Peter Goodhall fd49056a98 Enforce plugin read-only policy and show alerts ... Add server-side read-only policy checks for plugins and surface security alerts to admins. Plugin_manager now validates plugin code (collects PHP files and scans for forbidden file/system/exec functions) during install and before enabling; installs are blocked or plugins auto-disabled on violation with a security alert returned. Plugins controller updated to use session validation for login, enforce admin (user_type 99) access, store/display security alerts via a flash session key, and pass a CSRF token to the view. The plugins index view now renders a warning banner for plugin security alerts. Documentation updated to link and include a new QSO Hooks plugin guide for third-party sync plugins.		2026-04-30 23:03:29 +01:00
..
examples/plugins	Add plugin system and Plugin Manager	2026-04-29 22:33:22 +01:00
awards-plugin-guide.md	Add plugin system and Plugin Manager	2026-04-29 22:33:22 +01:00
plugin-manager-guide.md	Auto-disable plugins on runtime failures	2026-04-29 22:44:10 +01:00
plugin-system-phase1.md	Enforce plugin read-only policy and show alerts	2026-04-30 23:03:29 +01:00
qso-hooks-plugin-guide.md	Enforce plugin read-only policy and show alerts	2026-04-30 23:03:29 +01:00