v1.1.10
Production 500 recovery
Recovers shared-hosting boot safety after v1.1.9 and clears cache before Laravel boots.
- Emergency production recovery for homepage 500 after v1.1.9.
- Removed global dependency on the new SecurityHeaders middleware so a missing uploaded class cannot break every public page.
- Kept .htaccess focused on compatible rewrite and private-file protection rules only.
- Updater now clears Laravel cache files before booting the framework.
- Updater now repairs an invalid APP_KEY before Laravel boots.
- Security hardening release after the production audit.
- Protected the public updater with UPDATE_TOKEN in production.
- Added Apache deny rules for .env, vendor, app, config, routes, database, logs and other private files.
- Added security headers for frame protection, MIME sniffing protection, referrer policy and HTTPS HSTS.
- Admin and guide sessions now revalidate the active user and role on every protected request.
- Super admin user management is now restricted to super admins only.
- Login, registration, reviews, Explore actions, guide contacts and package enquiries now have rate limits.
- Public reviews now require a signed-in verified user and go to moderation instead of auto-publishing.
- Explore posts/comments from regular travellers now go to moderation while trusted guide/admin content can publish directly.
- Rich text output on city, park, lake, place, event, blog, route and package pages is sanitized before display.
- Logout now invalidates the full session instead of only forgetting flags.
- External profile and Explore media URLs now require HTTPS.
- Fixed guide profile 500 errors when optional availability tables are missing.
- Added public changelog page at /changelog.
- Added version tracking table for release notes.
- Improved mobile header: cleaner menu, hidden admin shortcut, full-width search.
- Improved Explore category bar, composer styling, and social feed spacing.
- Fixed oversized pagination icons/result count styling.
- Cache-busted the main stylesheet using the VERSION file so phones load the newest header design.
- Removed the public Admin shortcut from the public header.
- Added a polished SQL-aware 404 page with live platform counts and navigation cards.
- Protected page view counters with updater backup/restore so updates do not reset funding-critical insights.
- Fixed demo homepage seeding so it never overwrites existing homepage views back to 1.
- Added World Heritage Sites page backed by SQL at /world-heritage-sites.
- Expanded the Places encyclopedia with sourced holy places, UNESCO World Heritage places and tentative heritage places.
- Added admin-editable festival calendar fields for moving Nepal festival dates.
- Added public /festivals page and /festivals/{slug} detail pages.
- Seeded a broad Nepal festival encyclopedia including NTB-listed festivals, national festivals, jatras, Lhosar festivals, ethnic festivals, Muslim/Sikh/Christian observances and regional festivals.
- Added comprehensive festival guide fields for 5W/How answers, timeline, rituals, food, traveller tips, safety and FAQs.
- Redesigned festival detail pages so festival information comes from SQL sections instead of one generic paragraph.
- Added a lightweight local rich editor for admin festival descriptions and guide fields.
- Added admin hero image upload option in addition to image URL.
- Expanded lakes into full travel guide pages with access, permits, safety, conservation, facilities, photography, timeline and FAQs.
- Added lake admin rich editing plus browse/upload hero image support.
- Seeded richer Nepal lake content from Ramsar, Nepal Tourism Board, Pokhara Tourism Council and traveller-planning research.
- Expanded parks into full visitor-guide pages with access, permits, alerts, safety, facilities, wildlife viewing, route planning, timeline and FAQs.
- Added JavaScript quick filters and richer visual cards to /parks.
- Added park admin rich editing plus browse/upload hero image support.
- Seeded richer Nepal park and protected-area content from NTB, NTNC, DNPWC-style official sources and park visitor-guide design patterns.
- Added production-style email verification for new traveller accounts.
- Added resend verification flow and email verification landing page.
- Explore posting, commenting, saving, following and submissions now require a verified email.
- Expanded super admin user controls for pending verification, manual verify, suspend and activate.
- Fixed public package links so guide package cards open slug-based package detail pages.
- Added package enquiry and booking request storage in the database.
- Added package detail enquiry form that emails the guide when mail is configured.
- Mirrored guide-owned package enquiries into guide contact leads for dashboard/business tracking.
- Added recent package enquiries to the guide dashboard so guides can see leads even if mail is not configured.
- Added clickable Explore posts to guide profile pages.
- Fixed slug URL generation for cities, parks, lakes, places, activities, events, blogs, routes and packages.