# AeroFind v1.0.2 — Release Notes
**Release Date:** April 25, 2026  
**Type:** Security Maintenance + Stability Update  
**Status:** ✅ Production Stable — Recommended for all deployments

---

## 🚀 What's New in v1.0.2

This release prioritizes system hardening and input validation to ensure enterprise-grade security and reliability.

### 🛡️ Security & Hardening

**1. Cross-Site Scripting (XSS) Mitigation**  
Patched potential XSS vectors in the **Admin Dashboard** and **Staff Portal**. All dynamic error messages, login feedback, and session-based alerts are now strictly encoded using `htmlspecialchars` to prevent malicious script injection via URL parameters or form inputs.

**2. Robust Installer Validation**  
The system installer (`install.php`) has been hardened with strict regular expression validation for database names. This prevents directory traversal attempts and ensures that only valid, filesystem-safe database names can be used during initialization.

**3. Directory Access Hardening**  
Removed legacy `.htaccess` files from the `uploads/` directory to prevent potential configuration conflicts. Access control is now handled via top-level security headers and proper directory permissions.

---

## 🛠️ Core Bug Fixes

### **1. WorldTracer® Flight Parser**
Improved the regex logic in the WorldTracer integration layer (`worldtracer.php`). The parser now supports a wider range of UTF-8 arrow characters (➔, ->) and handles flexible whitespace in flight segments, ensuring reliable data synchronization for international carriers.

### **2. API Resource Optimization**
Identified and resolved a potential cURL resource leak in the central API layer. Resources are now explicitly closed after execution, preventing memory exhaustion in high-concurrency environments.

---

## 📦 Technical Changes

| Module | Change |
|--------|--------|
| `admin.php` | Applied `htmlspecialchars` to login error reporting. |
| `staffportal.php` | Hardened staff login feedback with HTML entity encoding. |
| `install.php` | Added `preg_match` validation for `dbname` input. |
| `worldtracer.php` | Updated `parseFlightString` regex for UTF-8 compatibility. |
| `api.php` | Ensured `curl_close()` is called on all outgoing requests. |

---

## 📋 Upgrade Instructions

### Upgrade from v1.0.1 or lower
1. **Overwrite Files**: Upload and replace `admin.php`, `staffportal.php`, `install.php`, `worldtracer.php`, and `api.php`.
2. **Clear Cache**: If you have browser caching enabled, clear it to ensure the new security scripts are loaded.
3. **Delete Installer**: If `install.php` is still on your server, either delete it or ensure it is protected.

---

*AeroFind v1.0.2 — Built for the ground. Designed for the passenger.*
