Release Notes: -------------------- 2.10 Release -------------------- NEW FEATURES: - Added Easy Installation System * Created easy-install.sh: One-command installer eliminating need for chmod * Installation reduced from 3 commands to 1 simple command: curl -sSL https://raw.githubusercontent.com/rcrum003/HiveControl/master/easy-install.sh | sudo bash * Added EASY_INSTALL_GUIDE.md: Complete beginner's guide from SD card imaging to running system - Step-by-step Raspberry Pi OS 5 installation instructions - How to use Raspberry Pi Imager with screenshots - WiFi and SSH configuration walkthrough - Sensor connection guide - Comprehensive troubleshooting section * Added DOWNLOAD_INSTRUCTIONS.md: All installation methods with comparisons - One-line installation (recommended for beginners) - Manual download and run (for code review) - Git clone method (for developers) - What happens during installation explained * Added QUICK_REFERENCE.md: Printable one-page reference card - Common commands and system control - Web interface quick links - Sensor testing commands - File locations and pin connections - Troubleshooting quick fixes * Created download.html: Beautiful web-based download page - Interactive installation method selector - Copy-to-clipboard buttons for commands - Visual step-by-step guides - Links to all documentation * Updated README.md with simplified installation instructions - Prominent easy installation section - Clear options for different features - Links to comprehensive guides * Added PACKAGING_IMPROVEMENTS.md: Complete documentation of all improvements * Addresses user feedback that "chmod u+x and multiple commands are too hard" * Makes HiveControl accessible to non-technical beekeepers - Added Backup & Restore System (backup.php) * Create full database backups (60MB+ databases supported) * Create configuration-only backups for quick settings preservation * Restore from any backup with automatic safety backup before restore * Download backups to local computer * Delete old backups to manage storage * All operations logged with user IP tracking * Protected backup directory with .htaccess deny rules * Optimized for large databases using file copy instead of SQL export * Updated navigation menus to include "Backup & Restore" option - Added Admin Password Management System (changepassword.php) * Change admin password through web interface * Current password verification required * Minimum 8 character password requirement * Password confirmation to prevent typos * Supports multiple Apache htpasswd hash formats (APR1, bcrypt, SHA1, crypt) * All password changes logged with IP tracking - Added Comprehensive Help Documentation System * Created central help.php with topic-based navigation * Added 13 comprehensive help topics covering all system features * Topics include: Overview, Initial Setup, Basic Settings, Instruments & Sensors, Calibration, Weather Sources, Dashboard Guide, Hive Components, Site Preferences, System Commands, Backup & Restore, Change Password, and Troubleshooting * Professional styling with Font Awesome icons and Bootstrap UI * Step-by-step guides with visual indicators * Code examples and configuration instructions * Best practices and recommendations for each feature area * Added Help link to navigation menu (both wide and normal orientations) WEB APPLICATION SECURITY FIXES: - Fixed CRITICAL SQL injection vulnerabilities in admin interface * loglocal() function now uses parameterized queries instead of string interpolation * removezero command uses strict column name whitelisting (hivetempf, hiveHum, hiveweight, IN_COUNT) * Message queue operations converted to parameterized queries * All database operations now use PDO prepared statements with ? placeholders * Prevents database manipulation, data theft, and privilege escalation - Fixed HIGH severity XSS (Cross-Site Scripting) vulnerabilities * All log output properly escaped with htmlspecialchars() in getlog() function * Error messages properly escaped in system.php command handling * Database content escaped before display to prevent script injection * Prevents session hijacking, credential theft, and malicious JavaScript execution - Implemented CSRF (Cross-Site Request Forgery) protection * All POST forms now include cryptographically secure CSRF tokens * Token validation required before processing sensitive operations * Implemented in backup.php, changepassword.php, and other admin forms * Session-based token storage with automatic regeneration * Prevents unauthorized actions from malicious websites - Improved session security configuration * HTTPOnly cookies prevent JavaScript access to session IDs * SameSite=Strict prevents cross-site request attacks * Strict session mode rejects uninitialized session IDs * Session ID regenerated every 5 minutes to prevent session fixation * 1-hour session timeout (configurable in security-init.php) * Note: session.cookie_secure disabled by default (enable if using HTTPS) - Fixed HIGH severity IP spoofing vulnerability * getUserIP() now only trusts REMOTE_ADDR for accurate logging * Removed trust of HTTP_X_FORWARDED_FOR and HTTP_CLIENT_IP headers * Prevents attackers from forging IP addresses in logs * Command injection via IP spoofing no longer possible - Removed plaintext password exposure in hiveconfig.php * Hivetool.org password field no longer pre-filled in forms * Password not visible in HTML source code or browser memory * Update logic preserves existing password if field left empty * Prevents password theft via shoulder surfing or page source inspection - Fixed information disclosure vulnerabilities * Database connection errors now logged instead of displayed to users * Error messages sanitized to prevent information leakage * Prevents attackers from learning database structure or credentials - Added comprehensive security headers * X-Frame-Options: DENY (prevents clickjacking attacks) * X-Content-Type-Options: nosniff (prevents MIME type sniffing) * Referrer-Policy: strict-origin-when-cross-origin (limits referrer information) * Content-Security-Policy with restrictions on script/style sources - Created centralized security initialization system * New /include/security-init.php file for all security configuration * Reusable CSRF protection functions: csrf_field(), verify_csrf_token(), require_csrf_token() * Automatic session management with secure defaults * Easy to maintain and extend security features Files Modified for Security: * /admin/system.php - SQL injection, XSS, IP spoofing, CSRF protection * /admin/changepassword.php - SQL injection, IP spoofing, CSRF protection * /admin/backup.php - SQL injection, IP spoofing, CSRF protection * /admin/hiveconfig.php - Plaintext password removal * /include/db-connect.php - Error disclosure prevention * /include/security-init.php - NEW FILE with session and CSRF configuration Security Documentation: * SECURITY_AUDIT_2026-01-17.md - Complete vulnerability assessment * SECURITY_FIXES_APPLIED_2026-01-17.md - Detailed fix documentation with testing procedures BUG FIXES: - Fixed temperature validation to allow valid 0-degree readings * Updated all_chart.php to remove != 0 check from temperature validation * Temperature values of exactly 0 degrees now display correctly on charts * Applies to both hive temperature and weather temperature readings - Fixed instrumentconfig.php blank screen issue on form submission * Added hidden input fields for all 39 required form validation fields * Ensures all fields are present in POST data even when conditionally hidden * Form now properly validates and reloads instead of showing blank screen - Fixed siteconfig.php blank screen issue with checkbox validation * Added PHP preprocessing to set unchecked checkboxes to empty string * Handles 18 checkbox fields: trend lines, chart options, and SHOW_METRIC * Unchecked checkboxes now properly pass validation - Fixed hiveconfig.inc generation failures on fresh installations * Removed stub file from git tracking and added to .gitignore * Added file size validation (<100 bytes triggers regeneration) * Changed INNER JOIN to LEFT JOIN for defensive database queries * Added source command to load config variables into shell environment * Fixes hive registration failures due to undefined variables (POWER, INTERNET, STATUS, COMPUTER) - Fixed footer display issues in web interface * Corrected malformed HTML structure in footer.php (changed from