Skip to content

2.8.20 - #3479

Merged
magicbug merged 19 commits into
masterfrom
dev
Oct 14, 2026
Merged

2.8.20 #3479
magicbug merged 19 commits into
masterfrom
dev

Conversation

@magicbug

Copy link
Copy Markdown
Owner

No description provided.

magicbug and others added 19 commits September 14, 2026 10:45
Update logbook search to accept the callsign as a query parameter and centralize search-term resolution in the controller. This preserves multi-part callsigns like portable or route-style suffixes, keeps exact-match handling intact, and ensures database and external callbook lookups use the normalized full callsign.
CI_Driver_Library loads drivers into undeclared properties
(CI_Cache::$file, CI_Cache::$dummy), which PHP 8.2+ reports as
"Creation of dynamic property ... is deprecated". Mark CI_Driver_Library
and CI_Driver with #[AllowDynamicProperties], as already done for
CI_Controller and CI_Loader. On PHP 7.x the attribute is parsed as a
comment, and subclasses such as CI_Cache inherit it.

Fixes #3146
Use CodeIgniter's standard CI_ENV lookup instead of hardcoding
ENVIRONMENT. The default stays 'development', so existing installs
behave exactly as before; deployments can opt into production with
`SetEnv CI_ENV production` (Apache) or `fastcgi_param CI_ENV production`
(nginx) instead of editing index.php, which conflicts on every update.
…tion

Fix CI_Cache dynamic property deprecation on PHP 8.2+
Allow selecting the environment via CI_ENV
Also sync the Club Log satellite map in AdifHelper with the LoTW map (TEVEL2-1..9, RS95S).
Adds SKCC-SKS, SKCC-SKSA, SKCC-SKSE and SKCC-WES to the contest table.
Default runtime environment was set to development, which can expose debug behavior in normal deployments. This change makes the app default to production unless CI_ENV is explicitly set, aligning the behavior with production-safe defaults.
POST mode looks the prefix up on the QSO date, treats a two-digit year such as 67 as the previous century, and keeps the entity badge readable when the name contains an apostrophe.
The four bulk update methods in Logbookadvanced_model address QSOs by
COL_PRIMARY_KEY, and authorize(2) only proves that the session belongs to a
logged-in user - a primary key says nothing about ownership. Any user could
therefore modify another user's QSOs by passing their IDs.

Scope every one of these updates to the station profiles the requesting user
owns. This reuses the same owner rule the read side already applies in
getQsosForAdif(), so a user can no longer tick (or forge) a row they should
not be able to write.

Ownership is enforced inside the SQL rather than by pre-filtering the ID list,
so IDs that are not owned simply stop matching instead of raising an error.
Add an unauthenticated plugins/cron endpoint that fires cron.action.run, for operators to call from crontab, and fire qso.action.before_delete from Logbook_model::delete() with a QSO snapshot.
The helper only checked that station_id existed in station_profile,
ignoring user_id. Scope the query by user_id so updateStationLocation
cannot assign another user's station profile.

Co-authored-by: Peter Goodhall <magicbug@users.noreply.github.com>
…owner

Scope bulk QSO updates to the owning user
Apply owner-only station_id scoping (matching Logbookadvanced_model
bulk fix in #3477) to paperqsl_update, paperqsl_update_sent, and
qsl_rcvd(). Return Error from qsl_rcvd_ajax and qsl_sent_ajax when
no owned QSO matches.

Spotted by raufaser in #3477.

Co-authored-by: Peter Goodhall <magicbug@users.noreply.github.com>
Scope single-QSO QSL updates to the owning user
Adds migration 285_tag_2_8_20 which sets the stored version option to 2.8.20 and resets the version dialog confirmation so users see the release info. The down() method reverts the version to 2.8.19. Bumps migration_version to 285 in the migration config.
@magicbug
magicbug merged commit 1676e11 into master Oct 14, 2026
1 check failed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants