Repository navigation
Request the Site Verification scope for Search Console setup - #10
Merged
nwaezedavid merged 11 commits intoNov 5, 2026
Merged
Conversation
Feature pages, homepage cards, help answers, menu links and pricing allowances for WordPress publishing, affiliate network connections, AffilStack in your language and the add-on marketplace, with real screenshots. A migration ships them to existing sites without touching admin edits. Plans now include WordPress sites and network connections, demo data covers the new features, and dependencies get security patches. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015ZBiaiMwi6BCi8vmwJFScW
…main and optional gateways in .env.example Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015ZBiaiMwi6BCi8vmwJFScW
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015ZBiaiMwi6BCi8vmwJFScW
- composer.json requires PHP ^8.4 (the locked Symfony 8 packages already needed it, which is why the PHP 8.3 build failed); CI tests PHP 8.4 and 8.5, builds the front end first, and runs on affilstack-app pushes. Dependabot now also proposes Composer and npm security updates. - Tom's daily scan checks the PHP the website and the cron run on against the PHP2Shell fixes (8.4.27 / 8.5.12) and php.net's newest security release, plus risky php.ini settings; new critical/high findings email the admins, cleared ones close themselves, and the admin panel shows a red bar while the website's PHP is unpatched. security:check-php fails a deploy on an unpatched PHP. - Web-shell defences: uploads carrying PHP (names, double extensions, .htaccess, code hidden in images) are refused on every form and API route; only index.php may run as PHP; requests over 40 MB stop at the web server; public/.user.ini turns off session upload progress and caps request size; Tom looks for PHP files in public and upload folders. - Manual GitHub sync runs in the queue, so the website no longer needs proc_open. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015ZBiaiMwi6BCi8vmwJFScW
Hostinger backports security fixes into PHP 8.4.26 / 8.5.11 without changing the version number. The PHP check now reads the binary's build date: a build dated on or after the fix's release is reported as a low note to confirm with the host instead of critical, and php.net's newer releases are judged the same way. Build dates are shown by security:check-php and recorded for the website's PHP. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015ZBiaiMwi6BCi8vmwJFScW
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015ZBiaiMwi6BCi8vmwJFScW
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015ZBiaiMwi6BCi8vmwJFScW
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015ZBiaiMwi6BCi8vmwJFScW
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015ZBiaiMwi6BCi8vmwJFScW
The page had 37 inline video upload fields, and each one sent its own Livewire request as the page opened. Hostinger refuses MySQL connections past about 20 at once per user, so most of those requests failed with "Operation not permitted" and the page returned a 500. Each card now has an "Upload my own video" button that opens a modal with the upload field, plus "Remove my video". Uploads save straight away and delete the file they replace. Opening the page now sends one request instead of 37. Also keeps storage/framework/php-runtime.json out of git. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015ZBiaiMwi6BCi8vmwJFScW
"Verify Search Console" failed with 403 ACCESS_TOKEN_SCOPE_INSUFFICIENT: the Site Verification API (which issues and checks the homepage meta tag) isn't covered by the webmasters scope. The Site Analytics connection now also asks for siteverification.verify_only, the narrowest scope that allows getToken and webResource.insert. A connection made before this change shows a plain "Reconnect with Google" message instead of Google's raw error. The built-in Site Analytics guide lists the new scope. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015ZBiaiMwi6BCi8vmwJFScW
nwaezedavid
enabled auto-merge
October 23, 2026 10:10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pushed from Claude Cowork bundle
affilstack-fixes.bundle.Commits: