35c10a7f66
Security findings: - SQL injection: LOW (query builder + parameter binding) - XSS: LOW (ThinkPHP auto-escape, no |raw detected) - Path traversal: LOW (all view paths hardcoded) - CSRF: MEDIUM (ShopXO framework-level gap, out of scope for plugin) Critical fix: admin/Admin.php was missing VenueList(), VenueSave(), VenueDelete() — sidebar URL "/plugins/vr_ticket/admin/venueList" would return 500 error. Added all three methods with v3.0 seat_map support. P1 garbled name: documented DB fix SQL for shx_plugins + vrt_power tables. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| admin | ||
| api | ||
| index | ||
| install | ||
| lang | ||
| module | ||
| plugins | ||
| route | ||
| service | ||
| tpl | ||
| .gitignore | ||
| AppService.php | ||
| BaseController.php | ||
| ExceptionHandle.php | ||
| Request.php | ||
| common.php | ||
| middleware.php | ||
| provider.php | ||
| service.php | ||