v1.1.11

[hitsumo]

Anime Tracker 1.1.11

Release date:** 2026-07-15

New: AniList import source limit

- **In online (multi-user) mode, a normal member may import from at most 3
  DIFFERENT AniList accounts.** This stops a single member from pulling an
  unbounded number of other people's public lists and flooding the moderation
  queue / catalog.

  - **The same account can be re-synced without limit.** An account you have
    already imported can be pulled again as often as you like without spending
    a new slot (a legitimate case: keep using AniList and come back later to
    re-import).

  - **A slot is consumed only on a real, successful import.** A mistyped name,
    previewing and cancelling, or an error never burns a slot; you can preview
    as much as you like.

  - Usernames are case-insensitive: `Mahmut`, `mahmut` and `MAHMUT` are one
    slot.

 Exemptions

- **Self-host (single-user) installs are never limited** - the sole owner may
  import from as many different names as they want.

- **Moderators and above are exempt** - bulk seeding is their legitimate job.

## Admin controls

- **The limit is configurable.** On the Admin Capabilities page, the "AniList
  import source limit" field sets the number of different accounts (default 3).
  **Setting 0 removes the limit (unlimited)** - an emergency off-valve.

- **An admin can reset a user's limit.** On the User Management page, every
  member who has used sources has a "Reset" button on their row; it clears that
  user's recorded sources so they regain the full allowance.

## How it works (technical)

- A new app-side table `anilist_import_sources` records the DISTINCT AniList
  names each member has used (one row per user, `(user_id, username)` UNIQUE).
  Used-source count = that user's row count.

- The check has two lines: at preview time (WITHOUT hitting AniList, no wasted
  call) and at import time (second defense + recording).

- The limit value lives in the `settings.anilist_import_source_limit` key; it
  needs no dedicated schema column.

- **No central-catalog impact** - this table is app-side only and never reaches
  the central catalog server; no manual step is required there.

## Improvement: Long dropdowns capped at 8 rows

- **Long dropdowns (more than 8 options) now show at most 8 rows, the rest
  scrolling.** For example the main list's "Filter by Genre" and the long
  selects on the form/detail pages used to cover almost the whole screen when
  opened; they are now compact, scrollable menus.

- **Applies site-wide:** the rule is not tied to one menu - every native
  `<select>` with more than 8 options is capped automatically; short menus
  (<=8) stay native.

- On desktop (mouse) the native `<select>` is enhanced into a compact menu;
  the selection is still written to the same form field (submit/filtering
  behavior unchanged). Touch devices keep the native picker. With JS off, the
  native list keeps working.

- `required` menus keep working (the native select is hidden but stays
  focusable, so browser validation is not broken). A very special menu (e.g.
  the genre-ADD picker that resets its own value) can be exempted with
  `data-no-enhance`.

## Security / deployment: main-app .htaccess

- **Added a dedicated `.htaccess` for the main-app document root (`files/`).**
  It 301-redirects http to https and sends HSTS, so the session cookie (written
  with the `Secure` flag in db.php over HTTPS) is always sent - removing the
  "logged in over https but logged out over http" symptom.

- Also: directory listing off, sensitive files denied (config.php, *.sql,
  *.md/*.txt, dotfiles), no web access to include/tooling dirs (functions/,
  migration/, tek_kullanimlik/), and no PHP execution under uploads/. PHP is
  NOT default-denied (the app's endpoints stay public) - this differs from the
  CENTRAL CATALOG server's default-deny `.htaccess`; the two must not be mixed.

## Schema / migration

- `migration/1.1.11/upgrade.sql` creates the new table (idempotent,
  `CREATE TABLE IF NOT EXISTS`). Fresh installs get it from `schema.sql`.

## Changed / new files

- functions/anilist_import_helpers.php (limit helpers)
- list_settings.php (preview + import limit checks, source recording)
- admin/admin_capabilities.php (global limit setting)
- admin/admin_users.php (per-user limit reset)
- lang/tr.php, lang/en.php, lang/admin_tr.php, lang/admin_en.php
- schema.sql (anilist_import_sources table)
- migration/1.1.11/upgrade.sql (new)
- js/select_enhance.js (new - generic dropdown enhancer)
- css/components.css (custom dropdown styles)
- index.php, add_anime.php, edit_anime.php, list_settings.php,
  anime_details.php, admin/admin_users.php, admin/admin_invites.php
  (select_enhance.js script tag; data-no-enhance on the add/edit genre-add
  picker)
- .htaccess (new - main-app docroot: HTTPS enforcement + HSTS + hardening)
- version.txt