fix: add .env.local to gitignore

fix: remove hardcoded credentials from source code
- Move PayPal live/sandbox API keys to env variables - Move hardcoded API token in isAuthorized middleware to env variable - Add api_token key to config/app.php - Update .env.example with new required env vars - Fix isAuthorized response code from 503 to 401
2026-04-24 12:17:02 +08:00 · 2026-04-24 10:45:54 +08:00 · 2026-04-19 19:22:13 +00:00 · 2026-04-20 03:21:31 +08:00 · 2026-04-17 10:41:20 +00:00 · 2026-04-17 18:40:47 +08:00
8 changed files with 117 additions and 35 deletions
--- a/.env.example
+++ b/.env.example
@@ -11,6 +11,13 @@ CACHE_DRIVER=file
 SESSION_DRIVER=file
 QUEUE_DRIVER=sync

+PAYPAL_SANDBOX_CLIENT_ID=
+PAYPAL_SANDBOX_SECRET=
+PAYPAL_LIVE_CLIENT_ID=
+PAYPAL_LIVE_SECRET=
+
+API_TOKEN=
+
 MAIL_DRIVER=smtp
 MAIL_HOST=mailtrap.io
 MAIL_PORT=2525
--- a/.env.local
+++ b/.env.local
@@ -1,26 +0,0 @@
-# Local Development Configuration
-# Copy to .env.local and fill in your values.
-
-# ── MinIO credentials ─────────────────────────────────────────────────────────
-MINIO_KEY=your_minio_root_user
-MINIO_SECRET=your_minio_root_password
-
-# ── SSH tunnel (remote DB) ────────────────────────────────────────────────────
-# Only needed when starting with --profile ssh-db.
-# NOTE: no inline comments allowed after values — Docker reads them literally.
-
-SSH_HOST=136.114.183.15
-SSH_PORT=22
-SSH_USER=webmaster
-# Must be an absolute path — Docker Compose does NOT expand ~
-SSH_KEY_PATH=/Users/webmaster/.ssh/id_ed25519_crew_webmaster
-
-SSH_DB_REMOTE_HOST=127.0.0.1
-SSH_DB_REMOTE_PORT=3306
-
-# Tell the app to route DB traffic through the tunnel container:
-DB_HOST=db-tunnel
-DB_PORT=3306
-DB_DATABASE=custom_designs
-DB_USERNAME=root
-DB_PASSWORD=VeryStrongRootPass2025!
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,7 @@
 /vendor
 /node_modules
 .env
+.env.local

 # SSH Keys - Never commit private keys
 *.ppk
--- a/app/Exceptions/Handler.php
+++ b/app/Exceptions/Handler.php
@@ -2,6 +2,8 @@

 use Exception;
 use Illuminate\Foundation\Exceptions\Handler as ExceptionHandler;
+use Illuminate\Database\Eloquent\ModelNotFoundException;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;

 class Handler extends ExceptionHandler {

@@ -42,6 +44,11 @@ class Handler extends ExceptionHandler {
 		if (!$e instanceof Exception) {
 			$e = new \ErrorException($e->getMessage(), $e->getCode(), E_ERROR, $e->getFile(), $e->getLine());
 		}
+
+		if ($e instanceof NotFoundHttpException || $e instanceof ModelNotFoundException) {
+			return response()->view('errors.404', [], 404);
+		}
+
 		return parent::render($request, $e);
 	}

--- a/app/Http/Middleware/isAuthorized.php
+++ b/app/Http/Middleware/isAuthorized.php
@@ -13,11 +13,11 @@ class isAuthorized {
 	 */
 	public function handle($request, Closure $next)
 	{
-		if(isset(getallheaders()['token']) && getallheaders()['token']=="1HHIaIsT4pvO2S39vMzlVfGWi3AhAz6F5xGBNKil") {
+		$token = $request->header('token') ?? (getallheaders()['token'] ?? null);
+		if ($token && $token === config('app.api_token')) {
 			return $next($request);
-		}else{
-				return response()->json(['status' => false,'error' => "Invalid request"], 503);
 		}
+		return response()->json(['status' => false, 'error' => 'Invalid request'], 401);
 	}

 }
--- a/config/app.php
+++ b/config/app.php
@@ -80,6 +80,8 @@ return [

 	'key' => env('APP_KEY', 'SomeRandomString'),

+	'api_token' => env('API_TOKEN'),
+
 	'cipher' => MCRYPT_RIJNDAEL_128,

 	/*
--- a/config/services.php
+++ b/config/services.php
@@ -36,13 +36,13 @@ return [

 	// sandbox
 	'paypal_sandbox' => [
-    'client_id' => 'AQuz-HKzQiL7FygkG8skSekaWf-RP6Rgj4f1XeX1Ghp86bUFj7tQXVT1xbpluu5_WCGRbQpOVGtlJKVB',
-		'secret' => 'EJAMKxQsl-mFkL_4J_90cvTamYfcsgswqgIxz9wQPiRAwJ6sy_wNsttMlmrXIpxI96JpYzdMXkLCHAPz'
+		'client_id' => env('PAYPAL_SANDBOX_CLIENT_ID'),
+		'secret'    => env('PAYPAL_SANDBOX_SECRET'),
 	],

 	// live
 	'paypal_live' => [
-    'client_id' => 'AUqBUFW5lfyYmrlBtFZA3RNw45sttM3ltbvS_d4qCVBMrkcMG9rEeivGvtNFSy8XTiEp50YyQ6khKxbq',
-	 	'secret' => 'ELlnuiupoFKwGUSc2g5j-sD1EmsvKpdhth1gFV7njpfvyNtKsK8WwIKUMOS0ehJcRatV865eMhfgsnd_'
+		'client_id' => env('PAYPAL_LIVE_CLIENT_ID'),
+		'secret'    => env('PAYPAL_LIVE_SECRET'),
 	],
 ];
--- a/resources/views/errors/404.blade.php
+++ b/resources/views/errors/404.blade.php
@@ -0,0 +1,91 @@
+<html>
+	<head>
+		<meta charset="utf-8">
+		<meta name="viewport" content="width=device-width, initial-scale=1">
+		<title>404 | Page Not Found</title>
+		<style>
+			body {
+				margin: 0;
+				padding: 0;
+				width: 100%;
+				height: 100%;
+				background: #f4f6f8;
+				color: #334155;
+				display: table;
+				font-family: Arial, sans-serif;
+			}
+
+			.container {
+				text-align: center;
+				display: table-cell;
+				vertical-align: middle;
+				padding: 24px;
+			}
+
+			.content {
+				text-align: center;
+				display: inline-block;
+				background: #ffffff;
+				padding: 32px 28px;
+				border-radius: 10px;
+				border: 1px solid #e5e7eb;
+				max-width: 560px;
+			}
+
+			.code {
+				font-size: 52px;
+				font-weight: 700;
+				line-height: 1;
+				color: #111827;
+				margin-bottom: 14px;
+			}
+
+			.title {
+				font-size: 24px;
+				font-weight: 700;
+				color: #111827;
+				margin-bottom: 10px;
+			}
+
+			.message {
+				font-size: 15px;
+				line-height: 1.6;
+				margin-bottom: 22px;
+			}
+
+			.actions a {
+				display: inline-block;
+				padding: 10px 16px;
+				margin: 0 6px 8px;
+				text-decoration: none;
+				border-radius: 6px;
+				font-size: 14px;
+				font-weight: 700;
+			}
+
+			.btn-primary {
+				background: #111827;
+				color: #ffffff;
+			}
+
+			.btn-secondary {
+				background: #ffffff;
+				color: #111827;
+				border: 1px solid #d1d5db;
+			}
+		</style>
+	</head>
+	<body>
+		<div class="container">
+			<div class="content">
+				<div class="code">404</div>
+				<div class="title">Page Not Found</div>
+				<div class="message">The page you are looking for does not exist or may have been moved.</div>
+				<div class="actions">
+					<a href="{{ url('/') }}" class="btn-primary">Go to Home</a>
+					<a href="{{ url('teamstore') }}" class="btn-secondary">Browse Team Stores</a>
+				</div>
+			</div>
+		</div>
+	</body>
+</html>
Author	SHA1	Message	Date
Frank John Begornia	962c8643c8	fix: add .env.local to gitignore	2026-04-24 12:17:02 +08:00
Frank John Begornia	d1976045db	fix: remove hardcoded credentials from source code - Move PayPal live/sandbox API keys to env variables - Move hardcoded API token in isAuthorized middleware to env variable - Add api_token key to config/app.php - Update .env.example with new required env vars - Fix isAuthorized response code from 503 to 401	2026-04-24 10:45:54 +08:00
webmaster	62b8ab44b2	Merge pull request 'feat: add custom 404 error page and handle exceptions for not found errors' (#7 ) from feat/page-404 into master Reviewed-on: #7	2026-04-19 19:22:13 +00:00
Frank John Begornia	63be70163e	feat: add custom 404 error page and handle exceptions for not found errors	2026-04-20 03:21:31 +08:00
webmaster	51f7dc8730	Merge pull request 'feat: enhance cart layout and styling for improved user experience' (#6 ) from feat/cart-enhancement into master Reviewed-on: #6	2026-04-17 10:41:20 +00:00
Frank John Begornia	1f6c71895f	feat: enhance cart layout and styling for improved user experience	2026-04-17 18:40:47 +08:00
webmaster	ea61963f7d	Merge pull request 'feat: enhance navbar and privacy policy layout for improved user experience' (#5 ) from feat/navbar-enhancement into master Reviewed-on: #5	2026-04-17 10:23:06 +00:00
Frank John Begornia	3f2175719b	feat: enhance navbar and privacy policy layout for improved user experience	2026-04-17 18:21:48 +08:00
webmaster	66e4179997	Merge pull request 'feat: enhance team store page layout and styling for improved user experience' (#4 ) from feat/teamstore-page-enhancement into master Reviewed-on: #4	2026-04-17 10:01:20 +00:00
Frank John Begornia	a255eedc40	feat: enhance team store page layout and styling for improved user experience	2026-04-17 18:00:36 +08:00
webmaster	d95427b08f	Merge pull request 'style: enhance authentication forms with improved layout and design' (#3 ) from feat/auth-forms into master Reviewed-on: #3	2026-04-17 06:19:50 +00:00
Frank John Begornia	0531bf35ba	style: enhance authentication forms with improved layout and design	2026-04-17 14:18:31 +08:00
Frank John Begornia	fa68bd1dca	fix: update storage paths for team store logo and banner uploads to use 'uploads/images' directory	2026-04-17 13:39:15 +08:00
Frank John Begornia	c5d32b7c6c	fix: update storage paths for store logo and banner uploads to include 'upload/images'	2026-04-17 13:33:31 +08:00
Frank John Begornia	90b94c95d6	fix: migrate store logo/banner uploads from sftp to minio	2026-04-17 13:24:40 +08:00
Frank John Begornia	43f365112f	fix: pin psr/http-message ^1.0 and guzzlehttp/psr7 ^1.4 to fix PsrStream __toString incompatibility	2026-04-17 13:13:42 +08:00
Frank John Begornia	1e62654a02	fix: register minio custom driver using flysystem-aws-s3-v3 (Laravel 5.0 hardcodes v2)	2026-04-17 13:03:37 +08:00
Frank John Begornia	65e14702a8	feat: update Dockerfile and AppServiceProvider for PHP 7.2 compatibility and improved error handling	2026-04-17 12:52:38 +08:00
Frank John Begornia	048d51f181	feat: add MinIO S3 storage configuration to docker-compose for improved file management	2026-04-16 23:55:22 +08:00
webmaster	8ec3454707	Merge pull request 'feat/hifive-filters' (#2 ) from feat/hifive-filters into master Reviewed-on: #2	2026-04-16 15:41:40 +00:00
webmaster	5845296919	Merge pull request 'Refactor image upload handling in UserController to use MinIO for improved storage management' (#1 ) from fix/upload-image into master Reviewed-on: #1	2026-04-16 15:40:59 +00:00
Frank John Begornia	751dcd4f9e	Refactor image upload handling in UserController to use MinIO for improved storage management	2026-04-16 23:40:09 +08:00
Frank John Begornia	a094650f64	chore: remove SSH Keys Setup guide to enhance security practices	2026-04-16 23:21:45 +08:00
Frank John Begornia	dd6503a4a4	feat(teamstore): add league/conference sub-sub-category pill filter (hi-five-franchise-store only)	2026-04-16 23:19:19 +08:00
Frank John Begornia	958edcfab8	Add centering guidelines script and update script references in designer view	2026-04-02 03:33:19 +08:00
Frank John Begornia	dc53b4863c	Refactor image handling in PrintPatternController and TemplatesController to use MinIO for improved storage management	2026-04-02 03:31:08 +08:00
Frank John Begornia	bd8c7f02b5	Refactor image URLs to use MinIO storage for improved asset management	2026-04-02 03:04:49 +08:00
Frank John Begornia	005b64233b	Enhance TestEmailController and view to include CSRF token and improve form security	2026-02-26 23:12:00 +08:00
Frank John Begornia	ee91fe18c6	Update exception handling in Handler and TestEmailController for improved error reporting	2026-02-26 22:58:28 +08:00
Frank John Begornia	678d110d29	Add TestEmailController and views for sending test emails	2026-02-26 22:46:14 +08:00
Frank John Begornia	517bf2c3db	Add SSH keys setup guide and update configurations for secure key management	2026-02-23 02:01:12 +08:00
Frank John Begornia	ea3fba0cd6	Fix image path for PayPal button in cart view	2026-01-07 01:42:43 +08:00
Frank John Begornia	02a6aa8d24	Update DesignerController and site_config for MinIO integration and URL adjustments	2026-01-07 01:28:47 +08:00
Frank John Begornia	8b195fff55	Refactor image URLs to use MinIO storage across various views and controllers	2026-01-07 01:10:15 +08:00
Frank John Begornia	0a796ef4e4	Add MinIO configuration and update image URLs in MainController	2026-01-06 15:34:02 +08:00
Frank John Begornia	604b986e6e	Use MinIO for sports category images	2026-01-06 15:27:17 +08:00
Frank John Begornia	995d3d3ea0	Add MinIO S3 storage integration - Add minio disk configuration in filesystems.php - Create helper functions for MinIO URLs (minio_url, minio_image_url) - Update composer.json with AWS SDK (for future S3 support) - Add MinIO env vars to docker-compose.local.yml - Add .env examples for MinIO configuration	2026-01-06 15:20:15 +08:00
Frank John Begornia	87af27fe10	Update README.md to reflect project details and installation instructions	2026-01-05 23:15:14 +08:00
Frank John Begornia	e6496b8ae0	Update APP_URL and Traefik rules for production environment	2026-01-05 23:13:37 +08:00
Frank John Begornia	6390717622	Remove commented-out sales chart section from user dashboard	2025-12-31 02:20:31 +08:00
Frank John Begornia	2dbcf3e2e6	Update AppServiceProvider to force HTTPS and configure APP_URL in app.php	2025-12-31 02:10:31 +08:00
Frank John Begornia	0f24a817ce	Remove '/public' prefix from asset paths for consistency across views	2025-12-31 02:04:33 +08:00
Frank John Begornia	1b645de66e	Refactor asset paths to remove '/public' prefix for consistency across views	2025-12-31 01:53:42 +08:00
Frank John Begornia	e1ac5bd2a5	Remove unnecessary environment setup and optimization steps from Dockerfile	2025-12-31 01:24:12 +08:00
Frank John Begornia	e3c5b44174	Fix Traefik certresolver value in production Docker Compose configuration	2025-12-31 01:10:07 +08:00
Frank John Begornia	9a6e3a63b2	Update production environment URLs and Traefik rules for dev-crew.crewsportswear.app	2025-12-31 00:56:31 +08:00
Frank John Begornia	0f12309175	Update deployment directory path in workflow configuration	2025-12-31 00:33:22 +08:00
Frank John Begornia	e25228e25e	Add Docker and deployment configurations for development and production environments	2025-12-31 00:23:44 +08:00
franknstayn	633249438c	updated	2023-08-24 21:55:06 +08:00
franknstayn	fe02cfe2d4	exempt sf spartans tax	2021-12-23 18:08:57 +08:00
franknstayn	854a39db30	added voucher validation	2021-12-03 18:00:27 +08:00
franknstayn	94b55851b4	update store item view	2021-11-26 19:31:40 +08:00
franknstayn	08571b2358	update store item view	2021-11-26 19:29:59 +08:00
franknstayn	0abc30c7a0	updated checkout flow	2021-11-03 21:30:42 +08:00
franknstayn	b4d92bb14a	update navbar	2021-09-25 18:32:49 +08:00
franknstayn	0327471c92	update navbar	2021-09-25 18:30:03 +08:00
franknstayn	72b800b22d	update navbar	2021-09-25 18:28:40 +08:00
franknstayn	54eb09f080	update navbar	2021-09-25 18:20:22 +08:00
franknstayn	6d67430c33	update creds	2021-09-15 20:48:31 +08:00
franknstayn	cde3a8597c	update email creds	2021-09-15 20:41:07 +08:00
franknstayn	6bc7f0b3f0	update email creds	2021-09-15 20:20:31 +08:00
franknstayn	1007e59b7d	update email	2021-09-15 20:02:51 +08:00
franknstayn	fe3b645352	update description label	2021-09-07 19:41:04 +08:00
franknstayn	bcaad2306a	update store please read text	2021-09-03 21:35:45 +08:00
franknstayn	0e3c86a075	update store please read text	2021-09-03 21:35:24 +08:00
franknstayn	b78a0dd6d2	updated delete function for delete item	2021-07-17 15:32:49 +08:00
Frank John Begornia	af0fae29f8	added shipping fee for dgs	2021-03-20 14:36:46 +08:00
Frank John Begornia	5d2ab7ffe2	fixed reports date range	2021-02-08 04:07:29 +08:00
Frank John Begornia	0b3ef61086	updated apis	2021-02-04 19:45:27 +08:00
Frank John Begornia	18dd91e2a8	update reports display	2021-01-23 19:52:17 +08:00
Frank John Begornia	42acec513f	update report	2021-01-23 19:49:15 +08:00
Frank John Begornia	71f5c53b53	fixed order report	2020-12-19 19:49:03 +08:00
Frank John Begornia	1e1440edaf	fixed order report	2020-12-19 19:46:36 +08:00
Frank John Begornia	0b157efbbf	added status	2020-12-12 19:53:30 +08:00
Frank John Begornia	d2f492212b	added new api	2020-12-11 21:47:36 +08:00
Frank John Begornia	73770a85be	added order status	2020-11-28 18:13:43 +08:00
Frank John Begornia	5f44fd781f	change image url	2020-11-27 16:24:57 +08:00
Frank John Begornia	a4cbfd63da	added api for tracking	2020-11-27 02:43:26 +08:00
franknstayn	bbf0fd286d	added bucket hat sizes	2020-11-26 12:32:29 -06:00
franknstayn	57cc16abf2	edit please read on lasc store	2020-11-17 18:50:50 +08:00
franknstayn	2688f9cab9	update crewsportswear	2020-10-24 21:27:04 +08:00
franknstayn	54c685ce79	added announcement	2020-10-17 23:16:25 +08:00
franknstayn	9aa01a4f31	added 0	2020-10-17 23:14:52 +08:00
franknstayn	386f04b32f	added announcement	2020-10-17 22:17:25 +08:00
franknstayn	fafa871214	added stat	2020-09-29 19:40:42 +08:00
franknstayn	9874fb4b60	update	2020-09-29 01:05:01 -05:00
franknstayn	cb89f32a64	update payment details record	2020-08-10 23:20:55 +08:00
franknstayn	21ec11e998	add shipping cost	2020-08-10 22:41:40 +08:00
franknstayn	0ca7174e2f	updates	2020-08-09 13:21:41 -05:00
franknstayn	fabc31ac2b	updates	2020-08-01 03:06:48 -05:00
franknstayn	427fbf616d	fix teamstore password	2020-07-11 19:31:35 +08:00
franknstayn	1b30d340b3	updated	2020-07-11 02:57:12 -05:00
franknstayn	56f790c279	added new form for store item	2020-03-19 22:37:08 +08:00
franknstayn	1aaf083a8a	update 3_14_2020	2020-03-14 01:17:24 -05:00
franknstayn	ef9a79539a	fix tax exemption	2020-02-28 21:07:05 +08:00
franknstayn	1f621ad7a3	Merge branch 'master' of github.com:franknstayn/crewsportswear Conflicts: app/Http/Controllers/paypal/PaypalController.php	2020-02-28 07:02:30 -06:00
franknstayn	ba86aa3039	exempt jjed phl intax	2020-02-28 06:58:41 -06:00
franknstayn	30a6351136	Merge branch 'master' of https://github.com/franknstayn/crewsportswear	2020-02-28 20:54:33 +08:00
franknstayn	519ee7a567	exempt nlp in tax	2020-02-28 20:53:29 +08:00
franknstayn	c938d6b08b	uncomment RewriteRule	2020-02-25 12:29:23 +08:00
franknstayn	566e657060	removed JAC	2020-02-25 12:21:10 +08:00
franknstayn	88679773fe	add jac	2020-02-25 12:06:28 +08:00
franknstayn	11bf31af39	added contact us page	2020-02-25 11:53:26 +08:00
franknstayn	16fcca5333	changed sizes display	2020-02-08 20:37:02 +08:00
franknstayn	0952f460d5	Merge pull request #9 from franknstayn/additional_form Additional form	2020-02-08 16:40:18 +08:00
franknstayn	0d26eefab9	add form in user page	2020-02-07 01:14:27 +08:00
franknstayn	b7875f0236	additional forms	2020-02-07 01:10:31 +08:00
franknstayn	4def6bcf09	Merge pull request #8 from franknstayn/local_dev added delete function on store item	2020-01-25 20:12:43 +08:00
franknstayn	a15c237f53	Merge branch 'master' of github.com:franknstayn/crewsportswear	2020-01-25 04:47:06 -06:00
franknstayn	4f91dd8370	added user for tax exemption	2020-01-25 04:45:58 -06:00
franknstayn	d0eeafcd52	Merge pull request #7 from franknstayn/local_dev Local dev	2020-01-25 18:43:25 +08:00
franknstayn	e7a4dce4e1	Merge branch 'local_dev' of github.com:franknstayn/crewsportswear	2020-01-10 07:32:59 -06:00
franknstayn	f355b3a9b5	Merge pull request #6 from franknstayn/local_dev rename number to name	2019-12-04 18:49:08 +08:00
franknstayn	5a7008b8d9	Merge pull request #5 from franknstayn/local_dev Local dev	2019-12-04 18:44:41 +08:00
franknstayn	9dfd6f3884	Merge pull request #4 from franknstayn/local_dev added "size" column on download report in csv and excel	2019-11-15 21:05:31 +08:00
franknstayn	b2985a5b32	Merge pull request #3 from franknstayn/local_dev Local dev	2019-11-14 19:45:29 +08:00
franknstayn	4ccd15566d	Merge branch 'master' of github.com:franknstayn/crewsportswear	2019-11-11 04:44:45 -06:00
franknstayn	b76eb97d66	update from live 11_11_2019	2019-11-11 04:44:08 -06:00
franknstayn	423a23abce	Merge pull request #2 from franknstayn/local_dev added column in store order reports in store owner	2019-11-11 18:42:11 +08:00
franknstayn	7b979abad1	fixed broken link on cart page.	2019-11-06 07:26:02 -06:00
franknstayn	31cf5dbb3b	Merge pull request #1 from franknstayn/local_dev Local dev by frank	2019-11-06 20:29:09 +08:00