Rhoerr PRs integration#102

Merged

vpietri merged 39 commits into

mainfrom

May 19, 2026

Commits on Apr 5, 2026

fix: add plugin guards, production mode check, default-off

rhoerr
and
claude
committed
security: add CSRF protection, POST enforcement, cookie allowlist

rhoerr
and
claude
committed
security: mask sensitive data in toolbar output

rhoerr
and
claude
committed
security: systematic XSS remediation across all templates

rhoerr
and
claude
committed
perf: scope observers to frontend/adminhtml areas only

rhoerr
and
claude
committed
security+perf: gate SQL profiler on access check, fix object creation

rhoerr
and
claude
committed
fix: code quality cleanup — DI, dedup, CSP, reflection, dead code

rhoerr
and
claude
committed
fix: correct TypePool API and remove phpinfo bypass

rhoerr
and
claude
committed
fix: correct Reset.php logic and typo

rhoerr
and
claude
committed
fix: escape getUiTabClass() in tabs.phtml class attribute

rhoerr
and
claude
committed

Commits on Apr 6, 2026

Commits on Apr 7, 2026

Commits on Apr 29, 2026

Commits on Apr 30, 2026

Move AccessChecker to Helper and check QDB controllers permission with plugin
vpietri
committed

Commits on May 19, 2026