Improves guidance for eQSL mappings by adding a shared-account tip, making the password field label/placeholder explicit about blank-password reuse, and clarifying that passwords are only required for new usernames. The eQSL wiki guide was updated to match this behavior and include a troubleshooting check for first-time username setup.
When editing or creating an eQSL mapping, the password field can now be left blank. Cloudlog will reuse an existing saved password for the same eQSL username. A password is only required when no saved password exists for that username. The mappings form hint text and docs are updated accordingly.
Update .gitignore to ignore /.env and /PluginDirectory/.env. Remove documentation and example plugin assets under docs/ (including awards-plugin-guide, plugin-manager-guide, plugin-system-phase1, qso-hooks-plugin-guide and example plugin folders/archives) to clean up obsolete docs and sample plugins.
Add server-side read-only policy checks for plugins and surface security alerts to admins. Plugin_manager now validates plugin code (collects PHP files and scans for forbidden file/system/exec functions) during install and before enabling; installs are blocked or plugins auto-disabled on violation with a security alert returned. Plugins controller updated to use session validation for login, enforce admin (user_type 99) access, store/display security alerts via a flash session key, and pass a CSRF token to the view. The plugins index view now renders a warning banner for plugin security alerts. Documentation updated to link and include a new QSO Hooks plugin guide for third-party sync plugins.
Automatically disable plugins when runtime errors or invalid plugin entry/metadata are detected. Adds a disable_plugin_after_failure helper to both Cloudlog_hooks and Plugin_manager that marks the plugin as 'disabled' in plugins_model and logs the reason. Cloudlog_hooks now disables plugins for missing hook methods, exceptions in filters/actions, invalid entry paths/class names, include failures, and construction failures. Plugin_manager disables plugins for invalid award method names, instantiation failures, missing award methods, award render exceptions, and include failures. Documentation updated to mention the new auto-disable behavior.
Introduce a plugin framework and management UI: adds Plugin Manager controller, Plugin_awards controller, Plugin_manager and Cloudlog_hooks libraries, Plugins_model, migration (268) to create the plugins table, and views for plugin manager and award pages. Integrates hooks into Logbook_model (qso.filter.before_save, qso.action.after_save, qso.action.after_edit), updates header to show award plugin entries and a Plugin Manager menu link, and bumps migration_version to 268. Also adds .gitignore rules, plugin index placeholder, docs and example plugin packages. The Plugin Manager supports uploading/installing ZIP packages, safe extraction, manifest validation, enable/disable/delete actions, and CSRF protection.
