Gmer4Lfe 67eabdc17c Route every conf writer through the guarded path ...

Eleven call sites wrote master.conf with tmp+rename and nothing else — no backup, no
parse check, no audit — including the two toggles the UI uses most and the raw editor
that installs a whole hand-edited file.

2026-08-09 19:07:28 -04:00

..

ai.php

Put the Scheduler dock on the same conversation store as everything else

2026-08-09 00:16:09 -04:00

api_test.php

Carry the CSRF token on fetch requests and put mutations behind POST

2026-08-02 10:28:53 -04:00

arrs.php

Carry the CSRF token on fetch requests and put mutations behind POST

2026-08-02 10:28:53 -04:00

auth.php

Carry the CSRF token on fetch requests and put mutations behind POST

2026-08-02 10:28:53 -04:00

board.php

Document the PHP api layer and fix what documenting it exposed

2026-08-02 10:11:39 -04:00

cert.php

Carry the CSRF token on fetch requests and put mutations behind POST

2026-08-02 10:28:53 -04:00

checklist.php

Document the PHP api layer and fix what documenting it exposed

2026-08-02 10:11:39 -04:00

clearlock.php

Document the PHP api layer and fix what documenting it exposed

2026-08-02 10:11:39 -04:00

conf_toggle.php

Route every conf writer through the guarded path

2026-08-09 19:07:28 -04:00

confform.php

Document the PHP api layer and fix what documenting it exposed

2026-08-02 10:11:39 -04:00

config.php

Route every conf writer through the guarded path

2026-08-09 19:07:28 -04:00

create_api_key.php

Carry the CSRF token on fetch requests and put mutations behind POST

2026-08-02 10:28:53 -04:00

docker_action.php

Put every tmpfs path in one place both layers can read

2026-08-08 22:57:29 -04:00

docker_pull_worker.php

Make a container action tell the truth about what happened

2026-08-07 10:20:11 -04:00

docker.php

Document the PHP api layer and fix what documenting it exposed

2026-08-02 10:11:39 -04:00

dryrun.php

Resolve Custom script ids where the scripts actually live

2026-08-08 12:47:26 -04:00

fallback.php

Document the PHP api layer and fix what documenting it exposed

2026-08-02 10:11:39 -04:00

flag_toggle.php

Route every conf writer through the guarded path

2026-08-09 19:07:28 -04:00

import_script.php

Carry the CSRF token on fetch requests and put mutations behind POST

2026-08-02 10:28:53 -04:00

log.php

Document the PHP api layer and fix what documenting it exposed

2026-08-02 10:11:39 -04:00

manual_sync.php

Carry the CSRF token on fetch requests and put mutations behind POST

2026-08-02 10:28:53 -04:00

media.php

Document the PHP api layer and fix what documenting it exposed

2026-08-02 10:11:39 -04:00

monitor_fast.php

Document the PHP api layer and fix what documenting it exposed

2026-08-02 10:11:39 -04:00

monitor_remote.php

Document the PHP api layer and fix what documenting it exposed

2026-08-02 10:11:39 -04:00

monitor.php

Give the AI subsystem one profile table and one collection, read everywhere

2026-08-08 22:35:37 -04:00

movescript.php

Route every conf writer through the guarded path

2026-08-09 19:07:28 -04:00

partnership_ping.php

Document the PHP api layer and fix what documenting it exposed

2026-08-02 10:11:39 -04:00

partnership_settings.php

Carry the CSRF token on fetch requests and put mutations behind POST

2026-08-02 10:28:53 -04:00

partnership.php

Document the PHP api layer and fix what documenting it exposed

2026-08-02 10:11:39 -04:00

rawconf.php

Route every conf writer through the guarded path

2026-08-09 19:07:28 -04:00

readscript.php

Add the AI tab — grounded chat over the documentation index

2026-08-02 17:32:17 -04:00

recent.php

Document the PHP api layer and fix what documenting it exposed

2026-08-02 10:11:39 -04:00

reorderarray.php

Route every conf writer through the guarded path

2026-08-09 19:07:28 -04:00

rsync_profiles.php

Document the PHP api layer and fix what documenting it exposed

2026-08-02 10:11:39 -04:00

rsync_standalone.php

Document the PHP api layer and fix what documenting it exposed

2026-08-02 10:11:39 -04:00

rsync_win_arrays.php

Route every conf writer through the guarded path

2026-08-09 19:07:28 -04:00

rsync.php

Put everything Varaverk persists under one root, state included

2026-08-08 23:26:46 -04:00

run.php

Resolve Custom script ids where the scripts actually live

2026-08-08 12:47:26 -04:00

savefolders.php

Document the PHP api layer and fix what documenting it exposed

2026-08-02 10:11:39 -04:00

scheduler.php

Document the PHP api layer and fix what documenting it exposed

2026-08-02 10:11:39 -04:00

script.php

Carry the CSRF token on fetch requests and put mutations behind POST

2026-08-02 10:28:53 -04:00

scriptinfo.php

Document the PHP api layer and fix what documenting it exposed

2026-08-02 10:11:39 -04:00

settings.php

Document the PHP api layer and fix what documenting it exposed

2026-08-02 10:11:39 -04:00

setup.php

Route every conf writer through the guarded path

2026-08-09 19:07:28 -04:00

snapshot.php

Document the PHP api layer and fix what documenting it exposed

2026-08-02 10:11:39 -04:00

status.php

Document the PHP api layer and fix what documenting it exposed

2026-08-02 10:11:39 -04:00

stop.php

Stop signalling on the strength of a stat file alone

2026-08-08 13:50:01 -04:00

storage.php

Document the PHP api layer and fix what documenting it exposed

2026-08-02 10:11:39 -04:00

system.php

Stop the dashboard polling harder than its data can change

2026-08-07 10:23:13 -04:00

watchdog.php

Document the PHP api layer and fix what documenting it exposed

2026-08-02 10:11:39 -04:00

webhook.php

Carry the CSRF token on fetch requests and put mutations behind POST

2026-08-02 10:28:53 -04:00