license states
- License information stored in system_settings table
User Experience
- Back button functionality for all steps
- Dropdown selections for language, timezone
- Checkboxes for module selection (Traffic, Camera, Ordering)
- Client and server-side validation
- Clear error messages and success notifications
- Detailed installation completion summary
Documentation
- Comprehensive README.md in /installation directory
- Architecture documentation for multi-domain setup
- Troubleshooting guide
- Post-installation configuration instructions
- Security best practices

v3.09.01 - 2025.11.18

System Configuration Improvements

Migrate settings_application table to system_settings table
Migrate settings_ldap table to system_settings table

v3.09.00 - 2025.11.18

System Configuration Overhaul

Centralized Settings Table & Migration
- Added system_settings table via sql/migrations/20251116_create_system_settings_table.sql
- Boot process now merges DB overrides into $_ENV (assets/load-environment.php)
- Helper getSystemSetting() caches values in assets/base-functions.php
- All mail ordering logic now reads SMTP data from DB rather than .env
System Settings UI Redesign
- assets/admin/system-settings.php reorganized into scoped tabs (Core, Authentication, Mail, Ordering, API, License, LDAP)
- Module enablement uses checkboxes, label-adjust applied for consistent layout
- Sensitive fields (SMTP/API/license credentials) support show/hide toggles
- CSRF-protected AJAX saves update system_settings and sync appMaxOrderDate
Navigation & Access Control
- Gear dropdown is sysadmin-only and collects all configuration entries plus the new audit log
- Offcanvas sidebar now excludes system/admin links moved to the gear menu
Activity Log Viewer
- New /auditlog route renders assets/admin/logs/activity-log.php
- Pulls from activity_log table with filtering by category, event type, user, IP, and date range
- Human-readable context display and badge styling for categories
Ordering Mail Improvements
- PHPMailer configuration reads from mail.smtp_* settings to keep secrets centralized

Documentation / Localization

Added English and Hungarian translation strings for new settings labels, module descriptions, audit log UI, and route slug

Profile Enhancements

My Profile now exposes ordering contact and delivery fields (when the ordering module is enabled) with AJAX save support, grouping by Personal/Contact/Invoicing/Delivery sections plus postal-code autocomplete and tax-field translations.

v3.08.01 - 2025.11.16

Security Enhancements

HTTP Security Headers Improvements
- Added Permissions-Policy header
  - Restricts browser features: geolocation, camera, microphone, payment, USB, accelerometer, gyroscope, magnetometer
  - Prevents third-party scripts from accessing sensitive browser APIs
  - Applied in both public/index.php and public/.htaccess for defense-in-depth
- CORS Policy Review
  - Commented out permissive Access-Control-Allow-Origin: * header
  - Added documentation for proper CORS configuration if needed
  - Improved security by default for internal admin application
- HSTS Header Prepared
  - Added commented-out Strict-Transport-Security header
  - Includes clear instructions for enabling after HTTPS verification
  - Ready for deployment: max-age=31536000; includeSubDomains; preload
- Enhanced header documentation
  - Added inline comments explaining each security header's purpose
  - Organized headers into logical sections
.htaccess Security Hardening (public/.htaccess)
- File Protection
  - Block access to sensitive files: .env, .git, composer.json, composer.lock, .md, .sql
  - Prevent directory listing with Options -Indexes
  - Disable server signature to reduce information disclosure
- Attack Prevention
  - Disabled TRACE/TRACK HTTP methods to prevent XST (Cross-Site Tracing) attacks
  - Added RewriteRule to reject TRACE/TRACK requests with 403 Forbidden
- Defense-in-Depth Headers
  - Security headers set at Apache level in addition to PHP
  - Ensures protection even if PHP fails or for non-PHP resources
  - Headers apply to all file types: PHP, CSS, JS, images
- Performance Optimization
  - Browser caching configured for static assets
  - Images cached for 1 month, CSS/JS for 1 week
  - Reduces server load and improves page load times

Documentation

Security Analysis Documents Created
- SECURITY_HEADERS_ANALYSIS.md - Complete audit of HTTP security headers
- RATE_LIMITING_PROPOSAL.md - Rate limiting implementation proposal
- CSP_HARDENING_PROPOSAL.md - Content Security Policy hardening roadmap
- DATATABLES_PROPOSAL.md - DataTables integration proposal

v3.08.00 - 2025.11.16

Major Security Enhancements

Session Timeout Validation
- Implemented automatic session expiration based on appLoginSessionInterval setting
- Sessions now properly expire after configured inactivity period
- Automatic cleanup of expired sessions from database
- Expired session events logged to activity log
CSRF Token Rotation
- CSRF tokens now rotate automatically after each successful form submission
- Implemented rotateAndSendCSRFToken() function in base-functions.php
- JavaScript handler automatically updates tokens from X-CSRF-Token header
- Enhanced protection against CSRF attacks through one-time token usage
Comprehensive Activity Logging System
- New activity_log table for tracking all user actions and security events
- Log categories: INFO, WARN, SECURITY, ERROR, DEBUG
- Automatic logging of: login success/failure, logout, session timeout, IP blocking, CSRF failures
- JSON context data support for detailed event information
- Convenience wrapper functions: logSecurityEvent(), logError(), logWarning(), logInfo()
Session Concurrency Limit
- Implemented enforceSessionLimit() function to limit concurrent sessions per user
- Default limit: 5 concurrent sessions per user
- Automatically terminates oldest sessions when limit exceeded
- Session limit enforcement events logged to activity log
Automated Session Cleanup
- Created cron job script: cron/cleanup_expired_sessions.php
- Removes expired sessions from database based on timeout setting
- Comprehensive logging of cleanup operations
- Crontab configuration file provided: cron/mozgasnaplo.crontab
- Scheduled to run daily at 2:00 AM

# 1. Verify the script is executable
chmod +x /path/to/cron/cleanup_expired_sessions.php

# 2. Edit the crontab file and update the path
nano /path/to/cron/mozgasnaplo.crontab

# 3. Import to crontab
crontab -l > mycron
cat /path/to/cron/mozgasnaplo.crontab >> mycron
crontab mycron
rm mycron

# 4. Verify installation
crontab -l

# 5. Test the script manually first
php /path/to/cron/cleanup_expired_sessions.php

Technical Improvements

Updated checkLogin() function with timeout validation and security logging
Enhanced logoutSession() function with activity logging
Integrated activity logging into authentication flow (login-auth.php)
Created CSRF token rotation JavaScript handler: assets/js/csrf-token-handler.js
Added global helper functions: getCSRFToken(), updateCSRFToken(), addCSRFTokenToFormData(), addCSRFTokenToData()

Database Schema

Added activity_log table with comprehensive event tracking fields
Indexes optimized for security monitoring and user activity queries
JSON column for flexible context data storage

================================================================ 
Example event types to log:
================================================================
SECURITY:
  - login_success
  - login_failed
  - logout
  - session_timeout
  - session_expired
  - csrf_failure
  - session_hijack_attempt
  - ip_blocked
  - suspicious_activity
  - password_changed
  - mfa_enabled
  - mfa_disabled
  --
DATA:
  - visitor_created
  - visitor_updated
  - visitor_deleted
  - gate_entry
  - gate_exit
  - order_created
  - order_updated
  - settings_changed
  --
ERROR:
  - database_error
  - permission_denied
  - validation_failed
  - api_error
  --
INFO:
  - page_view
  - export_generated
  - report_generated
  - email_sent
================================================================

Files Added

sql/create_activity_log_table.sql - Activity log table creation script
cron/cleanup_expired_sessions.php - Automated session cleanup script
cron/mozgasnaplo.crontab - Crontab configuration for automated tasks
assets/js/csrf-token-handler.js - Client-side CSRF token rotation handler

Files Modified

assets/base-functions.php - Added activity logging, session timeout, concurrency limit, CSRF rotation
assets/includes/general/login-auth.php - Integrated activity logging and session concurrency
assets/includes/general/footer.php - Added CSRF token handler script
public/index.php - Version bump to 3.08.00

v3.07.05 - 2025.11.16

Security Update

Cookie generation now uses bin2hex(random_bytes(32)) instead of IP+username+hrtime for improved security.

v3.07.04 - 2025.11.16

Backend Development

Removal of legacy, deprecated CSRF token system code

v3.07.03 - 2025.11.15

Documentation

README.md Update
- Comprehensive README creation with installation guide
- System architecture and technology stack documentation
- Developer guide additions

v3.07.02 - 2025.11.15

Bug Fixes

Camera Include Fix
- import-carplates-to-cameras.php: Fixed include order
- get-available-cameras-for-import.php: Fixed field mapping (camera_id → id)

v3.07.01 - 2025.11.15

New Features

CSV Import - Camera Upload Integration
- Direct upload of imported license plates to cameras after CSV import
- New Step 4: Camera selector UI with active camera list
- get-available-cameras-for-import.php, import-carplates-to-cameras.php endpoints
- Feedback on upload results per camera
- 25+ new translations (hu_HU, en_US)

Bug Fixes

Visitor Editor - CSRF Token & Company Assignment
- CSRF token refresh in JavaScript after save
- Automatic assignment of new company to visitor
- Camera list loading fixed without invalid token
Camera Dependency Fix
- visitor-camera-assignments.php: Missing visitor-camera-sync.php include
- getVisitorAssignedCameras() function now available

v3.07.00 - 2025.11.15

Major Changes – Top 10 Frequent Visitors Feature

NEW FEATURE: Automatically prefill the gate traffic form with the 10 most frequent visitors on the page.

New Features

Top 10 Frequent Visitor Cards
- Display 10 compact cards at the top of every gate traffic page
- Sorted by visit frequency during the last 30 days
- Each card shows:
  - Ranking number (1-10) with color-coded badges (🥇 gold, 🥈 blue, 🥉 green)
  - Visitor name
  - Company name
  - Visit count (blue badge)
- Touch-friendly card sizes for phones and tablets
- Responsive layout with the Bootstrap grid system
One-Click Form Prefill
- Clicking a card automatically fills the entry form
- Loads the visitor’s most recent entry data
- Every field is populated:
  - Visitor name and ID number
  - Company name
  - Contact person (who they visit)
  - Visitor type
  - Vehicle type
  - License plate and trailer plate
  - CMR number
  - Arrive-from / destination
  - Notes
- Smoothly scrolls to the form
- Visual feedback (blue border flash)
- Sets entry timestamp to current time
- Shows entry permission warnings
Intelligent Data Handling
- Groups visitors by name and company
- Reuses data from the latest visit
- Automatically refreshes after saving a new entry
- Handles empty states (hides the widget when no data is available)

Backend Enhancements

New backend files:
- assets/includes/traffic/movements/get-top10-visitors.php – Top 10 query
  - SQL GROUP BY by visitor and company
  - COUNT(*) based ordering
  - Last 30 days filter
  - Gate-specific filtering
- assets/includes/traffic/movements/get-visitor-latest-entry.php – Load full entry data
  - Complex JOINs (traffic_gates, traffic_visitors, traffic_visitor_company, traffic_targetperson, settings_visitortypes, traffic_carplates)
  - Entry permission information
  - Falls back to default carplate when available

Frontend Enhancements

Modified files:
- assets/includes/traffic/movements/gate-traffic.php:
  - Added Top 10 card container at the top of the page
  - Header copy with icon and subtitle
  - Bootstrap row/col grid structure
- assets/js/traffic/movement-scripts.js (+177 lines):
  - loadTop10Visitors() – AJAX call to fetch Top 10
  - renderTop10Cards() – card renderer
  - autoFillFromTop10() – load entry data on click
  - fillFormWithData() – full form population logic
  - escapeHtml() – XSS protection helper
  - Auto-load Top 10 on page load
  - Auto-refresh cards after successful entry save

UI/UX Enhancements

Bootstrap-native design
- Fully uses the Bootstrap card component
- No custom CSS (aside from inline cursor: pointer)
- Responsive grid breakpoints:
  - col-6: mobile (2 columns)
  - col-sm-4: tablet (3 columns)
  - col-md-3: laptop (4 columns)
  - col-lg-2: desktop (6 columns)
- Text truncation for long names + tooltip support
- Badge colors: warning (1st), info (2nd), success (3rd), secondary (4-10)
Touch-friendly design
- Entire card surface is clickable
- Card size optimized for tapping
- Hover and focus states included
- Smooth scrolling to the form

Language Support

New translation keys (3):
- Hungarian (hu_HU.po):
  - TEXT_TOP10_FREQUENT_VISITORS: "Gyakori Látogatók"
  - TEXT_TOP10_LAST_30_DAYS: "30 nap"
  - TEXT_TOP10_VISITS: "látogatás"
- English (en_US.po):
  - TEXT_TOP10_FREQUENT_VISITORS: "Frequent Visitors"
  - TEXT_TOP10_LAST_30_DAYS: "Last 30 days"
  - TEXT_TOP10_VISITS: "visits"

Performance Optimizations

Efficient SQL queries:
- Single GROUP BY query for the Top 10 list
- Reuses gateid and arrivetime indexes
- LIMIT 10 applied
- LEFT JOINs only for required data
Asynchronous loading:
- AJAX-driven data fetch
- Does not block page render
- Fault tolerant (hides the widget when an error occurs)

Usage

Open any gate traffic page (for example “Gate 1”)
The Top 10 cards load automatically on top
Click a card
The form fills with the visitor’s last entry
Adjust or approve the data
Press the “Entry” button
The Top 10 list refreshes automatically

Files

New files (2):

assets/includes/traffic/movements/get-top10-visitors.php (~75 lines)
assets/includes/traffic/movements/get-visitor-latest-entry.php (~95 lines)

Modified files (4):

assets/includes/traffic/movements/gate-traffic.php (+11 lines of HTML)
assets/js/traffic/movement-scripts.js (+177 lines)
assets/languages/hu_HU/LC_MESSAGES/hu_HU.po (+3 msgid)
assets/languages/en_US/LC_MESSAGES/en_US.po (+3 msgid)

Summary

New feature: Rapid entry for Top 10 frequent visitors
Files: 2 new, 4 modified
Lines: ~260 new lines (PHP + JavaScript)
Translations: 3 new keys per language
Design: Pure Bootstrap, responsive, touch-friendly

v3.06.00 - 2025.11.15

Major Changes – Visitor CSV Import Feature

NEW FEATURE: Bulk import visitors and their carplates from CSV.

New Features

CSV Import Flow
- Bulk visitor import from the visitor editor page
- Automatic field detection (visitor_name, carplate_number, visitor_company_name, etc.)
- Flexible CSV structure: only mandatory fields required (visitor_name, carplate_number)
- Smart duplicate handling: only add new plates for existing visitors
- Supported columns:
  - visitor_name – Visitor name (required)
  - carplate_number – License plate (required)
  - visitor_company_name – Visitor’s company (optional)
  - visitor_type – Visitor type (optional)
  - entity_assignment – Property/company assignment (optional)
  - entry_permission – Entry permission 1-3 (optional)
  - country_code – Country code (optional, auto-detected)
  - effective_start_date, effective_end_date – Validity period (optional)
  - idcard_number – ID card number (optional)
Automatic Entity Creation
- Visitor companies (traffic_visitor_company): LIKE %% lookup, auto-create when missing
- Entities (settings_companydata): LIKE %% lookup based on property/company name, auto-create when missing
- Visitor types: fuzzy matching to existing types with fallback to first active type
Import UI
- Bootstrap modal with three steps: Upload → Process → Results
- Live progress bar during upload
- Detailed statistics:
  - Total / processed rows
  - Created / updated visitors
  - Created carplates
  - Created visitor companies
  - Created entities
  - Error count and breakdown
- Downloadable CSV template
- Visitor list auto-refresh after import
Validation & Error Reporting
- File size check (max 5 MB)
- CSV format validation
- Mandatory field validation (visitor_name, carplate_number)
- License plate validation and normalization
- Visitor name length check (max 128 chars)
- Date format validation (YYYY-MM-DD)
- Detailed per-row error log

Backend Enhancements

New backend file:
- assets/admin/traffic/visitor-import-csv.php – CSV processing backend
  - CSV parsing with UTF-8 support
  - Automatic column mapping for multilingual headers (HU/EN)
  - Chunk processing with error handling
  - Detailed statistics collection
  - CSRF protection and permission checks
Helper functions:
- Auto-detect country codes from license plate
- Fuzzy matching for visitor_company and entity_assignment names
- Duplicate detection for visitors and carplates
- Intelligent visitor_type matching

Frontend Enhancements

Modified file:
- assets/admin/traffic/visitor-account-change.php:
  - Added “Import Visitors (CSV)” button
  - Full import modal implementation
  - JavaScript handlers for upload and processing
  - Results display with colored status cards
  - Modal state management + reset flow
New template file:
- public/templates/visitor_import_template.csv – downloadable sample CSV with example data

Language Support

30+ new translation keys:
- Hungarian (hu_HU.po): Import buttons, modal titles, field names, error messages
- English (en_US.po): Full English coverage
- Rich field descriptions and error texts in both languages

Additional Improvements

Security safeguards:
- CSRF validation on every import request
- File type and size validation
- User permission checks (sysadmin + siteadmin only)
- Prepared statements for SQL injection protection
- UTF-8 encoding validation with auto-conversion
Performance optimizations:
- Batch processing for parsed rows
- Optimized DB queries (one visitor → one query)
- Memory-efficient CSV parsing
- Progress tracking via AJAX

Usage

Open the Visitor editor page
Click the “Import Visitors (CSV)” button
(Optional) Download the template CSV
Select your CSV file (max 5 MB)
Click “Start Import”
Monitor the processing progress bar
Review stats and error details
Refresh the visitor list

Files

New files (3):

assets/admin/traffic/visitor-import-csv.php
public/templates/visitor_import_template.csv

Modified files (3):

assets/admin/traffic/visitor-account-change.php (~200 lines of JavaScript + modal HTML)
assets/languages/hu_HU/LC_MESSAGES/hu_HU.po (+30 msgid)
assets/languages/en_US/LC_MESSAGES/en_US.po (+30 msgid)

Summary

New feature: CSV import for visitors and license plates
Files: 3 new, 3 modified
Lines: ~700 new lines (PHP backend + JavaScript frontend)
Translations: 30+ new keys for both languages
Import type: Flexible, fault tolerant, detailed feedback

v3.05.00 - 2025.11.14

Major Changes – Unified Entity Management System

SIGNIFICANT REFACTOR: settings_property and settings_companydata merged into a single hierarchical entity system.

New Features

Unified entity management
- Manage properties and companies on one page (change-entity-management.php)
- Hierarchical structure: properties → companies (parent-child)
- Entity type selector when creating new records (property/company)
- Visual differentiation: 🏢 property, 🏪 company badges
- Choose parent property when creating companies
Hierarchical access control
- Property-level users see the property plus all companies underneath
- Company-level users only see their own company
- Sysadmin sees every property and company
- Applied to cameras and carplates as well
Camera assignment improvements
- Cameras can be linked to a property OR a company
- Optgroup dropdown separates properties and companies
- Property-level cameras become visible to all child companies
- Company-level cameras remain private to that company

Backend Enhancements

New helper functions (base-functions.php):
- getPropertyData(): fetch first active property (used on login screens)
- getUserEntityType(): determine whether the user belongs to a company or property
Updated functions (camera-functions.php):
- getUserCameras(): implements hierarchical access logic
- getUserCarPlates(): implements hierarchical access logic
- saveCameraConfig(): accepts both property and company entities

Database Changes

Unified table structure:
- settings_companydata extended with:
  - entity_type ENUM('company','property') to differentiate entity types
  - Column renames: company_* → entity_*
  - parent_entity_id: self-referencing foreign key (company → property)
- settings_property table removed (merged)
- Indexes: entity_type, parent_entity_id
- New constraint: fk_parent_entity (self reference)

Navigation & Routing

Unified menu item:
- Separate “Company management” + “Property management” replaced with single “Property & Company Admin”
- Menu header now shows property name (previously company name)
- URI: /entitas-kezelese (HU) or /entity-management (EN)
Backward compatibility:
- Legacy URLs automatically redirect to the new page
- /cegek-kezelese → unified page
- /ingatlan → unified page

New backend files

assets/admin/change-entity-management.php – unified UI
assets/admin/entity-search.php – entity lookup (AJAX)
assets/admin/entity-update.php – create/update entities
assets/admin/entity-delete.php – soft delete with validation
assets/admin/entity-logo-upload.php – logo handling

Modified files (19)

Property management (5 files):

change-property-management.php, property-search.php, property-update.php, property-delete.php, property-logo-upload.php

Company management (5 files):

change-company-management.php, company-search.php, company-update.php, company-delete.php, company-logo-upload.php

Camera module (3 files):

change-camera-settings.php – optgroup dropdown
change-carplates.php – optgroup dropdown
camera-functions.php – hierarchical logic

User management (3 files):

change-local-account.php, login-card.php, set-new-user-password.php

Core (4 files):

base-functions.php, data-save.php, offcanvas-menu.php, routing.php

Language Support

30 new translations (Hungarian + English):
- Unified management copy
- Entity type labels
- Camera assignment strings
- Error messages
- Tooltip content

Bug Fixes

Config path fix: correct initialization for entity backend files
Camera validation: accept property entities while saving cameras
Camera username removal: fixed bind_param type (integer → string)
Translation duplicates: removed duplicate msgids (TEXT_RESP_NO_PROPERTIES, TEXT_PAGE_ENTITY_MGMT)

SQL File Updates

sql/mozgasnaplo_DB_structure.sql – reflects new entity structure

Performance & Security

SQL aliases used for backward compatibility
Prepared statements across all queries
CSRF protection on every action
Soft delete via isActive flag for data retention

Summary

Touched files: 30+ (19 modified, 5 new, 2 SQL, 2 language packs, 2 docs)
New lines: ~1,500
Broken backward compatibility: None (legacy URLs redirected)
Database migration required: Yes (migration script included)

v3.04.02 - 2025.11.11

Enhancements

License validation now uses caching to avoid excessive server requests. License verification occurs once daily.

v3.04.01 - 2025.11.11

Bug Fix

validatePassword() bug fix

v3.04.00 - 2025.11.10

New Features

License Verification Implementation
- verifyLicense() function added (base-functions.php)
- API call to external license server (cURL)
- License status display in footer (client name, expiration date)
- Automatic shutdown on invalid license
- 5 new translation keys added (hu_HU.po)

Modified Files:

assets/base-functions.php (verifyLicense function)
assets/includes/general/footer.php (license display)
assets/languages/hu_HU/LC_MESSAGES/hu_HU.po + .mo
public/index.php (version bump)

v3.03.18 - 2025.11.10

Enhancements

Profile Management Refactored to AJAX
- Changes:
  - Profile page reorganization: change-local-profile.php → local-profile/local-profile.php
  - New AJAX endpoint created: local-profile-update.php
  - Traditional form POST → AJAX-based save (JSON responses)
  - Two separate operations: profile data update and password change
- Password Validation Improvements:
  - Dynamic password length using APP_PWD_MINLENGTH environment variable
  - Real-time password validation with JavaScript
  - Automatic save button enable/disable based on validation
  - Password feedback display with Bootstrap invalid-feedback class
- Result: More modern, user-friendly profile editing ✅
User Account Password Validation Enhancement
- Problem: Fixed 12-character minimum password length in validation
- Solution:
  - Dynamic passwordLength variable introduced from APP_PWD_MINLENGTH
  - JavaScript regex updated for dynamic minimum length
  - Save button disabled if password too short
- Location: assets/admin/change-local-account.php (lines 654-679)
- Result: Flexible password length configuration ✅

Modifications

Base Functions
- displaySubmitButton() function extended with new $prop parameter
- Allows adding custom HTML attributes (e.g. disabled) to buttons
- Usage: displaySubmitButton("btnId", "TEXT_BUTTON", "submit", "", "disabled")
- Location: assets/base-functions.php:1271 (line 1297)
Routing Update
- Profile page route redirected to new location
- Old: assets/admin/change-local-profile.php
- New: assets/admin/local-profile/local-profile.php
- Location: assets/routing.php:78

Translation Strings

2 new translation keys added (en_US.po, hu_HU.po):
- TEXT_RESP_PASSWORD_LENGHT - "Password length is incorrect."
- TEXT_RESP_USERNAME_MISSING - "Username is missing."

Modified Files:

assets/admin/change-local-profile.php → assets/admin/local-profile/local-profile.php (renamed + AJAX conversion)
assets/admin/local-profile/local-profile-update.php (new file - AJAX endpoint)
assets/admin/change-local-account.php (dynamic password validation)
assets/base-functions.php (displaySubmitButton enhancement)
assets/routing.php (route update)
assets/languages/en_US/LC_MESSAGES/en_US.po + .mo
assets/languages/hu_HU/LC_MESSAGES/hu_HU.po + .mo
public/index.php (version bump)

v3.03.17 - 2025.11.10

Bug Fixes

Accounts Management (/accounts/edit) - CSRF Token Error
- Problem: Using old SESSION-based CSRF validation
- Solution:
  - Updated to use validateCSRFToken()
  - Backward compatibility: $_POST['csrf_token'] ?? $_POST['csrfToken']
  - Token rotation added on successful operations (UPDATE and INSERT)
- Result: Account editing and creation works ✅
Profile Management (/profile) - Parse Error and CSRF
- Problem 1: Parse error - Unmatched '}' on line 74
  - Cause: Extra closing braces remained in code (lines 72-74)
  - Solution: Removed 3 extra closing braces
- Problem 2: Two different CSRF checks, both using old SESSION-based method
  - Solution: Unified CSRF validation for both forms
  - Token rotation added on both successful operations
- Result: Parse error fixed, profile save works ✅
Companies Management - CSRF Token and JSON Response Error
- Problem 1: Invalid CSRF Token
  - Location: company-update.php (line 29-34)
  - Cause: Using old SESSION-based validation
  - Solution: Updated to use validateCSRFToken()
- Problem 2: Wrong toast color (green instead of red on error)
  - Cause: updateSuccess()/updateFailed() returns string, not JSON
  - Solution: All responses in JSON format
  - Content-Type: application/json header added
  - Token rotation: After every successful operation
- Updated endpoints:
  - company-update.php - Create/Update companies
  - company-delete.php - Company deletion
  - local-account-delete.php - User deletion
- Result: CSRF works, toast colors correct ✅
Companies Management Route - Invalid Character %20
- Problem: URL "Companies management" → "Companies%20management"
- Solution: Space removed → "companies-management"
- NOTE: .po file updated, but .mo file needs recompilation!
- Result: Clean URL without spaces ✅

Modified Files:

assets/admin/change-local-profile.php (Parse error fix + CSRF validation + token rotation)
assets/admin/company-update.php (CSRF validation + JSON responses + token rotation)
assets/admin/company-delete.php (CSRF validation + JSON responses + token rotation)
assets/admin/local-account-delete.php (CSRF validation + token rotation)
assets/languages/en_US/LC_MESSAGES/en_US.po (URL fix)
public/index.php (version bump)

v3.03.16 - 2025.11.10

Bug Fixes

First Password Change - Critical Bugfixes
- Problem 1: Save button didn't activate even when both passwords matched
  - Cause: toggleAttribute("disabled") toggled disabled state on every keyup
  - Solution: Using removeAttribute("disabled") instead (line 187)
  - Result: Button becomes active immediately when passwords match ✅
- Problem 2: Backend didn't check if new password differs from old one
  - Solution: Added password_verify() check against current hash (line 100-108)
  - Error message: TEXT_HELP_PWD_DIFFERENT displayed if passwords are same
  - Result: User cannot set the same password ✅
- Problem 3: Logout and redirect conflict
  - Cause: logoutSession() sent Location header conflicting with JSON response
  - Cause 2: Token rotation after session destroy (didn't work)
  - Solution: Manual logout in AJAX-friendly way (line 120-133)
    - Delete session from database
    - Clear cookies
    - Session destroy
    - JSON response without CSRF token (not needed after logout)
  - Result: Frontend JavaScript handles redirect to "/" ✅
Modified Files:
- assets/includes/general/set-new-user-password.php (frontend)
- assets/includes/general/set-new-user-password-handler.php (backend)

v3.03.15 - 2025.11.10

Bug Fixes

Complete CSRF Token Rotation Coverage - All Endpoints Updated
- Problem: Only visitor/traffic modules got token rotation in v3.03.14
- Solution: ALL JSON endpoints updated with automatic token rotation
Camera Module Endpoints (7 files):
- assets/admin/camera/carplate-save.php
- assets/admin/camera/carplate-delete.php
- assets/admin/camera/carplate-remove.php
- assets/admin/camera/carplate-sync.php
- assets/admin/camera/camera-update.php
- assets/admin/camera/camera-delete.php
- assets/admin/camera/camera-test-connection.php
- assets/admin/camera/carplate-import.php
Admin/Settings Endpoints (2 files):
- assets/admin/property-update.php (3 success points)
- assets/admin/property-delete.php
Password Reset:
- assets/includes/general/set-new-user-password-handler.php
Updates in all files:
1. Old SESSION-based CSRF validation → validateCSRFToken()
2. Added rotateAndSendCSRFToken(true) after successful operations
3. Backward compatibility: $_POST['csrf_token'] ?? $_POST['csrfToken']
- Result:
  - ✅ ALL modules support automatic token rotation
  - ✅ Camera management: add/edit/delete/sync/test/import
  - ✅ Property management: create/update/delete
  - ✅ Unified CSRF protection across ENTIRE application
  - ✅ No more "Invalid CSRF token" errors anywhere!

v3.03.14 - 2025.11.10

Enhancements

Automatic CSRF Token Rotation with Client-side Update
- New function: rotateAndSendCSRFToken() in base-functions.php
  - Token rotation after every successful operation
  - New token sent in HTTP header (X-CSRF-Token) AND JSON response (csrf_token)
- Global JavaScript Handler (custom-scripts-header.js)
  - Automatically updates ALL csrf_token fields on page
  - Using $(document).ajaxComplete()
  - Supports both JSON response and X-CSRF-Token header
- Updated Endpoints with Token Rotation:
  - assets/admin/traffic/visitor-carplate-add.php
  - assets/admin/traffic/visitor-carplate-update.php
  - assets/admin/traffic/visitor-carplate-delete.php
  - assets/admin/traffic/visitor-account-update.php
  - assets/data-save.php
- Result:
  - ✅ Multiple operations on same page WORK
  - ✅ Token automatically refreshes after every AJAX operation
  - ✅ No page reload needed
  - ✅ Improved security with token rotation

Bug Fixes

CSRF Token Undefined Variable Bugfix
- visitor-carplate-add.php: $csrfToken → $token (line 20-23)
- visitor-carplate-delete.php: $csrfToken → $token (line 19-22)
- visitor-camera-assignments.php: already fixed in v3.03.13
- Result: Carplate add works even BEFORE save! ✅

v3.03.12 - 2025.11.10

Bug Fixes

CSRF Token System - AJAX Data Key & Validation Fix
- CRITICAL BUG FIXED: Two separate issues resolved
1. AJAX Data Key Problem:
- JavaScript read token from input[name="csrf_token"] (correct)
- But sent as csrfToken: value (incorrect)
- Solution: All AJAX data objects updated: csrf_token: value (correct)
- Updated files (~50+ AJAX calls):
  - assets/js/traffic/movement-scripts.js
  - assets/js/ordering/cart-ui.js
  - assets/admin/traffic/change-visitor-data.php (2 AJAX calls)
  - assets/admin/camera/* (all AJAX calls)
  - assets/admin/change-*.php (all settings files)
2. Backend Validation Problem:
- 6 *-update.php files still used OLD SESSION-based validation
- Old: if ($csrfToken != $_SESSION["csrfToken"])
- New: if (!validateCSRFToken($token))
- Updated backend files:
  - assets/admin/traffic/visitor-account-update.php
  - assets/admin/traffic/visitor-carplate-update.php
  - assets/admin/traffic/visitor-carplate-add.php
  - assets/admin/traffic/visitor-carplate-delete.php
  - assets/admin/camera/visitor-camera-assignments.php
  - assets/admin/camera/carplate-import.php
- Result: Token validation now WORKS everywhere! ✅
- Visitor and camera management working! ✅

v3.03.11 - 2025.11.10

Bug Fixes

CSRF Token System Simplification - Phase 7 (JavaScript Migration)
- CRITICAL: All JavaScript code updated to use new csrf_token field
- This version fixes forms functionality - forms didn't work after Phase 6!
- Updated files:
  - assets/js/traffic/movement-scripts.js (3 replacements)
  - assets/js/ordering/cart-ui.js (meta tag)
  - 13 PHP files with inline JavaScript:
    - change-visitor-type.php, visitor-account-change.php
    - change-gate.php, change-visitor-data.php
    - change-camera-settings.php, change-carplates.php
    - change-application-data.php, change-ldap-data.php
    - change-property-management.php, change-company-management.php
    - change-company-data.php, change-local-account.php
    - menu-gate-list.php
- All token references: csrfTokenXXX → csrf_token
- Forms now work with new token system
- Next step: Remove legacy functions (Phase 8)

v3.03.10 - 2025.11.10

New Features

CSRF Token System Simplification - Phase 6 (Admin/Settings & General Forms)
- Admin/Settings and general forms migrated to new CSRF system
- 10 files updated writeCSRFToken() → writeCSRFTokenField()
- Migrated files:
  - assets/admin/change-company-data.php
  - assets/admin/change-company-management.php
  - assets/admin/change-property-management.php
  - assets/admin/change-local-account.php
  - assets/admin/change-local-profile.php (2 forms)
  - assets/admin/change-application-data.php
  - assets/admin/change-ldap-data.php
  - assets/includes/general/set-new-user-password.php
  - assets/includes/general/login-card.php
- ALL PHP forms now use csrf_token field
- Backward compatibility: JavaScript still uses old field names (Phase 7)
- Next step: JavaScript update (Phase 7)

v3.03.9 - 2025.11.10

New Features

CSRF Token System Simplification - Phase 4 (Camera Module)
- Camera module forms migrated to new CSRF system
- 2 files updated writeCSRFToken() → writeCSRFTokenField()
- Migrated files:
  - assets/admin/camera/change-camera-settings.php
  - assets/admin/camera/change-carplates.php
- All Camera module forms now use csrf_token field
- Backward compatibility: JavaScript still uses old field names (Phase 7)
- Next step: Ordering module (Phase 5)

v3.03.8 - 2025.11.10

New Features

CSRF Token System Simplification - Phase 3 (Traffic Module)
- Traffic module forms migrated to new CSRF system
- 7 files updated writeCSRFToken() → writeCSRFTokenField()
- Migrated files:
  - assets/admin/traffic/change-visitor-type.php
  - assets/admin/traffic/visitor-account-change.php
  - assets/admin/traffic/change-visitor-data.php
  - assets/admin/traffic/change-gate.php
  - assets/includes/traffic/movements/gate-traffic.php
  - assets/includes/traffic/modal-leave.php
  - assets/includes/traffic/menu-gate-list.php
- All Traffic module forms now use csrf_token field
- Backward compatibility: JavaScript still uses old field names (Phase 7)
- Next step: Camera module (Phase 4)

v3.03.7 - 2025.11.10

New Features

CSRF Token System Simplification - Phase 2 (Core Validation)
- data-save.php migrated to new simplified CSRF system
- Supports both new (csrf_token) and old (csrfToken) tokens
- Automatic token rotation after successful operations
- Backward compatibility maintained: old tokens still work
- Validation priority:
  1. Use new simplified token (csrf_token) if exists
  2. Fallback to old token system if new one not received
- Timing-safe comparison with validateCSRFToken() function
- Next step: Migrate modules to new system (Phase 3-6)

v3.03.6 - 2025.11.08

New Features

CSRF Token System Simplification - Phase 1 (Foundation)
- New simplified CSRF token functions added (base-functions.php)
- Single token usage per session (instead of 13)
- Token rotation implemented after successful form submission (better security)
- New functions:
  - generateCSRFToken() - Token generation
  - validateCSRFToken() - Token validation (timing-safe)
  - rotateCSRFToken() - Token rotation
  - writeCSRFTokenField() - HTML field output
  - getCSRFToken() - Token retrieval for JS/AJAX usage
- Old system still works (backward compatibility)
- Start of gradual migration (Gradual Migration - Option A)

v3.03.5 - 2025.11.08

Bug Fix

After exit, the leave_notes field value must be cleared.

v3.03.4 - 2025.11.08

Bug Fix

New row didn't appear without page refresh at gate entry (gate-traffic.php)
- data-save.php: HTML response was not output in "traffic_save" case
- Echo statement on lines 787-788 was commented out
- Solution: Added echo immediately after HTML construction (line 693)

v3.03.3 - 2025.11.07

Bug Fix

Primary carplate and entry permission values were not passed when using resync button
- change-visitor-data.php: Fixed field identifiers for resync button
- $('#entry_permission') → $('#entry_allowed')
- $('#default_carplate') → $('#primary_carplate')

v3.03.2 - 2025.11.07

New Features

Pending Synchronization Handling
- On failed camera connection, carplates enter "pending" status
- Warning message appears in visitor editor when synchronization is pending
- "Resync" button added to retry pending carplates

Bug Fixes

visitor-account-update.php structural issues fixed
- Removed duplicate if blocks
- Made UPDATE query accessible when data changes
- Cleaner code structure and logic
Use 'pending' status instead of 'failed' on unsuccessful sync
- visitor-camera-sync.php: Mark as 'pending' on failed upload/verification
- pending_count return value instead of failed_count

Translation Strings

10 new translation strings added (en_US.po, hu_HU.po):
- TEXT_LABEL_CAMERA_SYNC, TEXT_HELP_CAMERA_SYNC_AUTO
- TEXT_NO_CAMERAS_SELECTED, TEXT_CAMERAS_SELECTED
- TEXT_BTN_RETRY_SYNC, TEXT_MSG_PENDING_SYNCS
- TEXT_LABEL_PENDING_PLATES, TEXT_SYNCING
- TEXT_RESP_SYNC_RETRY_SUCCESS, TEXT_RESP_SYNC_RETRY_FAILED

v3.03.1 - 2025.11.07

Bug Fix

Camera selection removal didn't work when editing visitor
- visitor-account-update.php: Detect camera assignment change even with empty array
- Compare previous and new camera lists on every save
- Sync always runs if camera assignment changed (even with empty list)
Missing translation strings added (en_US.po, hu_HU.po)
- TEXT_RESP_NO_CAMERAS_ASSIGNED
- TEXT_RESP_NO_PLATES_TO_REMOVE
- TEXT_RESP_REMOVED_FROM_CAMERAS
- TEXT_RESP_SYNC_SUCCESS
- TEXT_RESP_SYNC_PARTIAL

v3.03.0 - 2025.11.XX (WIP)

New Features

Unified Visitor-Camera Management
- Automatic synchronization of visitor carplates to cameras on save
- traffic_carplates table extended (country code, validity dates)
- traffic_carplate_camera junction table (carplate ↔ camera sync status)
- Automatic removal from cameras when deleting visitor/carplate
- Automatic country code detection from carplate
- Three operating modes: TRAFFIC-only, CAMERA-only, BOTH

Bug Fix

Camera removal didn't work when editing visitor (clearing checkbox selection)
- syncTrafficCarplatesToCamera() now supports empty list upload
- removeTrafficCarplatesFromCamera() now always syncs, even with empty list
- New message added: "Camera whitelist successfully cleared"

Database Changes

traffic_carplates: +5 columns (country_code, effective_start_date, effective_end_date, created_at, updated_at)
traffic_carplate_camera: new junction table for sync status tracking

Backward Compatibility

TRAFFIC-only clients: NO changes, 100% compatible
New columns are NULL if not used

v3.02.1 - 2025.11.07

Bug Fix

label-adjust.js didn't work on AJAX-loaded content (change-visitor-data.php)
- Manual label width setting added to visitor editor form
- Runs with 50ms delay after DOM rendering
- Automatic equal width for all .input-group-text labels

v3.02.0 - 2025.11.07

New Features

Visitor carplate management with AJAX operations
- Add, edit, delete carplates with AJAX
- Automatic validation using camera-functions.php
- 30+ EU/Balkan country recognition with flag display
- Inline editing with visual feedback
- Automatic primary carplate update
- Bootstrap modals instead of prompt/alert
- 4 new AJAX endpoints (add, update, delete, list)

Modifications

Convert form fields to input-group layout
- Switch from floating labels to input-group-text labels
- Use <label> element instead of <span> with for attribute
- Uniform appearance with label-adjust.js support
Primary carplate automatically updates on save

Bug Fixes

Fixed carplate editing auto-save
Fixed delete button multiple clicks
Enter key support in modals

v3.01.0 - 2025.11.07

Modifications

Camera carplate editor reorganization
- Camera selector panel removed from page top
- Inline checkbox list under company selector
- Display only active cameras
- Automatic checkbox selection when loading carplate
Whitelist/blacklist toggle removed
- All carplates treated as whitelist
- Simplified user interface
Display inactive cameras below active ones

v3.00.0 - 2025.11.02

New Features

1. Camera Module (ANPR - Automatic Number Plate Recognition)

Hikvision ANPR camera integration via ISAPI protocol
Camera settings page (IP, port, HTTPS, username, password with AES-256-CBC encryption)
Camera allowed vehicles management (carplate whitelist)
Import carplates from allowed parking permissions
Duplicate carplate checking, CRUD operations
Camera connection testing, status checking
AJAX API endpoints for camera management (7 new endpoints)

2. Property Management

New complete property management interface for sysadmin
Property CRUD operations (create, edit, delete, list)
Property data: name, short name, address, email, phone, logo
Assign companies to properties (using company_property_id field)
Referential integrity check on deletion (checking active company count)
Two-panel interface: list panel + editor panel
4 new AJAX endpoints for property management

3. Company Management Enhancements

Company management access redesign: sysadmin (all companies) + siteadmin (own company only)
Siteadmin users automatically loaded with their own company
Conditional UI display: hidden company list for siteadmin, full-width editor
Logo upload system on all three company editor screens:
- File upload with AJAX, preview at 50x50 px
- Automatic image conversion to JPG format
- Image resizing to max 250x250 px, preserving aspect ratio
- Filename sanitization: lowercase, hyphenated, only [a-z0-9-] characters
- Files saved to /upload directory (outside DOCROOT)
- Old logo automatically deleted on new upload
Standard Bootstrap input-group layout everywhere (140px wide labels)

4. Permission Management Redesign

New helper functions:
- getUserType(int $userId): ?int - Get user type
- getUserCompanyId(int $userId): ?int - Get user company ID
Access permissions redesign:
- Sysadmin (usertype 2): all functions, all companies and properties
- Siteadmin (usertype 1): edit own company only
- Conditional access validation on all AJAX endpoints
CSRF token protection on all POST operations

5. New Helper Functions

sanitizeLogoFilename(string $name, string $suffix): string - Filename sanitization for logos
processLogoImage(string $source, string $dest): bool - Image processing (resize, conversion)
getUploadDir(): string - Get upload directory path
deleteLogoFile(string $filename): bool - Secure logo file deletion
isReallyEmpty($value): bool - Empty value check (0, "0" not empty)

6. Database Changes

settings_camera table creation (camera data storage)
settings_camera_carplates table (camera whitelisted carplates, many-to-many relationship)
settings_property table activation (property data)
settings_companydata.company_property_id field usage (company-property relationship)

7. UI/UX Improvements

Unified Bootstrap 5 based input-group layout
Two-panel layout (list + editor) on administrative pages
Real-time AJAX upload for logos with immediate preview
Conditional UI elements display based on user permissions
Toast messages for all AJAX operation feedback
Image gallery preview for uploaded logos

8. Routing and Navigation

New route: URI_FUNC_PROPERTY (/ingatlan) - Property management page
New route: URI_FUNC_CAMERA - Camera settings page
New route: URI_ACTION_CAMERA_SETTINGS - Camera settings
New route: URI_ACTION_CARPLATES - Allowed carplates
New menu items in offcanvas menu:
- Property management (sysadmin)
- Camera settings (sysadmin + siteadmin)
- Camera carplates (sysadmin + siteadmin)

9. Security

AES-256-CBC encryption for camera passwords
CSRF token validation on all data modification operations
Prepared statements in all SQL queries
File upload validation (size, type, content checking)
Access permission checking on all AJAX endpoints
Referential integrity check before deletion

10. Multilingual Support

150+ new translation keys added (English + Hungarian):
- Camera module translations (30+ keys)
- Property management translations (20+ keys)
- Logo upload translations (11 keys)
- Company management additional translations (15+ keys)
- Error messages and tooltips (40+ keys)
- URI translations for new routes (10+ keys)
All .po and .mo files updated

11. API Integration

Hikvision ISAPI XML-based REST API communication
17 new AJAX endpoints:
- Camera CRUD operations (4 endpoints)
- Camera connection testing (1 endpoint)
- Carplate management (3 endpoints)
- Property management (4 endpoints)
- Company management additions (3 endpoints)
- Logo upload (2 endpoints)

Statistics

Modified files: ~50
New lines of code: ~3500+
New database tables: 4
New API endpoints: 17
New translation keys: 150+

v2.01.0 - 2025.10.18

New Features

Ordering page (checkout flow, cart, filtering)
Past orders section on the user side
Admin order summaries plus daily delivery sheet generation

v2.00.1 - 2025.10.07

Bug Fix

Local user management

v2.00.0 - 2025.08

New Features

Modular architecture with three modules:
- Traffic log
- License plate recognition with Hikvision ANPR cameras
- Ordering

v1.02.2 - 2025.07.25

Bug Fix

(#92) Password length validation error

v1.02.1 - 2025.07.06

New Features

Clicking the version number now opens the changelog
- Installed league/commonmark

Modification

(#89) Record gate movements with dynamic table refresh

v1.01.1 - 2025.04

New Features

(#79) Limit failed login attempts
(#73) Implement CSRF token protection

Modification

(#85) Changed TIMESTAMP columns to DATETIME in SQL to avoid the Y2038 issue
(#84) Moved LoginSessionInterval and FailedBlockDuration values into the database
- (#75) Automatic logout after X minutes of inactivity
(#83) Clean up session and blocking records via DB event instead of on every run
(#71) Harden SQL queries

v1.01.0 - 2024.10.17

New Features

(#81) Let users edit their own profile data and change password

Modification

(#65) Pagination for parking permits
(#82) Configure minimum password length in the ENV file

Bug Fix

(#77) Hide broken image icon on login if no logo is set
(#78) Show the offcanvas menu even if no movement exists yet

v1.00.00 - 2024.09.23

New Features

(#50) Collapsible sidebar menu (offcanvas)
(#51) Fully mobile-friendly layout
(#61) Separate parking permits and single-use visitors
(#67) Load movements for the last used gate on login (default gate)
(#68) Language selector
(#52) Local user authentication
(#66) Company logo upload on company profile

Modification

Design: input radius 0 px; font-size 0.9rem
Design: login dialog centered within viewport without border
Rewrite changelog into Markdown
Bootstrap Icons upgrade 1.10.2 → 1.x
Bootstrap upgrade 5.1.3 → 5.x
jQuery upgrade 3.6.1 → 3.x
Load Bootstrap and jQuery via jsDelivr CDN
Update copyright text and remove year
Convert translations to gettext (PO) format

Bug Fix

If the session cookie is missing from the DB, delete the received cookie + session (protect against stolen cookies)
Move PHP debug configuration from index.php to config.php
(#54) Set default timezone
(#58) Keep entry type for known visitors
(#59) Fix displayed parking options for existing visitors
(#62) Visitor name is required
(#64) Hide table columns responsively when resizing the movement table
(#69) Show empty page if no default gate exists
(#76) Limit logo dimensions
(#60) Allow deletion of existing license plates

v0.08.01 - 2022.12.13

Modification

(#49) Reduce retroactive event logging window to 10 minutes

v0.08.00 - 2022.11.20

Modification

Bootstrap upgrade 5.1.3 → 5.2.2
Bootstrap Icons upgrade 1.8.3 → 1.10.2
jQuery upgrade 3.6.0 → 3.6.1
jQuery UI upgrade 1.13.1 → 1.13.2

Bug Fix

(#46) Fix column wrapping on parking permit list
(#45) Review line weights after Bootstrap upgrade
(#44) Fix button and tooltip border radius on login screen

v0.07.00 - 2022.11.20

New Features

(#4) Pre-fill “Who they visit” field from the last event
(#10) Persist In/Out switch state per user
(#41) Autocomplete for “arrived from” and “going to” inputs
(#43) Allow filtering parking permits by license plate

v0.06.001 - 2022.11.18

New Features

(#12) PHP version check

Bug Fix

Missing translation key for Nexon query result-empty state

v0.06.000 - 2022.11.18

New Features

(#42) Colorize the leading “i” icon when a note already exists
(#31) Passenger car vs. truck selector

v0.05.000 - 2022.11.17

New Features

(#38) Nexon presence query from MS SQL Server
(#38) Print.js integration (https://printjs.crabbly.com/) for nicely formatted reports

Known Issues

Production MSSQL connection still hits an OpenSSL error

v0.04.000 - 2022.08.13

New Features

(#36) Clear ID card number when the visitor leaves

Modifications

Optimize and simplify code that checks entry and exit timestamps

v0.03.001 - 2022.08.12

Fixes

Validate timestamps even when the user just focuses the field (not only on input)

v0.03.000 - 2022.08.12

New Features

(#34) Move JS form-validation helpers into a dedicated file so they can load earlier
(#30) Allow entering both entry and exit timestamps and validate them
(#35) Inactivity watchdog: reload the page after 30 minutes of inactivity to avoid session/self-signed SSL expiry

Modifications

(#33) ID card field is no longer mandatory

Bug Fix

(#32) Sort Excel reports by entry time descending

Pallag43 rendszámfelismerő bejelentkezés

Mozgasnaplo Changelog

v3.10.01 - 2025.12.31

Bug Fixes

v3.10.00 - 2025.11.18

Installation System

v3.09.01 - 2025.11.18

System Configuration Improvements

v3.09.00 - 2025.11.18

System Configuration Overhaul

Documentation / Localization

Profile Enhancements

v3.08.01 - 2025.11.16

Security Enhancements

Documentation

v3.08.00 - 2025.11.16

Major Security Enhancements

Technical Improvements

Database Schema

Files Added

Files Modified

v3.07.05 - 2025.11.16

Security Update

v3.07.04 - 2025.11.16

Backend Development

v3.07.03 - 2025.11.15

Documentation

v3.07.02 - 2025.11.15

Bug Fixes

v3.07.01 - 2025.11.15

New Features

Bug Fixes

v3.07.00 - 2025.11.15

Major Changes – Top 10 Frequent Visitors Feature

New Features

Backend Enhancements

Frontend Enhancements

UI/UX Enhancements

Language Support

Performance Optimizations

Usage

Files

Summary

v3.06.00 - 2025.11.15

Major Changes – Visitor CSV Import Feature

New Features

Backend Enhancements

Frontend Enhancements

Language Support

Additional Improvements

Usage

Files

Summary

v3.05.00 - 2025.11.14

Major Changes – Unified Entity Management System

New Features

Backend Enhancements

Database Changes

Navigation & Routing

New backend files

Modified files (19)

Language Support

Bug Fixes

SQL File Updates

Performance & Security

Summary

v3.04.02 - 2025.11.11

Enhancements

v3.04.01 - 2025.11.11

Bug Fix

v3.04.00 - 2025.11.10

New Features

v3.03.18 - 2025.11.10

Enhancements

Modifications

Translation Strings

v3.03.17 - 2025.11.10

Bug Fixes

v3.03.16 - 2025.11.10

Bug Fixes