Replaces the callsign+password → JWT flow with a single long-lived
Personal Access Token (pat_*), matching the GitHub/Stripe pattern.
User flow now:
• Sign up on qrzcall.eu (Data or Extra subscription required)
• Account → API Tokens → "Generate new token", label it
(e.g. "Wavelog at home"), copy the pat_… string
• Paste into Wavelog's "QRZCALL.EU API Token" config field
Why this is better than the previous credentials flow:
• The user's QRZCALL.EU password never leaves the SPA
• Each Wavelog install gets its own revocable token
• A leaked Wavelog config exposes a single revocable token,
not the password the user might reuse elsewhere
• The library is simpler: no session cache, no retry-on-expiry,
no /portable-aware re-auth dance — just Bearer on every call
Code changes:
• application/libraries/Qrzcall.php - drops session() and
set_session(), keeps search() and sourcename(). ~30 LOC shorter.
• application/libraries/Callbook.php - QRZCALL_SESSION_DURATION
constant and qrzcall_session_cachekey property removed.
_qrzcall() collapses from ~40 to ~20 LOC.
• application/config/config.sample.php - qrzcall_username and
qrzcall_password replaced with a single qrzcall_token.
• install/config/config.php - same in the wizard's template.
• install/index.php - the wizard now shows a single "API Token"
field when QRZCALL.EU is selected (toggled via JS, no extra
HTML page state machine). callbook_combination() validates
the pat_ prefix when present.
• install/includes/core/core_class.php - refactored to support
both username/password-style providers (qrz/hamqth/qrzcq/qrzru)
and token-style providers (qrzcall) cleanly. Drops the
"all callbooks use the same shape" assumption.
End-to-end re-tested:
✓ Live PAT lookup PA4R via the new library HTTP 200
✓ Unknown callsign XX9XX9XX error: "Callsign not found"
✓ Tampered token error: "Invalid or revoked QRZCALL.EU API token"
✓ Subscription gate (Free user with revoked sub) surfaces upstream 401
✓ php -l clean on all 6 files
✓ All 5 patches dry-run apply cleanly against fresh master
Existing JWT flow on api.qrzcall.eu/v1/auth/login.php remains
available — this PR moves Wavelog to the recommended pattern but
doesn't break anyone who already wired up JWT.
QRZCALL.EU is a QRZ-compatible amateur-radio callsign database
(https://qrzcall.eu/). This adds it as a new 'qrzcall' callbook source
alongside the existing qrz, qrzcq, hamqth, and qrzru providers.
* `application/libraries/Qrzcall.php` — new library, mirrors Qrz.php
* `application/libraries/Callbook.php` — adds case 'qrzcall', `_qrzcall()`
private method, session-duration constant and session-cache key
* `application/config/config.sample.php` — adds `qrzcall_username` /
`qrzcall_password` defaults
* `install/index.php` — adds QRZCALL.EU to the install-wizard callbook
dropdown and extends the tooltip
* `install/config/config.php` — adds `%qrzcall_username%` /
`%qrzcall_password%` placeholders so the wizard writes the credentials
into the generated config
* `install/includes/core/core_class.php` — adds 'qrzcall' to the
$callbooks whitelist
Auth: callsign + password → JWT (cached 7h). The bearer pattern is
hidden behind the existing "session key" abstraction so the Callbook
orchestrator's retry-on-expiry and /portable fallback paths work
unchanged.
Access tier: requires a Data or Extra subscription on QRZCALL.EU.
XML schema: identical field names to QRZ.com → no downstream changes
to the QSO entry form.
This commit squashes multiple security fixes related to the installer. It includes input validation for database names, proper escaping of URLs, and improved error handling in AJAX requests. These changes enhance the security of the installation process and prevent potential vulnerabilities.
