Adminator/geograsim
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Review-Batch P0: Sicherheit + Schueler-Ergebnisse + Assessments-Aufblaehung

Browse Source 
Sicherheit:
- progress.php: IDOR geschlossen (student_id-Zweig verlangt Lehrer-Login + Klassenbesitz)
- licenses.php: ?admin=1 und generate nur noch fuer echten Admin; Collision-Retry mit Cap
- .htaccess: .env/.sh/.sql/.bak Deny (Defense-in-Depth)

Schueler-Ergebnisse (kritisch):
- sim-metrics.js + .ivm-CSS in schueler.html; renderOwnRunCard-Fallback zeigt jetzt
  Sterne + grafische Kennzahlen fuer die 9 bisher leeren Sims
- sim-metrics.js: klima final_budget als "Mio EUR" statt "EUR" (Faktor 10^6)

Skalierung:
- assessment.php: Zwischen-Pings (phase running/started) nicht mehr persistiert
- heli: 30-s-assessmentPing entfernt (Live-Zustand laeuft ueber Heartbeat)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Thomas
2026-08-15 16:21:25 +02:00
parent a3c5753cd7
commit 2984d93e7e
7 changed files with 65 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
App/schueler.html
+21 -1
View File
@@ -95,8 +95,18 @@
.hidden{display:none}
@media(max-width:550px){.mod-grid{grid-template-columns:1fr}.badge-grid{grid-template-columns:repeat(2,1fr)}}
/* Gemeinsames Sim-Kennzahlen-Schema (renderSimMetrics aus sim-metrics.js) */
.ivm-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(110px,1fr));gap:7px;margin-top:.5rem}
.ivm{background:#f4f1e8;border-radius:8px;padding:6px 9px;min-width:0}
.ivm-l{display:block;font-size:.58rem;color:#8a8a8a;text-transform:uppercase;letter-spacing:.03em;margin-bottom:3px;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}
.ivm-v{font-size:.92rem;font-weight:750}.ivm-u{font-size:.66rem;font-weight:600;color:#8a8a8a}.ivm-txt{font-size:.8rem;font-weight:700}
.ivm-stars{color:#e0a838;font-size:.95rem;letter-spacing:1px}.ivm-stars.sm{font-size:.8rem}.ivm-star-off{color:#ddd}
.ivm-bar{display:block;height:7px;border-radius:4px;background:#ece8dc;overflow:hidden;margin-top:3px}.ivm-bar>i{display:block;height:100%;border-radius:4px;background:currentColor}
.ivm-g{color:#4a7c4e}.ivm-li{color:#7fa856}.ivm-y{color:#e0a838}.ivm-o{color:#e08a3a}.ivm-r{color:#c0574a}
</style>
<script src="assets/js/badges.js"></script>
<script src="assets/js/sim-metrics.js"></script>
</head>
<body>
<div class="topbar">
@@ -496,7 +506,17 @@ function renderOwnRunCard(simId, run) {
if (simId === 'busfahrt') return renderBusfahrtOwnRun(dt, dur, r, d);
if (simId === 'fluggesellschaft') return renderFluggesellschaftOwnRun(dt, dur, r, d);
if (simId === 'heli') return renderHeliOwnRun(dt, dur, r, d);
return '<div class="ownruns-card"><div class="ownruns-head"><strong>'+dt+'</strong><span class="ownruns-meta">'+dur+'</span></div></div>';
// Generisch: gemeinsames Kennzahlen-Schema (Sterne + grafische Kacheln) —
// deckt klima, klima-3d, farmer, fluss, logistik, weltkueche, kofferdetektiv,
// tourismustal, tourismusregion ab (vorher nur Datum + Dauer).
var st = (typeof d.stars === 'number') ? d.stars : (typeof d.sterneGesamt === 'number' ? d.sterneGesamt : null);
var starsHtml = '';
if (st != null) { var n = Math.max(0, Math.min(5, Math.round(st)));
starsHtml = '<span class="ownruns-stars">'+'★'.repeat(n)+'<span class="ownruns-stars-empty">'+'★'.repeat(5-n)+'</span></span>'; }
var metrics = (typeof renderSimMetrics === 'function') ? renderSimMetrics(simId, d) : '';
return '<div class="ownruns-card"><div class="ownruns-head"><strong>'+dt+'</strong>'
+ '<span class="ownruns-meta" style="margin-left:auto">'+dur+(starsHtml?' · '+starsHtml:'')+'</span></div>'
+ metrics + '</div>';
}
function renderBusfahrtOwnRun(dt, dur, r, d) {
var stars = Math.max(0, Math.min(5, r.stars || 0));