Features for GameNight

[Isorgcom]

Post here any feature requests and ideas for Game night

[Isorgcom]

ass a import / export users for admins.

[Isorgcom]

add a custom Notes field for the user database.

[Isorgcom]

✅ Custom Notes field for the user database has been implemented (commit 361f011).

Admins can now:

• View and edit a Notes field directly in the Users datagrid (Site Settings → Users)
• Set notes when creating a new user
• Edit notes on the full user edit page

[Isorgcom]

✅ Import / Export users for admins has been implemented (commit cef9c93).

Admins can now (Site Settings → Users):

• Export CSV — downloads all users with fields: username, email, phone, role, preferred_contact, notes
• Import CSV — upload a CSV to bulk-create users; existing usernames are skipped; imported users are prompted to change their password on first login
• Sample CSV available to download as a template

[Isorgcom]

when events are cancled, have the option to send email to RSVP'd user that the event was cancled

[Isorgcom]

Dependency cleanup — removed Quill & quill-better-table (commit 80278d3)

Audited all third-party vendor libraries downloaded by Docker at container start. Found that Quill 1.3.7 and quill-better-table 1.2.3 were no longer in use — Jodit replaced Quill as the rich-text editor but the old download blocks and an orphaned CSS link in index.php were never cleaned up.

Removed:

• Quill 1.3.7 download block (3 files)
• quill-better-table 1.2.3 download block (2 files)
• quill.core.min.css link from index.php
• Updated stale CSP comments referencing Quill → Jodit

Active vendors remain: PHPMailer, Jodit, PHPLiteAdmin.

[Isorgcom]

Security Fix: Host Header Injection (commit 155ec2d)

Problem: All email/notification URLs (password reset, email verification, event invites, RSVP links, cron reminders, webhook URLs) were constructed using the untrusted $_SERVER['HTTP_HOST'] header. An attacker could spoof the Host header to redirect users to malicious domains and capture sensitive tokens.

Fix:

• Added get_site_url() helper in db.php that uses a configurable site_url setting with fallback to $_SERVER['HTTP_HOST']
• Added Site URL field in Admin Settings > General tab
• Replaced all 13 $_SERVER['HTTP_HOST'] usages across 9 files

Affected files: db.php, auth.php, auth_dl.php, forgot_password.php, calendar.php, calendar_dl.php, cron.php, rsvp.php, admin_settings.php

Action needed: Set the Site URL in Admin Settings > General to your domain (e.g. https://yourdomain.com).