Add server-side read-only policy checks for plugins and surface security alerts to admins. Plugin_manager now validates plugin code (collects PHP files and scans for forbidden file/system/exec functions) during install and before enabling; installs are blocked or plugins auto-disabled on violation with a security alert returned. Plugins controller updated to use session validation for login, enforce admin (user_type 99) access, store/display security alerts via a flash session key, and pass a CSRF token to the view. The plugins index view now renders a warning banner for plugin security alerts. Documentation updated to link and include a new QSO Hooks plugin guide for third-party sync plugins.
Automatically disable plugins when runtime errors or invalid plugin entry/metadata are detected. Adds a disable_plugin_after_failure helper to both Cloudlog_hooks and Plugin_manager that marks the plugin as 'disabled' in plugins_model and logs the reason. Cloudlog_hooks now disables plugins for missing hook methods, exceptions in filters/actions, invalid entry paths/class names, include failures, and construction failures. Plugin_manager disables plugins for invalid award method names, instantiation failures, missing award methods, award render exceptions, and include failures. Documentation updated to mention the new auto-disable behavior.
Introduce a plugin framework and management UI: adds Plugin Manager controller, Plugin_awards controller, Plugin_manager and Cloudlog_hooks libraries, Plugins_model, migration (268) to create the plugins table, and views for plugin manager and award pages. Integrates hooks into Logbook_model (qso.filter.before_save, qso.action.after_save, qso.action.after_edit), updates header to show award plugin entries and a Plugin Manager menu link, and bumps migration_version to 268. Also adds .gitignore rules, plugin index placeholder, docs and example plugin packages. The Plugin Manager supports uploading/installing ZIP packages, safe extraction, manifest validation, enable/disable/delete actions, and CSRF protection.
Add a full Cabrillo export workflow and harden Cabrillo/QSO formatting. Introduces a modal UI to export contest logs (new button + modal form with fields for location, category time, operators, club, soapbox, date range and other Cabrillo categories). Controller updates pass the new fields to the export action. Cabrilloformat library extended to accept and emit LOCATION and CATEGORY-TIME, improve header field ordering and presence checks, map ADIF modes to the five Cabrillo modes (CW/PH/FM/RY/DG), fix a band label (2.4G -> 2.3G), and emit placeholders for missing received exchanges to preserve column alignment. Contesting_model: more robust date parsing with UTC fallback, ensure session QSO marker only persists when timestamp valid, and build start timestamp when LIVE mode omits start_date/start_time. Frontend JS: setSession() now returns the ajax promise so callers can await it; several callers updated to await setSession and re-fetch session data before refreshing the QSO table; restore full table search on callsign blur and when suggestions are cleared. Misc: small form/input fixes (club field type, default overlay option) and additional server-supplied data loaded into the contesting view (active station id, contest session, station profile). These changes add required Cabrillo fields for certain contests and make exports and session handling more reliable.
Refactor eQSL batch update to operate on resolved primary keys instead of re-matching QSOs by time/callsign/band/mode. Eqslmethods_model now queries current eQSL status by COL_PRIMARY_KEY, builds update batches keyed by primary key, and returns updated_ids and duplicate_ids. This avoids re-querying with un-normalized ADIF modes, improves reliability (avoids CI3 affected_rows() pitfalls), and makes duplicate detection deterministic. EqslImporter was updated to enqueue qso_id for batch updates and to mark QSOs as Updated or Already received based on the returned ID lists.
Fixes a bug where the wrong array key was checked when determining if an eQSL was received. The code previously used $record['qsl_sent']; it now checks $record['eqsl_qsl_rcvd'] to set $qsl_rcvd (or an empty string) using config['eqsl_rcvd_mark'], ensuring imports correctly mark received eQSLs.
Add batch processing for eQSL imports/exports and introduce performance indexes. Bump migration_version to 248 and add Migration_add_eqsl_performance_indexes to create idx_eqsl_qslrdate and idx_eqsl_confirmation_match indexes to speed up eQSL queries and batch matching. Modify Eqsl controller to collect successful uploads and perform a single batch mark-as-sent update. Update EqslImporter to queue confirmations and run a single batch update at the end. Implement eqsl_update_batch() and eqsl_mark_sent_batch() in Eqslmethods_model to perform efficient batch DB operations and logging, reducing per-record queries for large eQSL operations.
Refactors the SOTA CSV download process to stream data directly to a temporary file using cURL, improving memory efficiency and error handling. Replaces the previous string-based CSV extraction with a file-based approach, and adds more robust error messages for file and download failures.
Replaces the old SOTA model with a new Sota_model, adds CSV-based summit metadata caching, and introduces new controller endpoints and view components for SOTA table, stats, and map fragments. The SOTA award page now supports filtering, improved statistics, and interactive mapping using summit coordinates. Updates .gitignore to include the new SOTA CSV, and refactors SOTA data refresh logic for reliability and maintainability.
The third parameter in array_search was set to true, enforcing strict type comparison. This has been removed to allow non-strict comparison, which may improve matching for satellite names.
Introduces logic to detect and enforce centrally managed email settings. When managed, email options are displayed as read-only and cannot be changed by users; attempts to save changes are blocked with a notice. The email options view now conditionally renders a read-only summary and test email form if management is enabled.
Introduces open registration settings in the options area, allowing administrators to enable or disable public user signup. Adds a registration options page, updates sidebar navigation, and implements a public signup form and controller logic. Also refines user model to ensure correct data types for user fields and updates language strings for registration. The login page now links to signup when open registration is enabled.
This addresses issue where Clublog uses the SAT_NAMES from LOTW rather than the real names/oscar numbers.
It also adds a parameter to the AdifHelper library to accept satellite_remap to rename them
