Updates to the Update Group logic to have a cleaner output

.docker-compose.runtime.override.yml

@@ -1,8 +0,0 @@
-services:
-  app:
-    working_dir: /app/Web
-    command: ["gunicorn", "app:app", "--bind", "0.0.0.0:8000", "--workers", "4", "--threads", "2", "--timeout", "30", "--graceful-timeout", "20", "--worker-connections", "100", "--max-requests", "1000", "--max-requests-jitter", "100", "--log-level", "info", "--access-logfile", "-", "--error-logfile", "-"]
-    image: ghcr.io/aiirondev/legendary-octo-garbanzo:v0.7.42
-    build: null
-    ports:
-      - "10000:8000"

.github/workflows/release-docker.yml

@@ -200,90 +200,98 @@ jobs:
 
       - name: Create release-only docker bundle
         run: |
-          mkdir -p release-bundle
-          cat > release-bundle/docker-compose.yml <<EOF
-          services:
-            app:
-              image: \${INVENTAR_APP_IMAGE:-${{ steps.meta.outputs.image }}}
-              container_name: inventarsystem-app
-              restart: unless-stopped
-              ports:
-                - "\${INVENTAR_HTTP_PORT:-10000}:8000"
-              depends_on:
-                - mongodb
-                - redis
-              environment:
-                INVENTAR_MONGODB_HOST: mongodb
-                INVENTAR_MONGODB_PORT: "27017"
-                INVENTAR_MONGODB_DB: Inventarsystem
-                INVENTAR_BACKUP_FOLDER: /data/backups
-                INVENTAR_LOGS_FOLDER: /data/logs
-              expose:
-                - "8000"
-              volumes:
-                - ./config.json:/app/config.json:ro
-                - app_uploads:/app/Web/uploads
-                - app_thumbnails:/app/Web/thumbnails
-                - app_previews:/app/Web/previews
-                - app_qrcodes:/app/Web/QRCodes
-                - app_backups:/data/backups
-                - app_logs:/data/logs
-
-            mongodb:
-              image: mongo:7.0
-              container_name: inventarsystem-mongodb
-              restart: unless-stopped
-              volumes:
-                - mongodb_data:/data/db
-              healthcheck:
-                test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping').ok"]
-                interval: 10s
-                timeout: 5s
-                retries: 10
-
-            redis:
-              image: redis:7-alpine
-              container_name: inventarsystem-redis
-              restart: unless-stopped
-              command: redis-server --appendonly yes --maxmemory 512mb --maxmemory-policy allkeys-lru
-              ports:
-                - "6379:6379"
-              volumes:
-                - redis_data:/data
-              healthcheck:
-                test: ["CMD", "redis-cli", "ping"]
-                interval: 10s
-                timeout: 5s
-                retries: 5
-
-          volumes:
-            mongodb_data:
-            app_uploads:
-            app_thumbnails:
-            app_previews:
-            app_qrcodes:
-            app_backups:
-            app_logs:
-            redis_data:
-          EOF
-
-          # Copy runtime scripts and config if present
-          for f in start.sh stop.sh restart.sh backup.sh restore.sh config.json update.sh; do
-            if [ -f "$f" ]; then
-              cp "$f" "release-bundle/$(basename "$f")"
-            fi
-          done
-
-          # Multitenant scripts & docs (optional)
-          for f in docker-compose-multitenant.yml manage-tenant.sh run-tenant-cmd.sh MULTITENANT_DEPLOYMENT.md MULTITENANT_PYTHON_API.md; do
-            if [ -f "$f" ]; then
-              cp "$f" "release-bundle/$(basename "$f")"
-            fi
-          done
-
-          # Make any shipped scripts executable
-          find release-bundle -maxdepth 1 -type f -name '*.sh' -exec chmod +x {} \; || true
-          tar -czf inventarsystem-docker-bundle.tar.gz -C release-bundle .
+            mkdir -p release-bundle
+            cat > release-bundle/docker-compose.yml <<EOF
+            services:
+              app:
+                image: \${INVENTAR_APP_IMAGE:-${{ steps.meta.outputs.image }}}
+                container_name: inventarsystem-app
+                restart: unless-stopped
+                ports:
+                  - "\${INVENTAR_HTTP_PORT:-10000}:8000"
+                depends_on:
+                  - mongodb
+                  - redis
+                environment:
+                  INVENTAR_MONGODB_HOST: mongodb
+                  INVENTAR_MONGODB_PORT: "27017"
+                  INVENTAR_MONGODB_DB: Inventarsystem
+                  INVENTAR_BACKUP_FOLDER: /data/backups
+                  INVENTAR_LOGS_FOLDER: /data/logs
+                  INVENTAR_SECRET_KEY: \${INVENTAR_SECRET_KEY}
+                  INVENTAR_DATA_ENCRYPTION_KEY: \${INVENTAR_DATA_ENCRYPTION_KEY}
+                  INVENTAR_MONGODB_PASSWORD: \${INVENTAR_MONGODB_PASSWORD}
+                  EMAIL_ENABLED: \${EMAIL_ENABLED}
+                  EMAIL_SMTP_HOST: \${EMAIL_SMTP_HOST}
+                  EMAIL_SMTP_PORT: \${EMAIL_SMTP_PORT}
+                  EMAIL_USERNAME: \${EMAIL_USERNAME}
+                  EMAIL_PASSWORD: \${EMAIL_PASSWORD}
+                expose:
+                  - "8000"
+                volumes:
+                  - ./config.json:/app/config.json:ro
+                  - app_uploads:/app/Web/uploads
+                  - app_thumbnails:/app/Web/thumbnails
+                  - app_previews:/app/Web/previews
+                  - app_qrcodes:/app/Web/QRCodes
+                  - app_backups:/data/backups
+                  - app_logs:/data/logs
+            
+              mongodb:
+                image: mongo:7.0
+                container_name: inventarsystem-mongodb
+                restart: unless-stopped
+                volumes:
+                  - mongodb_data:/data/db
+                healthcheck:
+                  test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping').ok"]
+                  interval: 10s
+                  timeout: 5s
+                  retries: 10
+            
+              redis:
+                image: redis:7-alpine
+                container_name: inventarsystem-redis
+                restart: unless-stopped
+                command: redis-server --appendonly yes --maxmemory 512mb --maxmemory-policy allkeys-lru
+                ports:
+                  - "6379:6379"
+                volumes:
+                  - redis_data:/data
+                healthcheck:
+                  test: ["CMD", "redis-cli", "ping"]
+                  interval: 10s
+                  timeout: 5s
+                  retries: 5
+            
+            volumes:
+              mongodb_data:
+              app_uploads:
+              app_thumbnails:
+              app_previews:
+              app_qrcodes:
+              app_backups:
+              app_logs:
+              redis_data:
+            EOF
+            
+            # Copy runtime scripts and config if present
+            for f in start.sh stop.sh restart.sh backup.sh restore.sh config.json update.sh; do
+              if [ -f "$f" ]; then
+                cp "$f" "release-bundle/$(basename "$f")"
+              fi
+            done
+            
+            # Multitenant scripts & docs (optional)
+            for f in docker-compose-multitenant.yml manage-tenant.sh run-tenant-cmd.sh MULTITENANT_DEPLOYMENT.md MULTITENANT_PYTHON_API.md; do
+              if [ -f "$f" ]; then
+                cp "$f" "release-bundle/$(basename "$f")"
+              fi
+            done
+            
+            # Make any shipped scripts executable
+            find release-bundle -maxdepth 1 -type f -name '*.sh' -exec chmod +x {} \; || true
+            tar -czf inventarsystem-docker-bundle.tar.gz -C release-bundle .
 
       - name: Create or update Gitea Release
         uses: https://gitea.com/actions/gitea-release-action@v1

.gitignore

@@ -3,6 +3,7 @@ logs
 certs
 build
 .venv
+.idea
 __pycache__
 .pycvapid.json
 Web/vapid.json

.release-version

@@ -1 +0,0 @@
-v0.8.31.1

CODE_OF_CONDUCT.md

@@ -1,128 +0,0 @@
-# Contributor Covenant Code of Conduct
-
-## Our Pledge
-
-We as members, contributors, and leaders pledge to make participation in our
-community a harassment-free experience for everyone, regardless of age, body
-size, visible or invisible disability, ethnicity, sex characteristics, gender
-identity and expression, level of experience, education, socio-economic status,
-nationality, personal appearance, race, religion, or sexual identity
-and orientation.
-
-We pledge to act and interact in ways that contribute to an open, welcoming,
-diverse, inclusive, and healthy community.
-
-## Our Standards
-
-Examples of behavior that contributes to a positive environment for our
-community include:
-
-* Demonstrating empathy and kindness toward other people
-* Being respectful of differing opinions, viewpoints, and experiences
-* Giving and gracefully accepting constructive feedback
-* Accepting responsibility and apologizing to those affected by our mistakes,
-  and learning from the experience
-* Focusing on what is best not just for us as individuals, but for the
-  overall community
-
-Examples of unacceptable behavior include:
-
-* The use of sexualized language or imagery, and sexual attention or
-  advances of any kind
-* Trolling, insulting or derogatory comments, and personal or political attacks
-* Public or private harassment
-* Publishing others' private information, such as a physical or email
-  address, without their explicit permission
-* Other conduct which could reasonably be considered inappropriate in a
-  professional setting
-
-## Enforcement Responsibilities
-
-Community leaders are responsible for clarifying and enforcing our standards of
-acceptable behavior and will take appropriate and fair corrective action in
-response to any behavior that they deem inappropriate, threatening, offensive,
-or harmful.
-
-Community leaders have the right and responsibility to remove, edit, or reject
-comments, commits, code, wiki edits, issues, and other contributions that are
-not aligned to this Code of Conduct, and will communicate reasons for moderation
-decisions when appropriate.
-
-## Scope
-
-This Code of Conduct applies within all community spaces, and also applies when
-an individual is officially representing the community in public spaces.
-Examples of representing our community include using an official e-mail address,
-posting via an official social media account, or acting as an appointed
-representative at an online or offline event.
-
-## Enforcement
-
-Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported to the community leaders responsible for enforcement at
-Iron.ai.dev@gmail.com.
-All complaints will be reviewed and investigated promptly and fairly.
-
-All community leaders are obligated to respect the privacy and security of the
-reporter of any incident.
-
-## Enforcement Guidelines
-
-Community leaders will follow these Community Impact Guidelines in determining
-the consequences for any action they deem in violation of this Code of Conduct:
-
-### 1. Correction
-
-**Community Impact**: Use of inappropriate language or other behavior deemed
-unprofessional or unwelcome in the community.
-
-**Consequence**: A private, written warning from community leaders, providing
-clarity around the nature of the violation and an explanation of why the
-behavior was inappropriate. A public apology may be requested.
-
-### 2. Warning
-
-**Community Impact**: A violation through a single incident or series
-of actions.
-
-**Consequence**: A warning with consequences for continued behavior. No
-interaction with the people involved, including unsolicited interaction with
-those enforcing the Code of Conduct, for a specified period of time. This
-includes avoiding interactions in community spaces as well as external channels
-like social media. Violating these terms may lead to a temporary or
-permanent ban.
-
-### 3. Temporary Ban
-
-**Community Impact**: A serious violation of community standards, including
-sustained inappropriate behavior.
-
-**Consequence**: A temporary ban from any sort of interaction or public
-communication with the community for a specified period of time. No public or
-private interaction with the people involved, including unsolicited interaction
-with those enforcing the Code of Conduct, is allowed during this period.
-Violating these terms may lead to a permanent ban.
-
-### 4. Permanent Ban
-
-**Community Impact**: Demonstrating a pattern of violation of community
-standards, including sustained inappropriate behavior,  harassment of an
-individual, or aggression toward or disparagement of classes of individuals.
-
-**Consequence**: A permanent ban from any sort of public interaction within
-the community.
-
-## Attribution
-
-This Code of Conduct is adapted from the [Contributor Covenant][homepage],
-version 2.0, available at
-https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
-
-Community Impact Guidelines were inspired by [Mozilla's code of conduct
-enforcement ladder](https://github.com/mozilla/diversity).
-
-[homepage]: https://www.contributor-covenant.org
-
-For answers to common questions about this code of conduct, see the FAQ at
-https://www.contributor-covenant.org/faq. Translations are available at
-https://www.contributor-covenant.org/translations.

LICENSE.md

@@ -1,55 +0,0 @@
- # Endbenutzer-Lizenzvertrag (EULA) und Nutzungsbedingungen
-**Softwareprojekt:** Inventarsystem  
-**Urheberrechtshalter (Lizenzgeber):** Maximilian Gründinger
-**Gültigkeit:** Stand 2026
-
----
-
-### PRÄAMBEL
-Dieser Endbenutzer-Lizenzvertrag (im Folgenden „Vertrag“) stellt eine rechtsgültige Vereinbarung zwischen Ihnen (im Folgenden „Lizenznehmer“) und dem Urheber **AIIrondev** (im Folgenden „Lizenzgeber“) dar. Durch den Zugriff auf den Quellcode, die Installation, das Kopieren oder die sonstige Nutzung der Software „Inventarsystem“ (im Folgenden „Produkt“) erklärt sich der Lizenznehmer mit den nachfolgenden Bedingungen vollumfänglich einverstanden. 
-
-Sollte der Lizenznehmer den Bedingungen dieses Vertrags nicht zustimmen, ist jegliche Nutzung, Vervielfältigung oder Distribution des Produkts mit sofortiger Wirkung untersagt.
-
----
-
-### § 1 GEGENSTAND DER LIZENZ UND EIGENTUMSRECHTE
-1. Das Produkt wird dem Lizenznehmer unter Vorbehalt lizenziert, nicht verkauft. Sämtliche Eigentumsrechte, Urheberrechte und sonstigen geistigen Eigentumsrechte am Produkt sowie an allen Kopien davon verbleiben ausschließlich beim Lizenzgeber.
-2. Diese Lizenz gewährt lediglich ein eingeschränktes Nutzungsrecht unter den in diesem Vertrag explizit genannten Bedingungen.
-
-### § 2 ZULÄSSIGER NUTZUNGSKREIS (PRIVATNUTZUNG)
-1. Die unentgeltliche Nutzung des Produkts ist ausschließlich **natürlichen Personen für den rein privaten, häuslichen Gebrauch** gestattet.
-2. Die Nutzung umfasst die Verwaltung privater Bestände ohne jegliche Gewinnerzielungsabsicht.
-3. Jegliche Nutzung durch **Institutionelle Nutzer** (einschließlich, aber nicht beschränkt auf: Unternehmen, Einzelunternehmer, Freiberufler, Vereine, Bildungseinrichtungen, Behörden oder NGOs) ist ausdrücklich **untersagt** und bedarf einer gesonderten, schriftlichen Lizenzvereinbarung mit dem Lizenzgeber.
-
-### § 3 FUNKTIONALE EINSCHRÄNKUNGEN UND SUPPORT
-1. Dem Lizenznehmer wird das Produkt in der jeweils vorliegenden Fassung bereitgestellt („As-Is“). 
-2. Für die kostenlose Privatnutzung besteht **kein Anspruch** auf:
-    - Technischen Support oder Beratung.
-    - Bereitstellung von Sicherheits-Updates oder Patches.
-    - Gewährleistung der Kompatibilität mit spezifischen Hardware- oder Softwareumgebungen.
-3. Der Lizenzgeber behält sich das Recht vor, Funktionen in zukünftigen Versionen zu ändern, einzuschränken oder kostenpflichtig zu gestalten.
-
-### § 4 WAHRUNG DER URHEBERBEZEICHNUNG (BRANDING-KLAUSEL)
-1. Das Produkt verfügt über fest integrierte Urheberrechtshinweise, insbesondere die Kennzeichnung **„Powered by AIIrondev“** in der Benutzeroberfläche (Footer/Menü).
-2. Es ist dem Lizenznehmer untersagt, diese Hinweise zu entfernen, zu modifizieren, zu verdecken oder deren Sichtbarkeit durch technische Maßnahmen (z. B. Manipulation von CSS, JavaScript oder Metadaten) zu beeinträchtigen.
-3. Das Entfernen dieser Hinweise führt zum sofortigen und automatischen Erlöschen der Nutzungslizenz.
-
-### § 5 VERBOT DER KOMMERZIELLEN VERWERTUNG & SAAS
-1. Die Bereitstellung des Produkts als Dienstleistung für Dritte (Software-as-a-Service, SaaS), insbesondere gegen Entgelt oder zur Generierung von Werbeeinnahmen, ist strikt untersagt.
-2. Das Hosting auf öffentlichen Servern mit dem Ziel, Dritten ohne eigene Installation Zugriff auf die Funktionalität zu gewähren, ist nur mit ausdrücklicher schriftlicher Genehmigung des Lizenzgebers zulässig.
-
-### § 6 MODIFIKATIONEN UND CONTRIBUTIONS
-1. Der Lizenznehmer darf den Quellcode für den privaten Eigenbedarf modifizieren.
-2. Im Falle einer Veröffentlichung von Modifikationen oder der Einreichung von Verbesserungsvorschlägen (z. B. Pull Requests auf GitHub) räumt der Lizenznehmer dem Lizenzgeber ein unwiderrufliches, weltweites, zeitlich unbeschränktes und kostenfreies Nutzungs- und Verwertungsrecht an diesen Änderungen ein. Der Lizenzgeber ist berechtigt, diese Änderungen in das Hauptprodukt zu übernehmen und unter dieser oder einer anderen Lizenz zu vertreiben.
-
-### § 7 HAFTUNGSBESCHRÄNKUNG
-1. Die Haftung des Lizenzgebers für Schäden, die aus der Nutzung oder Unmöglichkeit der Nutzung des Produkts entstehen (einschließlich Datenverlust, Betriebsunterbrechung oder entgangener Gewinn), ist auf Vorsatz und grobe Fahrlässigkeit beschränkt.
-2. Der Lizenzgeber übernimmt keine Haftung für die Richtigkeit der mit dem Produkt verwalteten Daten.
-
-### § 8 RECHTSWAHL UND GERICHTSSTAND
-1. Es gilt ausschließlich das Recht der **Bundesrepublik Deutschland** unter Ausschluss des UN-Kaufrechts (CISG).
-2. Soweit gesetzlich zulässig, wird als Gerichtsstand für alle Streitigkeiten aus diesem Vertrag der Sitz des Lizenzgebers vereinbart.
-3. Sollten einzelne Bestimmungen dieses Vertrags unwirksam sein, bleibt die Wirksamkeit der übrigen Bestimmungen unberührt (Salvatorische Klausel).
-
----
-**ANFRAGEN FÜR AUSNAHMEGENEHMIGUNGEN (KOMMERZIELLE LIZENZEN):** Bitte kontaktieren Sie den Urheber direkt über das GitHub-Profil: [AIIrondev auf GitHub](https://github.com/AIIrondev)

RELEASE_OPTIONS.md

@@ -1,38 +0,0 @@
-Release-Optionen
-=================
-
-Diese Datei beschreibt die Eingabeoptionen des CI-Workflows `.github/workflows/release-docker.yml`.
-
-Inputs (workflow_dispatch)
-- `bump` (choice)
-  - `patch` (Standard): Erhöht nur die Patch-Version (vX.Y.Z -> vX.Y.Z+1).
-  - `minor`: Erhöht die Minor-Version und setzt Patch auf 0 (vX.Y.Z -> vX.Y+1.0).
-  - `major`: Erhöht die Major-Version und setzt Minor/Patch auf 0 (vX.Y.Z -> vX+1.0.0).
-  - `development`: Erzeugt einen Development-Release mit Suffix `-dev` (z. B. `v3.1.4-dev`).
-
-- `push_dev` (choice, optional)
-  - `false` (Standard): Bei `bump=development` wird das `:dev`-Image NICHT automatisch an GHCR gepusht.
-  - `true`: Bei `bump=development` wird zusätzlich das Image `ghcr.io/aiirondev/legendary-octo-garbanzo:dev` gepusht.
-
-Verhalten/Anmerkungen
-- Development releases werden als GitHub Release erzeugt und als `prerelease` markiert, damit sie nicht automatisch von normalen Update‑Flows genutzt werden.
-- Es gibt pro Release genau einen Release‑Eintrag (für Dev‑Releases mit `-dev` Suffix). Es wird kein separates `inventarsystem-image-dev.tar.gz` mehr erzeugt; das Update/Deployment erfolgt über den Release‑Tag / Image‑Tag.
-- `update.sh` unterstützt weiterhin `dev`/`development`-Modus und akzeptiert nun auch explizite Release‑Tags wie `v3.1.4-dev`.
-
-Beispiele
-- Patch-Release (manuell):
-  - GitHub UI: Run workflow → `bump=patch`
-  - CLI mit `gh`:
-    gh workflow run release-docker.yml --repo AIIrondev/legendary-octo-garbanzo --field bump=patch
-
-- Development prerelease (ohne Push des :dev Images):
-  - GitHub UI: Run workflow → `bump=development` (leave `push_dev=false`)
-  - Ergebnis: Release `vX.Y.Z-dev` als prerelease, Image wird nicht automatisch als `:dev` gepusht.
-
-- Development prerelease + push des :dev Images:
-  - GitHub UI: Run workflow → `bump=development`, `push_dev=true`
-  - CLI Beispiel:
-    gh workflow run release-docker.yml --repo AIIrondev/legendary-octo-garbanzo --field bump=development --field push_dev=true
-
-Empfehlung
-- Verwende `bump=development` für experimentelle/early releases; Nutzer müssen explizit `./update.sh vX.Y.Z-dev` ausführen, um auf diese Version zu upgraden.

SECURITY.md

@@ -1,25 +0,0 @@
-# Security Policy
-
-## Supported Versions
-
-The latest version will allways be supported the rest are old version that are not activly supported.
-
-| Version | Supported          |
-| ------- | ------------------ |
-| 0.2.17  | ✅                 |
-| 3.2.x   | :white_check_mark: |
-| 3.1.x   | :x:                |
-| 3.0.x   | :x: |
-| 2.6.x   | :x:                |
-| 2.4.x   | :x:                |
-| 1.8.x   | :x:                |
-| 1.7.x   | :x:                |
-| 1.5.x   | :x:                |
-| 1.4.x   | :x:                |
-| 1.3.x   | :x:                |
-| 1.1.x   | :x:                |
-
-
-## Reporting a Vulnerability
-
-To report a vulnerability contact me via. my E-Mail Iron.ai.dev@gmail.com or in insevere cases over an Issue.

Web/modules/database/settings.py

@@ -220,15 +220,15 @@ SSL_CERT = _get(_conf, ['ssl', 'cert'], DEFAULTS['ssl']['cert'])
 SSL_KEY = _get(_conf, ['ssl', 'key'], DEFAULTS['ssl']['key'])
 
 # Email settings
-EMAIL_ENABLED = _get(_conf, ['email', 'enabled'], False)
-EMAIL_SMTP_HOST = _get(_conf, ['email', 'smtp_host'], 'smtp.gmail.com')
-EMAIL_SMTP_PORT = int(_get(_conf, ['email', 'smtp_port'], 587))
-EMAIL_USE_TLS = bool(_get(_conf, ['email', 'use_tls'], True))
-EMAIL_USERNAME = _get(_conf, ['email', 'username'], '')
-EMAIL_PASSWORD = _get(_conf, ['email', 'password'], '')
+EMAIL_ENABLED = bool(os.getenv('EMAIL_ENABLED', False))
+EMAIL_SMTP_HOST = str(os.getenv('EMAIL_SMTP_HOST', False))
+EMAIL_SMTP_PORT = int(os.getenv('EMAIL_SMTP_PORT', 587))
+EMAIL_USE_TLS = True
+EMAIL_USERNAME = str(os.getenv('EMAIL_USERNAME', False))
+EMAIL_PASSWORD = str(os.getenv('EMAIL_PASSWORD', False))
 EMAIL_FROM_ADDRESS = _get(_conf, ['email', 'from_address'], EMAIL_USERNAME)
-EMAIL_DEFAULT_SENDER_NAME = _get(_conf, ['email', 'default_sender_name'], 'Inventarsystem')
-EMAIL_TIMEOUT_SECONDS = int(_get(_conf, ['email', 'timeout_seconds'], 30))
+EMAIL_DEFAULT_SENDER_NAME = "Invario Inventarsystem Sender"
+EMAIL_TIMEOUT_SECONDS = 20
 
 # School periods
 SCHOOL_PERIODS = _get(_conf, ['schoolPeriods'], DEFAULTS['schoolPeriods'])
@@ -278,6 +278,7 @@ INVENTORY_MODULE_ENABLED = _TenantAwareBool('inventory', _get(_conf, ['modules',
 TERMINPLAN_MODULE_ENABLED = _TenantAwareBool('terminplan', _get(_conf, ['modules', 'terminplan', 'enabled'], DEFAULTS['modules']['terminplan']['enabled']))
 LIBRARY_MODULE_ENABLED = _TenantAwareBool('library', _get(_conf, ['modules', 'library', 'enabled'], DEFAULTS['modules']['library']['enabled']))
 STUDENT_CARDS_MODULE_ENABLED = _TenantAwareBool('student_cards', _get(_conf, ['modules', 'student_cards', 'enabled'], DEFAULTS['modules']['student_cards']['enabled']))
+MAIL_ADD_ON_ENABLED = _TenantAwareBool('mail', _get(_conf, ['email', 'enabled'], False))
 
 def _match_inventory(path):
     if not path: return False
@@ -297,11 +298,16 @@ def _match_student_cards(path):
     if not path: return False
     return path.startswith(('/student_cards'))
 
+def _match_mail(path):
+    if not path: return False
+    return path.startswith(('/'))
+
 # Register core modules into the pipeline
 MODULES.register('inventory', INVENTORY_MODULE_ENABLED, _match_inventory)
 MODULES.register('terminplan', TERMINPLAN_MODULE_ENABLED, _match_terminplan)
 MODULES.register('library', LIBRARY_MODULE_ENABLED, _match_library)
 MODULES.register('student_cards', STUDENT_CARDS_MODULE_ENABLED, _match_student_cards)
+MODULES.register('mail', MAIL_ADD_ON_ENABLED, _match_mail)
 
 STUDENT_DEFAULT_BORROW_DAYS = int(_get(_conf, ['modules', 'student_cards', 'default_borrow_days'], DEFAULTS['modules']['student_cards']['default_borrow_days']))
 STUDENT_MAX_BORROW_DAYS = int(_get(_conf, ["modules", "student_cards", "max_borrow_days"], DEFAULTS["modules"]["student_cards"]["max_borrow_days"]))

Web/modules/database/user.py

@@ -97,18 +97,18 @@ def build_name_synonym(first_name, last_name=''):
     last = _clean_name_fragment(last_name)
 
     if first and last:
-        return (first[:2] + last[:2]).title()
+        return (first[:3] + last[:3]).title()
 
     combined = (first + last)
     if not combined:
         return 'User'
-    return combined[:4].title()
+    return combined[:6].title()
 
 
 def build_username_from_name(first_name, last_name=''):
     """
     Build a deterministic username abbreviation from first and last name.
-    Uses 2 letters from each name and stores it lowercase.
+    Uses 3 letters from each name and stores it lowercase.
     
     Args:
         first_name (str): First name
@@ -123,12 +123,12 @@ def build_username_from_name(first_name, last_name=''):
 
 def build_unique_username_from_name(first_name, last_name=''):
     """
-    Build a unique username from the first 2 letters of the first name and
-    the first 2 letters of the last name.
+    Build a unique username from the first 3 letters of the first name and
+    the first 3 letters of the last name.
     """
     first = _clean_name_fragment(first_name)
     last = _clean_name_fragment(last_name)
-    base_username = (first[:2] + last[:2]).lower()
+    base_username = (first[:3] + last[:3]).lower()
 
     if not base_username:
         base_username = 'user'
@@ -594,8 +594,8 @@ def student_card_exists(student_card_id):
         return False
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
-    users = db['users']
-    exists = users.find_one({'StudentCardId': normalized}) is not None
+    users = db['student_cards']
+    exists = users.find_one({'SchülerName': normalized}) is not None
     client.close()
     return exists
 
@@ -607,8 +607,8 @@ def get_user_by_student_card(student_card_id):
         return None
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     db = _get_tenant_db(client)
-    users = db['users']
-    found_user = users.find_one({'StudentCardId': normalized})
+    users = db['student_cards']
+    found_user = users.find_one({'SchülerName': normalized})
     client.close()
     return found_user
 

Web/modules/emailservice/email.py

@@ -1,51 +1,98 @@
-from email.mime.text import MIMEText
 from email.mime.multipart import MIMEMultipart
-from modules.module_registry import ModuleRegistry as mr
+from email.mime.text import MIMEText
 import smtplib
+import time
 
 import Web.modules.database.settings as cfg
 
 
 def _build_smtp_client():
-    smtp = smtplib.SMTP(cfg.EMAIL_SMTP_HOST, cfg.EMAIL_SMTP_PORT, timeout=cfg.EMAIL_TIMEOUT_SECONDS)
+    smtp = smtplib.SMTP(
+        cfg.EMAIL_SMTP_HOST,
+        cfg.EMAIL_SMTP_PORT,
+        timeout=cfg.EMAIL_TIMEOUT_SECONDS,
+    )
     smtp.ehlo()
     if cfg.EMAIL_USE_TLS:
         smtp.starttls()
         smtp.ehlo()
     if cfg.EMAIL_USERNAME:
-        smtp.login(cfg.EMAIL_USERNAME, cfg.EMAIL_PASSWORD or '')
+        smtp.login(cfg.EMAIL_USERNAME, cfg.EMAIL_PASSWORD or "")
     return smtp
 
-def send(email: list, subject: str, note: str, sender: str) -> bool:
-  """
-  Sends the email with the link to the Clients
 
-  Input:
-  - email: Email list of all the addresses to send the link to ["","",""]
-  - subject: Subject of the email
-  - note: Note that is send with the Emails
+def send(email: list | str, subject: str, note: str, sender: str) -> bool:
+    """Sends the email with the link to the Clients."""
+    if not cfg.MODULES.is_enabled("mail"):
+        print("Debug: Module not enabled")
+        return False
+
+    if isinstance(email, str):
+        email = [email]
+
+    body_message = note
+
+    HTML_SIGNATURE = f"""
+    <table cellpadding="0" cellspacing="0" border="0" style="font-family: Arial, Helvetica, sans-serif; font-size: 13px; color: #333333; line-height: 1.5;">
+        <tr>
+            <td>
+                <p style="margin:0 0 12px 0;">Mit freundlichen Grüßen</p>
+                <p style="margin:0;"><strong style="font-size:16px;">Automatisierter Email Verteiler für die Schule: {cfg.get_school_info().get("name")}</strong><br></p>
+                <p style="margin:12px 0 0 0;"><strong>Invario UG</strong><br>Am Sportplatz 10<br>83052 Bruckmühl</p>
+            </td>
+        </tr>
+    </table>
+    """
+
+    text_content = f"{body_message}\n\nMit freundlichen Grüßen\n{sender}\nInvario UG"
+
+    html_content = f"""
+    <html>
+      <body>
+        <p>{body_message}</p>
+        <br>
+        {HTML_SIGNATURE}
+      </body>
+    </html>
+    """
+
+    mails_per_second = 10
+    interval = 1.0 / mails_per_second
 
-  Output:
-  - bool: true if the sending worked and false if it didnt
-  """
-  if not mr.registry.is_enabled('mail'):
-    return False
-  else:
-    msg = MIMEMultipart()
-    msg['Subject'] = subject
-    msg['From'] = sender or cfg.EMAIL_FROM_ADDRESS or cfg.EMAIL_USERNAME
-    msg['To'] = ', '.join(email) if isinstance(email, (list, tuple)) else str(email)
-    msg.attach(MIMEText(note))
     smtp = None
     try:
-      smtp = _build_smtp_client()
-      smtp.sendmail(from_addr=msg['From'], to_addrs=email, msg=msg.as_string())
-      return True
-    except Exception:
-      return False
+        smtp = _build_smtp_client()
+
+        for i, recipient in enumerate(email):
+            start_time = time.time()
+
+            msg = MIMEMultipart("alternative")
+            msg["Subject"] = str(subject)
+            msg["From"] = f"{sender} <{cfg.EMAIL_USERNAME}>"
+            msg["To"] = str(recipient)
+
+            msg.attach(MIMEText(text_content, "plain"))
+            msg.attach(MIMEText(html_content, "html"))
+
+            smtp.sendmail(
+                from_addr=cfg.EMAIL_USERNAME,
+                to_addrs=[recipient],
+                msg=msg.as_string()
+            )
+
+            elapsed_time = time.time() - start_time
+            sleep_time = interval - elapsed_time
+
+            if sleep_time > 0 and i < len(email) - 1:
+                time.sleep(sleep_time)
+
+        return True
+    except Exception as e:
+        print(f"Debug: Fehler beim Senden der E-Mail: {e}")
+        return False
     finally:
-      try:
         if smtp:
-          smtp.quit()
-      except Exception:
-        pass
+            try:
+                smtp.quit()
+            except Exception:
+                pass

Web/modules/terminplaner/backend_server.py

@@ -22,7 +22,7 @@ def _resolve_public_base_url() -> str:
     subdomain = ''
     if tenant_context:
         subdomain = getattr(tenant_context, 'subdomain', '') or getattr(tenant_context, 'tenant_id', '') or ''
-    return f"https://{subdomain}.invario.eu" if subdomain else "https://invario.eu"
+    return (f"https://{subdomain}.invario-software.de") if subdomain else "https://invario-software.de"
 
 
 def _current_tenant_id() -> str:

Web/requirements.txt

@@ -1,4 +1,5 @@
 flask
+flask-wtf
 werkzeug
 gunicorn
 pymongo

Web/templates/base.html

@@ -1375,8 +1375,10 @@
                                 <li><a class="dropdown-item" href="{{ url_for('library_loans_admin') }}">Ausleihen / Defekte Items</a></li>
                                 {% endif %}
                                 {% if student_cards_module_enabled %}
+                                {% if current_permissions.actions.get('can_manage_users', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('student_cards_admin') }}">Bibliotheksausweis</a></li>
                                 {% endif %}
+                                {% endif %}
                                 {% if current_permissions.pages.get('admin_school_settings', False) %}
                                 <li><a class="dropdown-item" href="{{ url_for('admin_school_settings') }}">Schulstammdaten</a></li>
                                 {% endif %}
@@ -1619,11 +1621,10 @@
     <div id="cookie-banner" role="dialog" aria-live="polite" aria-label="Cookie-Hinweis">
         <div class="cb-inner">
             <div class="cb-text">
-                Wir verwenden technisch notwendige Cookies, um Ihre Sitzung zu verwalten und die Anwendung bereitzustellen. Bitte akzeptieren Sie Cookies, um fortzufahren.
+                Wir verwenden ausschließlich technisch notwendige Cookies, um Ihre Sitzung zu verwalten und die Anwendung bereitzustellen. Bitte bestätigen Sie dies, um fortzufahren.
             </div>
             <div class="cb-actions">
-                <button class="btn-decline" id="cookie-decline">Ablehnen</button>
-                <button class="btn-accept" id="cookie-accept">Akzeptieren</button>
+                <button class="btn-accept" id="cookie-accept">Notwendige Cookies akzeptieren</button>
             </div>
         </div>
     </div>
@@ -1728,31 +1729,39 @@
         (function(){
             function getCookie(name){
                 const v = document.cookie.split(';').map(s=>s.trim());
-                for(const c of v){ if(c.startsWith(name+'=')) return decodeURIComponent(c.split('=')[1]); }
+                for(const c of v){ 
+                    if(c.startsWith(name+'=')) return decodeURIComponent(c.split('=')[1]); 
+                }
                 return null;
             }
+
             function setCookie(name, value, days){
-                const d = new Date(); d.setTime(d.getTime() + (days*24*60*60*1000));
+                const d = new Date(); 
+                d.setTime(d.getTime() + (days*24*60*60*1000));
                 document.cookie = name + '=' + encodeURIComponent(value) + ';expires=' + d.toUTCString() + ';path=/;SameSite=Lax';
             }
-            function showBanner(){ var el = document.getElementById('cookie-banner'); if(el) el.style.display = 'block'; }
-            function hideBanner(){ var el = document.getElementById('cookie-banner'); if(el) el.style.display = 'none'; }
 
-            // If not decided yet, show banner and block app until decision
+            function showBanner(){ 
+                var el = document.getElementById('cookie-banner'); 
+                if(el) el.style.display = 'block'; 
+            }
+
+            function hideBanner(){ 
+                var el = document.getElementById('cookie-banner'); 
+                if(el) el.style.display = 'none'; 
+            }
+
+            // Prüfen, ob der Nutzer bereits zugestimmt hat
             const consent = getCookie('cookie_consent');
             if(!consent){
                 showBanner();
-                // Optionally blur content until consent
-                document.body.style.filter = 'none';
             }
+
+            // Nur noch der Akzeptieren-Button für vitale Cookies ist vorhanden
             document.getElementById('cookie-accept')?.addEventListener('click', function(){
-                setCookie('cookie_consent','accepted',365);
+                setCookie('cookie_consent', 'vital_accepted', 365);
                 hideBanner();
             });
-            document.getElementById('cookie-decline')?.addEventListener('click', function(){
-                setCookie('cookie_consent','declined',365);
-                window.location.href = 'https://www.ecosia.org/';
-            });
 
             const username = {{ (session['username'] if 'username' in session else '')|tojson }};
             const isTutorialPage = window.location.pathname === {{ url_for('tutorial_page')|tojson }};

Web/templates/library_borrowings_admin.html

@@ -520,7 +520,16 @@
   window.openDamageReportPrompt = openDamageReportPrompt;
 
   function openDamageInvoiceModal(row, description) {
-    if (!damageInvoiceModal || !damageInvoiceForm) {
+    const modal = document.getElementById('damage-invoice-modal');
+    const form = document.getElementById('damage-invoice-form');
+    const inputItem = document.getElementById('damage-invoice-item');
+    const inputBorrower = document.getElementById('damage-invoice-borrower');
+    const inputCode = document.getElementById('damage-invoice-code');
+    const inputAmount = document.getElementById('damage-invoice-amount');
+    const inputReason = document.getElementById('damage-invoice-reason');
+
+    if (!modal || !form) {
+      console.error("Modal oder Formular nicht gefunden.");
       return;
     }
 
@@ -530,23 +539,29 @@
     const itemCode = row.dataset.itemCode || '';
     const itemCost = row.dataset.itemCost || '';
 
-    damageInvoiceForm.action = "{{ url_for('admin_create_invoice', borrow_id='__BORROW_ID__') }}".replace('__BORROW_ID__', borrowId);
-    damageInvoiceItem.value = itemName;
-    damageInvoiceBorrower.value = borrower;
-    damageInvoiceCode.value = itemCode;
-    damageInvoiceAmount.value = String(itemCost).replace(' EUR', '').trim();
-    damageInvoiceReason.value = description || `Schaden gemeldet für ${itemName}`;
-    damageInvoiceModal.style.display = 'block';
-    damageInvoiceAmount.focus();
+    form.action = "{{ url_for('admin_create_invoice', borrow_id='__BORROW_ID__') }}".replace('__BORROW_ID__', borrowId);
+
+    inputItem.value = itemName;
+    inputBorrower.value = borrower;
+    inputCode.value = itemCode;
+
+    inputAmount.value = String(itemCost).replace(' EUR', '').trim();
+
+    inputReason.value = description || `Schaden gemeldet für ${itemName}`;
+
+    modal.style.display = 'block';
+    inputAmount.focus();
+  }
+
+  function closeDamageInvoiceModal() {
+    const modal = document.getElementById('damage-invoice-modal');
+    if (modal) {
+      modal.style.display = 'none';
+    }
   }
 
   window.openDamageInvoiceModal = openDamageInvoiceModal;
-
-  function closeDamageInvoiceModal() {
-    if (damageInvoiceModal) {
-      damageInvoiceModal.style.display = 'none';
-    }
-  }
+  window.closeDamageInvoiceModal = closeDamageInvoiceModal;
 
   if (damageInvoiceModal) {
     damageInvoiceModal.addEventListener('click', function(event) {

Web/templates/library_table.html

@@ -1371,7 +1371,8 @@
                         await loadLibraryItems(); // Daten neu laden
                         // renderTable(); // Ggf. Tabelle neu rendern
                     } else {
-                        alert('Fehler: ' + result.message);
+                        closeEditLibraryModal();
+                        await loadLibraryItems();
                     }
                 } catch (error) {
                     console.error('Update failed:', error);
@@ -1416,8 +1417,8 @@
                 <div>
                     <label for="editLibraryType">Medientyp</label>
                     <select id="editLibraryType" style="width: 100%;">
-                        <option value="book">Buch</option>
-                        <option value="schoolbook">Schulbuch</option>
+                        <option value="Buch">Buch</option>
+                        <option value="Schulbuch">Schulbuch</option>
                         <option value="cd">CD</option>
                         <option value="dvd">DVD</option>
                         <option value="other">Sonstige Medien</option>
@@ -1451,14 +1452,14 @@
     <div style="display: flex; justify-content: space-between; align-items: center; margin-bottom: 10px; border-bottom: 1px solid #eee; padding-bottom: 10px;">
         <strong style="color: #0ea5e9;">Gruppen-Range (Total: <span id="editLibraryGroupCount"></span>)</strong>
     </div>
-    
+
     <p style="margin: 5px 0; font-size: 12px; color: #555;">
         Alle Codes in dieser Gruppe:
     </p>
-    
+
     <!-- Hier wird die Liste als Komma-Text eingefügt -->
     <div id="editLibraryAllCodes" style="font-family: monospace; font-size: 14px; font-weight: bold; color: #333; margin-top: 5px;"></div>
-    
+
     <div style="margin-top: 15px; font-size: 11px; background: #e0f2fe; padding: 8px; border-radius: 4px;">
         <strong>Hinweis:</strong> Änderungen an Titel/Ort/Beschreibung werden auf <strong>alle</strong> Exemplare der Range übertragen.
     </div>

Web/templates/main_admin.html

@@ -2309,6 +2309,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
 </script>
 
 <div class="admin-content-container">
+    {% if current_permissions.actions.get('can_edit', False) %}
     <!-- Admin conflict warning banner (populated by JS) -->
     <div id="conflict-banner" style="display:none; background:#fff3cd; border:1px solid #ffc107; border-left:4px solid #fd7e14; color:#856404; padding:12px 16px; border-radius:4px; margin-bottom:16px; position:relative;">
         <strong>⚠ Buchungskonflikte erkannt:</strong>
@@ -2335,6 +2336,8 @@ document.addEventListener('DOMContentLoaded', ()=>{
             .catch(() => {});
     });
     </script>
+    {% endif %}
+
     <div class="content">
         <h1 style="position:relative;">Inventar Objekte
             <div class="view-switch-group">
@@ -2344,14 +2347,17 @@ document.addEventListener('DOMContentLoaded', ()=>{
                 <button id="toggle-favorites-view" class="view-toggle-btn" title="Nur Merkliste anzeigen">
                     <span id="favorites-view-icon">🔖</span>
                 </button>
+                {% if current_permissions.actions.get('can_delete', False) %}
                 <div class="bulk-delete-inline-wrap">
                     <button type="button" id="bulk-delete-drawer-toggle" class="view-toggle-btn bulk-delete-drawer-toggle" aria-expanded="false" title="Massenlöschung" onclick="toggleBulkDeleteDrawer()">
                         <span class="drawer-icon">⚙</span>
                     </button>
                 </div>
+                {% endif %}
             </div>
         </h1>
         <div id="items-indicator" class="items-indicator">Objekte im System: 0</div>
+        {% if current_permissions.actions.get('can_delete', False) %}
         <div id="bulk-delete-drawer" class="bulk-delete-drawer" aria-hidden="true">
             <div class="bulk-delete-content">
                 <strong>Massenlöschung nach Kriterien</strong>
@@ -2364,6 +2370,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
                 <button type="button" id="bulk-delete-button" class="danger" onclick="deleteSelectedItems()" disabled>Auswahl löschen</button>
             </div>
         </div>
+        {% endif %}
         <div class="filter-container">
             <div class="filter-group">
                 <div class="filter-header">
@@ -2469,6 +2476,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
     </div>
 
     <!-- Add the edit modal form -->
+    {% if current_permissions.actions.get('can_edit', False) %}
     <div id="edit-modal" class="item-modal">
         <div class="modal-content">
             <span class="close-modal" onclick="closeEditModal()">&times;</span>
@@ -2646,6 +2654,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
             </form>
         </div>
     </div>
+    {% endif %}
 </div>
 
 <!-- Schedule Appointment Modal -->
@@ -2724,7 +2733,6 @@ document.addEventListener('DOMContentLoaded', ()=>{
     </div>
 </div>
 
-<!-- Initialize template variables before any JavaScript code -->
 <script>
     // Create a global object to hold server-side template values
     window.serverVars = {};
@@ -3239,7 +3247,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
             return;
         }
 
-        fetch('{{ url_for('bulk_delete_items') }}', {
+        fetch("{{ url_for('bulk_delete_items') }}", {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
@@ -3703,6 +3711,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
                                         Für Löschung markieren
                                     </label>
                                 </div>
+                                {% if current_permissions.actions.get('can_borrow', False) %}
                                 ${isAvailableForBorrow && !item.BlockedNow ? 
                                     `<form method="POST" action="{{ url_for('ausleihen', id='') }}${item._id}">
                                         ${isGroupedItem ? `
@@ -3724,12 +3733,21 @@ document.addEventListener('DOMContentLoaded', ()=>{
                                 :
                                     `<button class="ausleihen disabled-button" disabled>${item.BlockedNow ? 'Reserviert' : 'Ausgeliehen'}</button>`
                                 }
+                                {% endif %}
+                                {% if current_permissions.actions.get('can_delete', False) %}
                                 <form method="POST" action="{{ url_for('delete_item', id='') }}${item._id}" style="display:inline;" onsubmit="return confirm('Sind Sie sicher, dass Sie dieses Objekt löschen möchten?')">
                                     <button class="delete-button" type="submit">Löschen</button>
                                 </form>
+                                {% endif %}
+                                {% if current_permissions.actions.get('can_edit', False) %}
                                 <button class="edit-button" onclick="openEditModalForSelectedUnit('${item._id}', 'specific-item-card-${item._id}')">Bearbeiten</button>
+                                {% endif %}
+                                {% if current_permissions.actions.get('can_insert', False) %}
                                 <button class="duplicate-button" onclick="duplicateItem('${item._id}')">Duplizieren</button>
+                                {% endif %}
+                                {% if current_permissions.pages.get('admin_school_settings', False) %}
                                 ${canScheduleItem ? `<button class="schedule-button" onclick="openScheduleModal('${item._id}')">Reservieren</button>` : ''}
+                                {% endif %}
                             </div>
                         `;
                         itemsContainer.appendChild(card);
@@ -4506,10 +4524,10 @@ document.addEventListener('DOMContentLoaded', ()=>{
             : '<div style="font-size:0.92rem;color:#64748b;">Keine Beschädigungs-Historie vorhanden.</div>';
         
         modalContent.innerHTML = `
-            <h2>${item.Name}</h2>
+            <h2>${escapeHtml(item.Name || '')}</h2>
             ${borrowerInfoHtml}
             ${appointmentInfoHtml}
-            
+                
             <div class="modal-image-container">
                 ${imagesHtml}
                 ${item.Images && item.Images.length > 1 ? `
@@ -4518,66 +4536,67 @@ document.addEventListener('DOMContentLoaded', ()=>{
                     <div class="image-counter">1/${item.Images.length}</div>
                 ` : ''}
             </div>
-            
+
             <div class="modal-details">
                 <div class="detail-group">
                     <div class="detail-label">Ort:</div>
-                    <div class="detail-value">${item.Ort || '-'}</div>
+                    <div class="detail-value">${escapeHtml(item.Ort || '-')}</div>
                 </div>
-                
+
                 <div class="detail-group">
                     <div class="detail-label">Status:</div>
                     <div class="detail-value ${isBorrowed ? 'status-borrowed' : ''}">
                         ${isBorrowed ? 'Ausgeliehen' : 'Verfügbar'}
                     </div>
                 </div>
-                
+
                 <div class="detail-group">
                     <div class="detail-label">Unterrichtsfach:</div>
-                    <div class="detail-value">${filter1Array.join(', ') || '-'}</div>
+                    <div class="detail-value">${escapeHtml(filter1Array.join(', ') || '-')}</div>
                 </div>
-                
+
                 <div class="detail-group">
                     <div class="detail-label">Jahrgangsstufe:</div>
-                    <div class="detail-value">${filter2Array.join(', ') || '-'}</div>
+                    <div class="detail-value">${escapeHtml(filter2Array.join(', ') || '-')}</div>
                 </div>
-                
+
                 <div class="detail-group">
                     <div class="detail-label">Schlagwort:</div>
-                    <div class="detail-value">${filter3Array.join(', ') || '-'}</div>
+                    <div class="detail-value">${escapeHtml(filter3Array.join(', ') || '-')}</div>
                 </div>
-                
+
                 <div class="detail-group">
                     <div class="detail-label">Code:</div>
-                    <div class="detail-value">${item.Code_4 || '-'}</div>
+                    <div class="detail-value">${escapeHtml(item.Code_4 || '-')}</div>
                 </div>
-
+            
                 <div class="detail-group">
                     <div class="detail-label">Anzahl:</div>
-                    <div class="detail-value">${item.GroupedDisplayCount || 1}</div>
+                    <div class="detail-value">${escapeHtml(String(item.GroupedDisplayCount || 1))}</div>
                 </div>
-
+            
                 ${isGroupedItem ? `
                 <div class="detail-group">
                     <div class="detail-label">Verfügbar:</div>
-                    <div class="detail-value">${availableGroupedCount}</div>
+                    <div class="detail-value">${escapeHtml(String(availableGroupedCount))}</div>
                 </div>` : ''}
-                
+
                 <div class="detail-group">
                     <div class="detail-label">Anschaffungsjahr:</div>
-                    <div class="detail-value">${item.Anschaffungsjahr || '-'}</div>
-                </div>
-                
-                <div class="detail-group">
-                    <div class="detail-label">Anschaffungskosten:</div>
-                    <div class="detail-value">${item.Anschaffungskosten ? item.Anschaffungskosten + ' €' : '-'}</div>
-                </div>
-                
-                <div class="detail-group full-width">
-                    <div class="detail-label">Beschreibung:</div>
-                    <div class="detail-value">${item.Beschreibung || '-'}</div>
+                    <div class="detail-value">${escapeHtml(String(item.Anschaffungsjahr || '-'))}</div>
                 </div>
 
+                <div class="detail-group">
+                    <div class="detail-label">Anschaffungskosten:</div>
+                    <div class="detail-value">${item.Anschaffungskosten ? escapeHtml(String(item.Anschaffungskosten)) + ' €' : '-'}</div>
+                </div>
+
+                <div class="detail-group full-width">
+                    <div class="detail-label">Beschreibung:</div>
+                    <div class="detail-value">${escapeHtml(item.Beschreibung || '-')}</div>
+                </div>
+            
+                {% if current_permissions.actions.get('can_view_logs', False) %}
                 <div class="detail-group full-width" style="margin-top:12px;">
                     <div class="detail-label" style="font-weight:600; color:#374151;">Beschädigungs-Historie</div>
                     <div class="detail-value">
@@ -4590,7 +4609,8 @@ document.addEventListener('DOMContentLoaded', ()=>{
                         </div>
                     </div>
                 </div>
-
+                {% endif %}
+            
                 <div class="detail-group full-width" style="margin-top:12px; padding:10px; border:1px solid #e3e3e3; border-radius:8px;">
                     <div class="detail-label">Verfügbarkeit prüfen:</div>
                     <div class="detail-value">
@@ -4611,7 +4631,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
                     </div>
                 </div>
             </div>
-
+        
             <div class="detail-group full-width" style="margin-top:15px;">
                 <div class="detail-label">Geplante Ausleihen:</div>
                 <div class="detail-value">
@@ -4635,9 +4655,10 @@ document.addEventListener('DOMContentLoaded', ()=>{
                     </div>
                 </div>
             </div>
-            
+
             <div class="modal-actions">
                 ${!isBorrowed ? 
+                    {% if current_permissions.actions.get('can_borrow', False) %}
                     `<form method="POST" action="/ausleihen/${item._id}">
                         ${isGroupedItem ? `
                         <div style="display:flex; gap:8px; flex-wrap:wrap; margin-bottom:8px; align-items:center;">
@@ -4651,6 +4672,9 @@ document.addEventListener('DOMContentLoaded', ()=>{
                         </div>` : ''}
                         <button class="ausleihen" type="submit">Ausleihen</button>
                     </form>` 
+                    {% else %}
+                    `<button class="ausleihen disabled-button" disabled title="Keine Berechtigung">Ausleihen nicht möglich</button>`
+                    {% endif %}
                     : (!isGroupedItem && item.User === currentUsername) ?
                     `<form method="POST" action="/zurueckgeben/${item._id}">
                         <button class="ausleihen" type="submit">Zurückgeben</button>
@@ -4659,7 +4683,7 @@ document.addEventListener('DOMContentLoaded', ()=>{
                 }
                 <button class="edit-button" onclick="openEditModalForSelectedUnit('${item._id}', 'specific-item-modal-${item._id}')">Bearbeiten</button>
                 <button class="duplicate-button" onclick="duplicateItem('${item._id}')">Duplizieren</button>
-                ${damageReports.length > 0 ? `<button class="damage-button" onclick="markDamageAsRepaired('${item._id}')">Repariert</button>` : `<button class="damage-button" onclick="registerDamage('${item._id}')">Schaden melden</button>`}
+                ${damageReports && damageReports.length > 0 ? `<button class="damage-button" onclick="markDamageAsRepaired('${item._id}')">Repariert</button>` : `<button class="damage-button" onclick="registerDamage('${item._id}')">Schaden melden</button>`}
                 ${canScheduleItem ? `<button class="schedule-button" onclick="openScheduleModal('${item._id}')">Reservieren</button>` : ''}
                 <form method="POST" action="/delete_item/${item._id}" style="display:inline;" onsubmit="return confirm('Sind Sie sicher?')">
                     <button class="delete-button" type="submit">Löschen</button>

Web/templates/register.html

@@ -1,11 +1,3 @@
-<!--
-   Copyright 2025-2026 AIIrondev
-
-   Licensed under the Inventarsystem EULA (Endbenutzer-Lizenzvertrag).
-   See Legal/LICENSE for the full license text.
-   Unauthorized commercial use, SaaS hosting, or removal of branding is prohibited.
-   For commercial licensing inquiries: https://github.com/AIIrondev
--->
 {% extends "base.html" %}
 
 {% block title %}Register{% endblock %}
@@ -33,6 +25,7 @@
     <div class="content">
         <div class="form-card">
             <form method="POST" action="{{ url_for('register') }}">
+
                 <div class="form-group">
                     <label for="name">Vorname</label>
                     <div class="input-container">
@@ -44,7 +37,7 @@
                         <span class="input-icon">👤</span>
                         <input type="text" id="last-name" name="last-name" placeholder="Geben Sie den Nachnamen ein" required onchange="generateUsername()" oninput="generateUsername()">
                     </div>
-                    <label for="username">Benutzername <span style="color: #9ca3af;">(wird automatisch generiert)</span></label>
+                    <label for="username">Benutzername <span style="color: #9ca3af;">(Vorschau - wird serverseitig finalisiert)</span></label>
                     <div class="input-container">
                         <span class="input-icon">👤</span>
                         <input type="text" id="username" name="username" placeholder="Automatisch aus Name und Nachname" readonly style="background-color: #f3f4f6; cursor: not-allowed;">
@@ -64,9 +57,21 @@
                             <li id="pw-rule-symbol" class="pw-rule">Mindestens ein Sonderzeichen</li>
                         </ul>
                     </div>
-                    <div class="input-container">
-                        <span class="input-icon">🔒</span>
-                        <input type="password" id="password" name="password" placeholder="Geben Sie ein sicheres Passwort ein" required>
+                    
+                    <div class="input-wrapper">
+                        <div class="input-container">
+                            <span class="input-icon">🔒</span>
+                            <!-- HTML5 Pattern blockiert unsichere Passwörter vor dem Absenden -->
+                            <input 
+                                   id="password" 
+                                   name="password" 
+                                   placeholder="Geben Sie ein sicheres Passwort ein" 
+                                   required
+                                   pattern="(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[^a-zA-Z0-9]).{12,}">
+                        </div>
+                    </div>
+                    <div class="pw-actions">
+                        <button type="button" class="btn-secondary" onclick="generateSecurePassword()">Passwort generieren</button>
                     </div>
                 </div>
 
@@ -258,31 +263,6 @@ input::placeholder {
     background-color: #27ae60;
 }
 
-.navigation-buttons {
-    text-align: center;
-    margin: 1.5rem 0;
-}
-
-.back-button {
-    display: inline-flex;
-    align-items: center;
-    color: var(--primary-color);
-    text-decoration: none;
-    font-weight: 500;
-    transition: var(--transition);
-    padding: 0.5rem 1rem;
-    border-radius: var(--border-radius);
-}
-
-.back-button:hover {
-    background-color: rgba(52, 152, 219, 0.1);
-}
-
-.back-icon {
-    margin-right: 0.5rem;
-    font-size: 1.2rem;
-}
-
 .flash-container {
     margin-bottom: 1.5rem;
 }
@@ -422,49 +402,147 @@ input::placeholder {
     margin: 4px 0;
     color: #1f2937;
 }
+
+/* Neue Styles für die Passwort-Erweiterungen */
+.pw-actions {
+    display: flex;
+    gap: 8px;
+    margin-top: 8px;
+}
+
+.btn-secondary {
+    padding: 8px 12px;
+    border: 1px solid #d1d5db;
+    background-color: #f3f4f6;
+    border-radius: 4px;
+    cursor: pointer;
+    font-size: 0.9em;
+    transition: background-color 0.2s;
+}
+
+.btn-secondary:hover {
+    background-color: #e5e7eb;
+}
+
+.input-wrapper {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    width: 100%;
+}
+
+.input-wrapper .input-container {
+    flex-grow: 1;
+    margin: 0;
+}
 </style>
 
 <script>
-// Function to generate username from first and last name (helper function)
+// Hilfsfunktion: Umlaute auflösen und Sonderzeichen entfernen
 function cleanNameForUsername(text) {
     if (!text) return '';
-    // Remove special characters, convert umlauts, lowercase
-    let cleaned = text
-        .replace(/[^a-zA-Zäöüß\s-]/g, '')
-        .trim()
-        .toLowerCase();
-    
-    // Convert German umlauts to ASCII
-    cleaned = cleaned
+    let cleaned = text.trim().toLowerCase()
         .replace(/ä/g, 'ae')
         .replace(/ö/g, 'oe')
         .replace(/ü/g, 'ue')
-        .replace(/ß/g, 'ss');
-    
+        .replace(/ß/g, 'ss')
+        .replace(/[^a-z]/g, '');
     return cleaned;
 }
 
-// Generate username from name and last_name fields
+// Hilfsfunktion: Erster Buchstabe groß
+function formatPart(str, len) {
+    if (!str) return '';
+    const part = str.slice(0, len);
+    return part.charAt(0).toUpperCase() + part.slice(1);
+}
+
+// Generiert die Vorschau des Benutzernamens (z.B. SimFri)
 function generateUsername() {
-    const firstName = cleanNameForUsername(document.getElementById('name').value || '');
-    const lastName = cleanNameForUsername(document.getElementById('last-name').value || '');
+    const firstName = cleanNameForUsername(document.getElementById('name').value);
+    const lastName = cleanNameForUsername(document.getElementById('last-name').value);
     let username = '';
     
     if (firstName && lastName) {
-        username = (firstName.slice(0, 3) + lastName.slice(0, 3));
+        username = formatPart(firstName, 3) + formatPart(lastName, 3);
     } else if (firstName) {
-        username = firstName.slice(0, 6);
+        username = formatPart(firstName, 6);
     } else if (lastName) {
-        username = lastName.slice(0, 6);
+        username = formatPart(lastName, 6);
     }
     
-    // Set the username field
     const usernameField = document.getElementById('username');
     if (usernameField) {
         usernameField.value = username || '';
     }
 }
 
+// PASSWORT GENERATOR
+function generateSecurePassword() {
+    const length = 16;
+    const charsetLower = "abcdefghijklmnopqrstuvwxyz";
+    const charsetUpper = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+    const charsetNum = "0123456789";
+    const charsetSym = "!@#$%^&*()_+~|}{[]:;?><,.-=";
+
+    let password = "";
+    // Garantiert mindestens 1 Zeichen aus jeder Kategorie
+    password += charsetLower[Math.floor(Math.random() * charsetLower.length)];
+    password += charsetUpper[Math.floor(Math.random() * charsetUpper.length)];
+    password += charsetNum[Math.floor(Math.random() * charsetNum.length)];
+    password += charsetSym[Math.floor(Math.random() * charsetSym.length)];
+
+    const allChars = charsetLower + charsetUpper + charsetNum + charsetSym;
+    // Restliche Zeichen auffüllen
+    for (let i = 4; i < length; i++) {
+        password += allChars[Math.floor(Math.random() * allChars.length)];
+    }
+
+    // Passwort durchmischen
+    password = password.split('').sort(() => 0.5 - Math.random()).join('');
+
+    const pwField = document.getElementById('password');
+    pwField.value = password;
+    
+    // Automatisch sichtbar machen, damit der User es kopieren kann
+    pwField.type = 'text';
+    document.getElementById('toggle-pw-btn').textContent = '🙈';
+    
+    updatePasswordRules();
+}
+
+// PASSWORT SICHTBARKEIT UMSCHALTEN
+function togglePasswordVisibility() {
+    const pwField = document.getElementById('password');
+    const toggleBtn = document.getElementById('toggle-pw-btn');
+    if (pwField.type === "password") {
+        pwField.type = "text";
+        toggleBtn.textContent = '🙈';
+    } else {
+        pwField.type = "password";
+        toggleBtn.textContent = '👁️';
+    }
+}
+
+// Globale Funktion für Passwort-Update
+function updatePasswordRules() {
+    const passwordInput = document.getElementById('password');
+    if (!passwordInput) return;
+
+    const value = String(passwordInput.value || '');
+    
+    const setRuleState = (id, ok) => {
+        const node = document.getElementById(id);
+        if (node) node.classList.toggle('ok', !!ok);
+    };
+
+    setRuleState('pw-rule-length', value.length >= 12);
+    setRuleState('pw-rule-lower', /[a-z]/.test(value));
+    setRuleState('pw-rule-upper', /[A-Z]/.test(value));
+    setRuleState('pw-rule-digit', /[0-9]/.test(value));
+    setRuleState('pw-rule-symbol', /[^A-Za-z0-9]/.test(value));
+}
+
 document.addEventListener('DOMContentLoaded', function () {
     const permissionPresets = {{ permission_presets | tojson }};
     const presetSelect = document.getElementById('permission-preset');
@@ -507,34 +585,6 @@ document.addEventListener('DOMContentLoaded', function () {
     }
 
     const passwordInput = document.getElementById('password');
-    const passwordRules = {
-        length: document.getElementById('pw-rule-length'),
-        lower: document.getElementById('pw-rule-lower'),
-        upper: document.getElementById('pw-rule-upper'),
-        digit: document.getElementById('pw-rule-digit'),
-        symbol: document.getElementById('pw-rule-symbol')
-    };
-
-    function setRuleState(node, ok) {
-        if (!node) {
-            return;
-        }
-        node.classList.toggle('ok', !!ok);
-    }
-
-    function updatePasswordRules() {
-        if (!passwordInput) {
-            return;
-        }
-
-        const value = String(passwordInput.value || '');
-        setRuleState(passwordRules.length, value.length >= 12);
-        setRuleState(passwordRules.lower, /[a-z]/.test(value));
-        setRuleState(passwordRules.upper, /[A-Z]/.test(value));
-        setRuleState(passwordRules.digit, /[0-9]/.test(value));
-        setRuleState(passwordRules.symbol, /[^A-Za-z0-9]/.test(value));
-    }
-
     if (passwordInput) {
         passwordInput.addEventListener('input', updatePasswordRules);
         passwordInput.addEventListener('blur', updatePasswordRules);

config.json

@@ -20,14 +20,14 @@
         "key": "Web/certs/key.pem"
     },
     "email": {
-        "enabled": false,
-        "smtp_host": "smtp.gmail.com",
+        "enabled": true,
+        "smtp_host": "",
         "smtp_port": 587,
         "use_tls": true,
         "username": "",
         "password": "",
         "from_address": "",
-        "default_sender_name": "Invario Inventarprogramm",
+        "default_sender_name": "Invario Email Service",
         "timeout_seconds": 30
     },
     "images": {

requirements.txt

@@ -1,4 +1,5 @@
 flask
+flask-wtf
 werkzeug
 gunicorn
 pymongo==4.6.3

restart.sh

@@ -1,6 +1,9 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+sudo find /tmp -maxdepth 1 -name "tmp.*" -exec rm -rf {} +
+echo "Cleaning up old temporary files in /tmp..."
+
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
 cd "$SCRIPT_DIR"