Refactors the callsign/gridsquare search to support exact match toggling, partial/broad match fallback, and a recent searches history stored in localStorage. Search terms are now passed via GET parameters (bookmarkable URLs) instead of POST. The advanced filter panel gains result count badges, a clear button, and persists query rules across page loads. DataTable initialization is extracted into reusable helpers.
Add the `search` route to the shared Leaflet include checks in the main and mini headers plus the footer. This ensures search pages load the map CSS and scripts needed for Leaflet-based UI elements.
Add a persisted `force_amsat` OscarWatch user option, expose it on the user edit form, and keep the AMSAT upload setting in sync when OscarWatch status uploads are enabled. The controller now defaults unchecked values correctly and shows a notice when OscarWatch disables direct AMSAT uploads or when the override keeps both enabled.
Enhances satellite mode detection in `Logbook_model` by adding explicit CSS FM cross-band handling based on TX/RX bands and expanding per-satellite mode maps. FM transponder aliases (`V/U`, `U/V`) are now recognized for SO-50/SO-124/SO-125/PO-101, and ISS/ARISS mappings now cover repeater aliases plus `V` as Packet to improve mode label consistency.
Adds full user-setting support for OscarWatch SAT status uploads: new per-user `status_upload` option initialization, save/load wiring, and session hydration. The user edit page now includes an enable/disable selector plus a “Test Token” action that calls a new `validate_oscarwatch_token` controller endpoint to verify tokens against OscarWatch and return clear JSON status messages. Logbook SAT upload logic is updated so AMSAT and OscarWatch uploads are handled independently based on their respective user toggles.
This adds optional OscarWatch integration for SAT QSOs: users can store an OscarWatch API token in account settings, and Cloudlog now reports SAT status uploads to OscarWatch alongside AMSAT uploads when enabled. It includes payload building, mode remapping for common satellites/modes, timestamp/grid handling, and error logging for failed submissions. The edit flow was also updated to load/save these options for the correct edited user, and the account label was generalized from “AMSAT Status Upload” to “Satellite Status Upload.”
When Clublog returns HTTP 403 (access denied), automatically clear the stored credentials and optionally send the user an email notification with context about the failure. Also sets a session flash warning when the affected user is logged in. Adds an email view template for the notification.
Introduces a new `station_profile.clublogcron` flag (migration 276) and wires it into station create/edit save flows so users can explicitly enable locations for `/clublog/upload`. Clublog station selection now only includes enabled locations (with fallback to `clublogrealtime` if the new column is not present), and the dashboard shows a warning when Clublog credentials exist but no station is enabled. It also tightens Clublog upload-status query grouping and fixes `Clublog::uploadall` return flow so upload results are returned consistently.
- Fix returnStatus() to evaluate all band statuses before returning, so 'C' takes priority over 'W' across all bands instead of returning on first match
- Add band preset buttons (HF Only, VHF/UHF+, SAT Only, All, Clear) to the DXCC filter form
- Update map legend to show total worked count (confirmed + unconfirmed) alongside the unconfirmed breakdown
Wires missing DXCC map filters through the request pipeline. The frontend now submits `year` and `eqsl` with the map AJAX payload, and the Awards controller now reads/sanitizes `year` into `postdata` so year-based filtering can be applied server-side.
Replaces the single band dropdown on the DXCC awards page with a group of checkboxes allowing multiple bands to be selected simultaneously.
- Controller and model updated to accept `bands[]` array instead of a single `band` value
- `addBandToQuery()` in Dxcc model now handles array input, building appropriate IN clauses and SAT propagation mode logic
- `returnStatus()` priority fixed: Confirmed (C) now takes precedence over Worked (W); unworked entries now return 'x' instead of null
- JS updated to collect checked band values; map and filter reset functions updated accordingly
- Uninitialized `$newdxcc`/`$newiota` arrays now explicitly initialized before use
Add granular failure reason tracking to Eqsl_mappings_model via last_failure_reason and last_db_error properties. Controller now differentiates between encryption failures, schema migration errors (DB error 1406), and generic DB errors, providing more actionable user-facing messages and structured error logging.
Adds migration 275 to convert eQSL password columns to TEXT and encrypt existing user/mapping passwords with an `enc:` prefix. Updates eQSL controller/model flows to decrypt on read, encrypt on create/update, and keep plaintext backward compatibility for legacy rows. User profile updates now avoid reusing stored ciphertext when no new password is submitted, and mapping updates report a clear error if secure password storage fails.
Enhances the eQSL mappings form to better support shared usernames by detecting existing usernames, guiding users with contextual hints, and automatically enabling password reuse behavior unless explicitly overridden. It also disables browser autofill/correction on sensitive fields and adds a visual “Reusable password” indicator in the mappings table.
Improves guidance for eQSL mappings by adding a shared-account tip, making the password field label/placeholder explicit about blank-password reuse, and clarifying that passwords are only required for new usernames. The eQSL wiki guide was updated to match this behavior and include a troubleshooting check for first-time username setup.
When editing or creating an eQSL mapping, the password field can now be left blank. Cloudlog will reuse an existing saved password for the same eQSL username. A password is only required when no saved password exists for that username. The mappings form hint text and docs are updated accordingly.
Adds a `qso_show_profile_image` JS flag from the user session and updates callbook panel rendering to honor it. The panel now omits the image column when profile images are disabled, keeps the empty-image message only when images are enabled, and applies a single-column layout class for no-image states.
Gate the QSO callbook tab on the configured callbook provider instead of the profile image setting. The controller now exposes a `show_callbook_tab` flag when the user's callbook type is `HAMQTH` or `QRZ`, and the view uses that flag for both the tab button and pane.
Canonicalize activator callsigns and combine results for variant forms such as portable suffixes and MM/MW prefixes. This updates activator listings, max-grid counts, and contact details to aggregate grids across matching calls while keeping the table output consistently sorted.
Extends Gridmap and Activated Gridmap to accept a new `sat_orbit` filter and applies it across worked/confirmed grid and VUCC queries, including SAT-specific SQL filtering for LEO, MEO (IO-117), and GEO (QO-100). Updates the gridmap UI to show/hide orbit controls with SAT selection, sends the new filter in AJAX requests, and adds activated-grid summary cards with worked/confirmed counts and satellite class breakdown data from new model methods.
Updates the migration target to 273 and adds a new migration to tag Cloudlog as 2.8.16. The migration sets `options.version` to `2.8.16` and resets `user_options` version dialog confirmation so users see the version info dialog; the down migration restores the version value to `2.8.15`.
Refactored the callsign profile display from a separate hidden card to an integrated tab-based interface. The new callbook tab includes a responsive grid layout with profile image, external links (QRZ and HamQTH), and metadata fields (name, QTH, locator, IOTA). Added proper HTML escaping for security and improved visual organization with Bootstrap 5 styling.
Add 'logbookadvanced' controller to the list of routes that require Leaflet map assets. Also conditionally load easyprint.js only when Leaflet is enabled to reduce unnecessary script loading.
#3453 Fixed
Add the `labeltable` class to the labels table and switch the checkbox handler to a delegated `change` event. The uncheck logic is now scoped to the current table so only labels in the same list are affected.
Leaflet CSS/JS assets are now loaded conditionally in shared headers/footers so map libraries are only included on pages that need them. For the QRB calculator dialog, Leaflet is loaded on demand in `common.js`, and the `newpath` map-rendering function was moved into the QRB view so the modal still works when global map scripts are skipped. Also adds a small HTMX updating indicator to the dashboard’s Today’s QSOs section.
Bumps the configured migration target to 272 and adds migration `272_tag_2_8_15`. The new migration updates the app version in `options` to `2.8.15` and resets `user_options` version dialog confirmation so users see release info. The `down()` method rolls the version value back to `2.8.14`.
Replace fragile quoted-implode station lists with normalized integer CSVs and where_in usage to ensure station_id lists are numeric. Add normalize_location_list helpers in multiple models (Lookup_model, Sig, Timeline_model) and update controllers to cast inputs (e.g. dxcc_id) to ints. Escape user-supplied SQL fragments with $this->db->escape_str/escape_like_str and sanitize band/mode parameters; consolidate band/mode filtering into add_band_mode_filters in Timeline_model. Add guards for empty location lists (returning empty results) and a method_exists check around a legacy vucc_shit call. Overall this improves input validation and reduces SQL injection risk while removing duplicated list-building logic.
Replace string-quoted station_id lists with comma-separated, integer-casted lists and harden SQL across awards models. This diff converts constructions like "'a','b'" to implode(',', array_map('intval', ...)) and uses $this->db->escape_str() for band/mode values and band lists to reduce injection/format issues. Added helper methods (addModeToQuery, addBandToQuery variants) to centralize mode/band filtering, parameterized time/mode/band queries in Gmdxsummer_model, and escaped band arrays when building IN() lists. Also added null/empty-checks for logbook arrays in several models and small refactors (e.g. VUCC addBandToQuery) to keep SQL building consistent.
Sanitize location lists and escape query parameters across multiple models to prevent SQL injection and fix query formatting. Changes include: converting location arrays to comma-separated integer lists (array_map('intval')) instead of quoted implode, adding escape_str for band/mode/sat, adding a sanitize_location_list helper and early-return checks in CQ, escaping band lists, and updating Adif_data date where clauses to use $this->db->escape(..., NULL, FALSE). Files modified: Accumulate_model, Activated_gridmap_model, Adif_data, Cq, and Gridmap_model.
Replace ad-hoc xss_clean calls with explicit casting and stronger type checks for ID/parameter handling, and convert many raw SQL strings to CodeIgniter Query Builder usage. Added normalize_location_ids helpers (Activators_model, Oqrs_model) to safely parse location lists and used where_in/parameter binding/escaping to avoid injection and improve maintainability. Also adjusted session user_id handling, improved LIKE/DATE/TIMEDIFF usage, and tightened several model/controller methods (Labels, Activators, Bands, Contesting, Labels_model, Modes, Oqrs_model, Qsl_model, Setup_model, Sstv_model, User_model) for safer, clearer DB queries and inputs.
Replace concatenated SQL with CodeIgniter query builder across models to improve safety and readability. Changes in Cat, Contesting_model and Oqrs_model convert raw SQL strings into active-record calls, add integer casting for ID/station values, use select/from/join/where/order_by/get patterns, and simplify delete/query flows. Affected methods include radio_status, multiple contest-related selects/inserts/deletes, and several oqrs/station_profile queries.
Normalize incoming ID parameters to integers and replace concatenated/raw SQL with CodeIgniter query builder. Controllers (Contesting.php, Themes.php) now cast $id to (int) instead of using xss_clean; models (Contesting_model.php, Themes_model.php) cast $id and use $this->db->where()/get()/select() to build queries. This improves type safety and reduces risk of injection while using more idiomatic CI DB APIs.
Replace direct lang('prev')/lang('next') calls with localized labels using general_word_previous and general_word_next language lines (falling back to 'Previous'/'Next'). Adds $prev_label and $next_label and updates the pagination links/spans to use them, improving localization support for the previous-contacts pagination.
Introduce window.cloudlogLastCatData and window.cloudlogLastCatRadioId to cache the last CAT response and radio ID, set on successful CAT poll and cleared on UI reset. Add isSatelliteLookupContext() in qso.js to centralize logic for detecting satellite lookup context using UI fields or the cached CAT data, and replace scattered sat_name checks with this helper. This makes satellite lookups more reliable when CAT populates fields and avoids duplicated logic across handlers.
In Logbook_model, only sanitize 'a_index' and 'age' when the input is not an empty string; if filter_var returns an empty string or false, set the variable to NULL. This prevents empty/invalid sanitized values from being treated as valid numeric inputs.
Replace hardcoded '/tmp' sess_save_path with a dynamically generated temp directory based on sys_get_temp_dir() and a hash of the installation path (realpath(FCPATH)). Create the directory with 0700 permissions if it does not exist. Changes applied to application/config/config.sample.php and install/config/config.php to avoid shared /tmp collisions and improve session isolation/security.
Replace hardcoded encryption key in installer with a %encryption_key% placeholder and generate a unique per-install key during installation (uses random_bytes, falls back to openssl_random_pseudo_bytes or sha1(uniqid)). Inject the generated key into config.php. Also tighten User_Model::validate_session(): return early if no user_id, clear session if user_hash is missing, re-read the user from the database to verify user_type before authenticating, and refresh or clear the session accordingly. These changes improve security by using a unique encryption key per install and by validating session state against persisted user data.
Update migration_version to 271 and add Migration_tag_2_8_14. The new migration sets options.version to 2.8.14 and resets user_options (version_dialog/confirmed) to 'false' to trigger the version info dialog for users. The down() method reverts options.version back to 2.8.13.
Introduce an advanced search status display and persist UI state for the Logbook Advanced view. Adds CSS and a status span to show result/selection counts and transient messages. Implements setAdvancedSearchStatus(), getVisibleColumnIndex(), restoreAdvancedSearchUiState() and persistAdvancedSearchUiState() to update status, handle visible columns dynamically, and save/restore collapsed sections and the QSO results selection via localStorage. Also adds client-side date range validation, sets status messages during load/search/failure, and updates status when rows are selected/unselected. Adjusts band/mode column lookups to respect visible columns.
Decode the PHP $options JSON into an object, ensure pota/operator/stationLocation keys exist (each with show:'true') when missing, and emit user_options via json_encode. Replace the previous string-based JS assembly with a robust PHP-side normalization and set $options for the view to the normalized object. Also add a defensive JS check around user_options.operator.show to avoid runtime errors when operator is absent.
Avoid double-processing of the Escape key by setting a timestamp (window.cloudlogQsoEscHandledAt) when handling the QSO-escape keydown and short-circuiting subsequent handlers within 500ms. Also broaden the SAT field restore logic in resetQsoEntryOnEscape to restore sat_name/sat_mode when preSatMode exists or when the previous propagation mode was SAT (not just when preSatName is present). These changes prevent accidental duplicate resets and ensure SAT fields are correctly restored.
Track and return whether any QSOs were actually uploaded to Clublog and log/report when none are pending. index(): introduced $uploaded_any_qsos and aggregate per-user upload results; if nothing uploaded, echo a message and write an info log. uploadUser(): return false on invalid Clublog username (was previously void); added $uploaded_for_user tracking while iterating station profiles and set it when Clublog responds with 'accepted'. uploadUser now returns true when QSOs were uploaded for the user, otherwise false.
