XLX Dashboard 2.5.4 - Security and PHP 8.x Notes
=======================================================

This modified dashboard was checked for PHP syntax compatibility with the PHP
version installed on the test system.

Security and compatibility changes
----------------------------------
- Dashboard version updated to 2.5.4.
- Calling Home dashboard URL changed to HTTPS.
- Removed chmod 777 for callinghome.php; chmod 0660 is used instead.
- Calling Home hash generation changed from mt_rand() to random_int().
- Removed the shell call to "uptime"; /proc/uptime is read directly.
- The show= page selector is validated against a fixed whitelist.
- Selected meta/output values are protected with htmlspecialchars().
- Corrected the robots meta value to use MetaRobots instead of MetaAuthor.
- APRS.fi links changed to HTTPS.
- Live Log page hardened:
  * the password is no longer stored as clear text in PHP code;
  * password_hash() / password_verify() are used;
  * the session ID is regenerated after a successful login;
  * a logout function is available;
  * log output is HTML-escaped;
  * the log file is configurable.

Important notes
---------------
- The previous Live Log password still works in this release. It is now stored
  only as a password hash in pgs/config.inc.php.

- To set a new Live Log password, generate a hash with:

    php -r 'echo password_hash("NEW_PASSWORD", PASSWORD_DEFAULT), PHP_EOL;'

  Then copy the generated value to:

    $PageOptions['LogPage']['PasswordHash']

- $CallingHome['ServerURL'] intentionally remains:
    http://xlxapi.rlx.lu/api.php
  Do not change it to HTTPS without verifying upstream support.

- pgs/liveccs.php and pgs/liveircddb.php still contain historical HTTP iframe
  URLs. Verify those external services before changing them.

- On Debian systems where /var/log/messages does not exist, change
  $PageOptions['LogPage']['LogFile'] to an appropriate readable log file.

Installation
------------
1. Back up the existing dashboard and local configuration.
2. Copy this release into the dashboard directory.
3. Review pgs/config.inc.php and preserve/adapt site-specific settings.
4. Verify ownership and permissions for the web server.
5. Run: apache2ctl configtest
6. Reload Apache: systemctl reload apache2

Theme/UI notes
--------------
- Persistent light/dark theme switch.
- Theme choice stored in browser localStorage.
- CSS cache-busting reduces stale-style problems.
- Theme 4 modernizes Last Heard, Repeaters/Nodes, Peers and module overview.
