Enhance security and logging in application settings and templates; update impressum legal references

Fix email link in impressum section
Remove notifications link and update impressum contact information
2026-04-17 16:54:53 +02:00 · 2026-04-13 21:58:14 +02:00 · 2026-04-13 21:44:06 +02:00 · 2026-04-13 21:30:24 +02:00 · 2026-04-13 21:27:12 +02:00 · 2026-04-13 21:19:32 +02:00
7 changed files with 457 additions and 121 deletions
@@ -27,6 +27,7 @@ Features:

 from flask import Flask, render_template, request, redirect, url_for, session, flash, send_from_directory, get_flashed_messages, jsonify, Response, make_response, send_file
 from werkzeug.utils import secure_filename
+from werkzeug.middleware.proxy_fix import ProxyFix
 import user as us
 import items as it
 import ausleihung as au
@@ -44,6 +45,7 @@ import traceback
 import re
 import io
 import html
+import logging
 # QR Code functionality deactivated
 # import qrcode
 # from qrcode.constants import ERROR_CORRECT_L
@@ -62,13 +64,34 @@ from settings import MongoClient


 app = Flask(__name__, static_folder='static')  # Correctly set static folder
+app.logger.setLevel(logging.WARNING)
 app.secret_key = cfg.SECRET_KEY
 app.debug = cfg.DEBUG
 app.config['UPLOAD_FOLDER'] = cfg.UPLOAD_FOLDER
 app.config['THUMBNAIL_FOLDER'] = cfg.THUMBNAIL_FOLDER
 app.config['PREVIEW_FOLDER'] = cfg.PREVIEW_FOLDER
 app.config['ALLOWED_EXTENSIONS'] = set(cfg.ALLOWED_EXTENSIONS)
+app.config['MAX_CONTENT_LENGTH'] = max(cfg.MAX_UPLOAD_MB, cfg.IMAGE_MAX_UPLOAD_MB, cfg.VIDEO_MAX_UPLOAD_MB) * 1024 * 1024
+app.config['SESSION_COOKIE_HTTPONLY'] = True
+app.config['SESSION_COOKIE_SAMESITE'] = 'Lax'
+app.config['SESSION_COOKIE_SECURE'] = cfg.SSL_ENABLED if os.getenv('INVENTAR_SESSION_COOKIE_SECURE') is None else os.getenv('INVENTAR_SESSION_COOKIE_SECURE', '').strip().lower() in ('1', 'true', 'yes', 'on')
+app.config['PREFERRED_URL_SCHEME'] = 'https' if app.config['SESSION_COOKIE_SECURE'] else 'http'
 # app.config['QR_CODE_FOLDER'] = cfg.QR_CODE_FOLDER  # QR Code storage deactivated
+app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1, x_host=1, x_port=1)
+
+
+def print(*args, **kwargs):
+    if not args:
+        return None
+
+    message = " ".join(str(arg) for arg in args)
+    stripped = message.lstrip()
+    if stripped.startswith(('Error', 'Fehler', 'Warning', 'Warnung', '[WARN]', '[KONFLIKT]', 'Failed', 'Fehl')):
+        app.logger.warning(message)
+    elif stripped.startswith(('Exception', 'Traceback')):
+        app.logger.error(message)
+    else:
+        app.logger.info(message)

 # Thumbnail sizes
 THUMBNAIL_SIZE = cfg.THUMBNAIL_SIZE
@@ -96,6 +119,16 @@ APP_VERSION = __version__
 RELEASE_STATE_FILE = os.path.join(os.path.dirname(BASE_DIR), '.release-version')


+@app.after_request
+def _set_security_headers(response):
+    response.headers.setdefault('X-Content-Type-Options', 'nosniff')
+    response.headers.setdefault('X-Frame-Options', 'SAMEORIGIN')
+    response.headers.setdefault('Referrer-Policy', 'strict-origin-when-cross-origin')
+    if cfg.SSL_ENABLED:
+        response.headers.setdefault('Strict-Transport-Security', 'max-age=31536000; includeSubDomains')
+    return response
+
+
 def _get_asset_version():
    """Return a cache-busting asset version tied to deployment state."""
    env_version = os.getenv('INVENTAR_ASSET_VERSION', '').strip()
@@ -653,14 +686,11 @@ def create_daily_backup():
    Erstellt täglich ein Backup der Ausleihungsdatenbank
    """
    try:
-        print(f"[{datetime.datetime.now()}] Erstelle Backup der Ausleihungsdatenbank...")
        result = au.create_backup_database()
-        if result:
-            print(f"[{datetime.datetime.now()}] Backup erfolgreich erstellt")
-        else:
-            print(f"[{datetime.datetime.now()}] Fehler beim Erstellen des Backups")
+        if not result:
+            app.logger.warning("Daily backup creation returned false")
    except Exception as e:
-        print(f"[{datetime.datetime.now()}] Ausnahme beim Erstellen des Backups: {str(e)}")
+        app.logger.error(f"Daily backup creation failed: {e}")

 def update_appointment_statuses():
    """
@@ -670,17 +700,8 @@ def update_appointment_statuses():
    - Aktive Termine, die beendet werden sollten
    """
    current_time = datetime.datetime.now()
-    # Prepare logging early so it's available in exception paths
-    log_dir = os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), 'logs')
-    os.makedirs(log_dir, exist_ok=True)
-    log_file = os.path.join(log_dir, 'scheduler.log')

    try:
-        with open(log_file, 'a', encoding='utf-8') as f:
-            f.write(f"[{current_time}] Starte automatische Statusaktualisierung...\n")
-
-        print(f"[{current_time}] Starte automatische Statusaktualisierung...")
-
        # Hole alle Termine mit Status 'planned' oder 'active'
        client = MongoClient(MONGODB_HOST, MONGODB_PORT)
        db = client[MONGODB_DB]
@@ -742,16 +763,15 @@ def update_appointment_statuses():
                                        f"  [KONFLIKT] Termin {appointment['_id']}: "
                                        f"planned → active, aber {conflict_note}"
                                    )
-                                    print(conflict_log)
-                                    with open(log_file, 'a', encoding='utf-8') as f:
-                                        f.write(f"[{current_time}] {conflict_log}\n")
+                                    app.logger.warning(conflict_log)
                                else:
                                    # No conflict — clear any previously stored conflict flag
                                    extra_fields['ConflictDetected'] = False
                                    extra_fields['ConflictNote'] = ''
                        except Exception as conflict_err:
-                            print(f"  [WARN] Konfliktprüfung fehlgeschlagen für Termin "
-                                  f"{appointment['_id']}: {conflict_err}")
+                            app.logger.warning(
+                                f"Conflict check failed for appointment {appointment['_id']}: {conflict_err}"
+                            )

                result = ausleihungen.update_one(
                    {'_id': appointment['_id']},
@@ -769,37 +789,15 @@ def update_appointment_statuses():
                    elif new_status == 'completed':
                        completed_count += 1

-                    log_msg = f"  - Termin {appointment['_id']}: {old_status} → {new_status}"
-                    print(log_msg)
-                    with open(log_file, 'a', encoding='utf-8') as f:
-                        f.write(f"[{current_time}] {log_msg}\n")
-
        client.close()

        if updated_count > 0:
-            result_msg = f"Statusaktualisierung abgeschlossen: {updated_count} Termine aktualisiert"
-            detail_msg = f"  - {activated_count} aktiviert, {completed_count} abgeschlossen"
-            print(f"[{current_time}] {result_msg}")
-            print(f"[{current_time}] {detail_msg}")
-            with open(log_file, 'a', encoding='utf-8') as f:
-                f.write(f"[{current_time}] {result_msg}\n")
-                f.write(f"[{current_time}] {detail_msg}\n")
-        else:
-            result_msg = "Statusaktualisierung abgeschlossen: Keine Änderungen erforderlich"
-            print(f"[{current_time}] {result_msg}")
-            with open(log_file, 'a', encoding='utf-8') as f:
-                f.write(f"[{current_time}] {result_msg}\n")
+            app.logger.warning(
+                f"Appointment status update finished: {updated_count} changed ({activated_count} active, {completed_count} completed)"
+            )

    except Exception as e:
-        error_msg = f"Fehler bei der automatischen Statusaktualisierung: {str(e)}"
-        print(f"[{datetime.datetime.now()}] {error_msg}")
-        try:
-            with open(log_file, 'a', encoding='utf-8') as f:
-                f.write(f"[{datetime.datetime.now()}] {error_msg}\n")
-        except Exception:
-            pass
-        import traceback
-        traceback.print_exc()
+        app.logger.error(f"Automatic appointment status update failed: {e}")

 # Schedule jobs
 scheduler = BackgroundScheduler()
@@ -1484,7 +1482,7 @@ def uploaded_file(filename):
        # Default placeholder from static folder
        return send_from_directory(app.static_folder, 'favicon.ico')
    except Exception as e:
-        print(f"Error serving file {filename}: {str(e)}")
+        app.logger.error(f"Error serving file {filename}: {str(e)}")
        return Response("Image not found", status=404)


@@ -1519,7 +1517,7 @@ def thumbnail_file(filename):
        else:
            return send_from_directory(app.static_folder, 'favicon.ico')
    except Exception as e:
-        print(f"Error serving thumbnail {filename}: {str(e)}")
+        app.logger.error(f"Error serving thumbnail {filename}: {str(e)}")
        return Response("Thumbnail not found", status=404)


@@ -1554,7 +1552,7 @@ def preview_file(filename):
        else:
            return send_from_directory(app.static_folder, 'favicon.ico')
    except Exception as e:
-        print(f"Error serving preview {filename}: {str(e)}")
+        app.logger.error(f"Error serving preview {filename}: {str(e)}")
        return Response("Preview not found", status=404)


@@ -2017,7 +2015,7 @@ def api_library_items():
            'has_more': (offset + count) < total_count
        }), 200
    except Exception as e:
-        print(f"Error fetching library items: {e}")
+        app.logger.error(f"Error fetching library items: {e}")
        return jsonify({'error': str(e)}), 500


@@ -2227,7 +2225,7 @@ def api_item_detail(item_id):
        """
        return detail_html, 200
    except Exception as e:
-        print(f"Error fetching item detail: {e}")
+        app.logger.error(f"Error fetching item detail: {e}")
        return jsonify({'error': str(e)}), 500


@@ -2330,11 +2328,6 @@ def upload_admin():
        try:
            original_item = it.get_item(duplicate_from)
            if original_item:
-                # Enhanced debug logging for images
-                images = original_item.get('Images', [])
-                print(f"DEBUG: Original item: {original_item.get('_id')} has these images: {images}")
-                print(f"DEBUG: Images type: {type(images)}, count: {len(images) if isinstance(images, list) else 'not a list'}")
-                
                duplicate_data = {
                    'name': original_item.get('Name', ''),
                    'description': original_item.get('Beschreibung', ''),
@@ -2360,7 +2353,7 @@ def upload_admin():
            else:
                flash('Ursprungs-Element für Duplizierung nicht gefunden.', 'error')
        except Exception as e:
-            print(f"Error loading item for duplication: {e}")
+            app.logger.warning(f"Error loading item for duplication: {e}")
            flash('Fehler beim Laden der Duplizierungsdaten.', 'error')
    
    # Handle the new method (sessionStorage-based duplication)
@@ -2429,7 +2422,7 @@ def library_admin():
            else:
                flash('Ursprungs-Element für Duplizierung nicht gefunden.', 'error')
        except Exception as e:
-            print(f"Error loading item for duplication: {e}")
+            app.logger.warning(f"Error loading item for duplication: {e}")
            flash('Fehler beim Laden der Duplizierungsdaten.', 'error')
    elif duplicate_flag == 'true':
        flash('Buch wird dupliziert. Die Daten werden aus dem Session-Speicher geladen.', 'info')
@@ -2486,7 +2479,7 @@ def student_cards_admin():
                    'notes': card.get('Notizen', '')
                }
        except Exception as e:
-            print(f"Error loading student card for edit: {e}")
+            app.logger.error(f"Error loading student card for edit: {e}")
            flash('Fehler beim Laden des Ausweises.', 'error')

    # Handle POST request (add or edit)
@@ -2504,7 +2497,7 @@ def student_cards_admin():
                student_cards.delete_one({'_id': ObjectId(card_id)})
                flash('Ausweis wurde gelöscht.', 'success')
            except Exception as e:
-                print(f"Error deleting student card: {e}")
+                app.logger.error(f"Error deleting student card: {e}")
                flash('Fehler beim Löschen des Ausweises.', 'error')

        elif action == 'edit':
@@ -2532,7 +2525,7 @@ def student_cards_admin():
                        flash('Ausweis wurde aktualisiert.', 'success')
                        return redirect(url_for('student_cards_admin'))
                except Exception as e:
-                    print(f"Error updating student card: {e}")
+                    app.logger.error(f"Error updating student card: {e}")
                    flash('Fehler beim Aktualisieren des Ausweises.', 'error')

        elif action == 'add':
@@ -2556,7 +2549,7 @@ def student_cards_admin():
                        flash('Neuer Ausweis wurde hinzugefügt.', 'success')
                        return redirect(url_for('student_cards_admin'))
                    except Exception as e:
-                        print(f"Error adding student card: {e}")
+                        app.logger.error(f"Error adding student card: {e}")
                        flash('Fehler beim Hinzufügen des Ausweises.', 'error')

    # Get all student cards
@@ -5196,7 +5189,7 @@ def ausleihen(id):
                    flash('Alle Exemplare sind aufgrund geplanter Reservierungen heute belegt.', 'error')
                    return redirect(url_for(redirect_target))
    except Exception as e:
-        print(f"Warning: could not enforce planned booking guard: {e}")
+        app.logger.warning(f"Could not enforce planned booking guard: {e}")

    # Get number of exemplars to borrow (default to 1)
    exemplare_count = request.form.get('exemplare_count', 1)
@@ -5317,10 +5310,7 @@ def zurueckgeben(id):
        
    username = session['username']
    
-    print("Code 1169: zurueckgeben called with item ID:", id)
-
    if not item.get('Verfuegbar', True) and (us.check_admin(session['username']) or item.get('User') == username):
-        print("Code 1172: Item is not available, proceeding with return")
        try:
            # Get ALL active borrowing records for this item and complete them
            client = MongoClient(MONGODB_HOST, MONGODB_PORT)
@@ -5339,8 +5329,6 @@ def zurueckgeben(id):
            updated_count = 0
            for record in active_records:
                ausleihung_id = str(record['_id'])
-                print(f"Completing active ausleihung {ausleihung_id} for item {id}")
-                
                # Update each active record
                result = ausleihungen.update_one(
                    {'_id': ObjectId(ausleihung_id)},
@@ -12,6 +12,8 @@ defaults for the web application and helper modules.
 """
 import os
 import json
+import atexit
+from threading import Lock
 from pymongo import MongoClient as _PyMongoClient

 # Base directory of this Web package
@@ -99,10 +101,27 @@ def _get(conf, path, default):
            return default
    return cur

+
+def _get_bool_env(name, default):
+    value = os.getenv(name)
+    if value is None:
+        return default
+    return value.strip().lower() in ('1', 'true', 'yes', 'on')
+
+
+def _get_int_env(name, default):
+    value = os.getenv(name)
+    if value is None or not value.strip():
+        return int(default)
+    try:
+        return int(value)
+    except ValueError:
+        return int(default)
+
 # Expose settings
 APP_VERSION = _get(_conf, ['ver'], DEFAULTS['version'])
-DEBUG = _get(_conf, ['dbg'], DEFAULTS['debug'])
-SECRET_KEY = str(_get(_conf, ['key'], DEFAULTS['secret_key']))
+DEBUG = _get_bool_env('INVENTAR_DEBUG', _get(_conf, ['dbg'], DEFAULTS['debug']))
+SECRET_KEY = str(os.getenv('INVENTAR_SECRET_KEY', _get(_conf, ['key'], DEFAULTS['secret_key'])))
 HOST = _get(_conf, ['host'], DEFAULTS['host'])
 PORT = _get(_conf, ['port'], DEFAULTS['port'])

@@ -115,6 +134,13 @@ MONGODB_DB = _get(_conf, ['mongodb', 'db'], DEFAULTS['mongodb']['db'])
 MONGODB_HOST = os.getenv('INVENTAR_MONGODB_HOST', MONGODB_HOST)
 MONGODB_PORT = int(os.getenv('INVENTAR_MONGODB_PORT', str(MONGODB_PORT)))
 MONGODB_DB = os.getenv('INVENTAR_MONGODB_DB', MONGODB_DB)
+MONGODB_MAX_POOL_SIZE = _get_int_env('INVENTAR_MONGODB_MAX_POOL_SIZE', 20)
+MONGODB_MIN_POOL_SIZE = _get_int_env('INVENTAR_MONGODB_MIN_POOL_SIZE', 0)
+MONGODB_MAX_IDLE_TIME_MS = _get_int_env('INVENTAR_MONGODB_MAX_IDLE_TIME_MS', 300000)
+MONGODB_CONNECT_TIMEOUT_MS = _get_int_env('INVENTAR_MONGODB_CONNECT_TIMEOUT_MS', 5000)
+MONGODB_SERVER_SELECTION_TIMEOUT_MS = _get_int_env('INVENTAR_MONGODB_SERVER_SELECTION_TIMEOUT_MS', 5000)
+MONGODB_SOCKET_TIMEOUT_MS = _get_int_env('INVENTAR_MONGODB_SOCKET_TIMEOUT_MS', 30000)
+MONGODB_MAX_CONNECTING = _get_int_env('INVENTAR_MONGODB_MAX_CONNECTING', 2)

 # Scheduler
 SCHEDULER_INTERVAL_MIN = _get(_conf, ['scheduler', 'interval_minutes'], DEFAULTS['scheduler']['interval_minutes'])
@@ -176,19 +202,81 @@ if not os.path.isabs(LOGS_FOLDER):
    LOGS_FOLDER = os.path.join(PROJECT_ROOT, LOGS_FOLDER)


+_MONGO_CLIENT_CACHE = {}
+_MONGO_CLIENT_LOCK = Lock()
+
+
+class _MongoClientProxy:
+    def __init__(self, client):
+        self._client = client
+
+    def __getattr__(self, name):
+        return getattr(self._client, name)
+
+    def __getitem__(self, name):
+        return self._client[name]
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, exc_type, exc, tb):
+        return False
+
+    def close(self):
+        return None
+
+
+def _close_cached_mongo_clients():
+    with _MONGO_CLIENT_LOCK:
+        clients = list(_MONGO_CLIENT_CACHE.values())
+        _MONGO_CLIENT_CACHE.clear()
+
+    for proxy in clients:
+        try:
+            proxy._client.close()
+        except Exception:
+            pass
+
+
+atexit.register(_close_cached_mongo_clients)
+
+
 def MongoClient(*args, **kwargs):
-    """Return a lightweight MongoDB client configured from this settings module."""
+    """Return a process-local MongoDB client configured from this settings module."""
+    explicit_host = 'host' in kwargs
+    explicit_port = 'port' in kwargs
+    host = args[0] if len(args) >= 1 else kwargs.pop('host', MONGODB_HOST)
+    port = args[1] if len(args) >= 2 else kwargs.pop('port', MONGODB_PORT)
    client_kwargs = {
-        'maxPoolSize': 10,
-        'minPoolSize': 0,
-        'connectTimeoutMS': 5000,
-        'serverSelectionTimeoutMS': 5000,
+        'maxPoolSize': MONGODB_MAX_POOL_SIZE,
+        'minPoolSize': MONGODB_MIN_POOL_SIZE,
+        'maxIdleTimeMS': MONGODB_MAX_IDLE_TIME_MS,
+        'connectTimeoutMS': MONGODB_CONNECT_TIMEOUT_MS,
+        'serverSelectionTimeoutMS': MONGODB_SERVER_SELECTION_TIMEOUT_MS,
+        'socketTimeoutMS': MONGODB_SOCKET_TIMEOUT_MS,
+        'maxConnecting': MONGODB_MAX_CONNECTING,
        'retryWrites': True,
+        'retryReads': True,
    }
    client_kwargs.update(kwargs)

-    # Preserve caller-provided positional host/port arguments.
-    # If none are passed, use configured defaults.
-    if args:
-        return _PyMongoClient(*args, **client_kwargs)
-    return _PyMongoClient(MONGODB_HOST, MONGODB_PORT, **client_kwargs)
+    if len(args) >= 2 and not explicit_host and not explicit_port:
+        mongo_args = args
+    else:
+        mongo_args = (host, port)
+
+    cache_key = (
+        mongo_args,
+        tuple(sorted((key, repr(value)) for key, value in client_kwargs.items())),
+    )
+
+    with _MONGO_CLIENT_LOCK:
+        cached_client = _MONGO_CLIENT_CACHE.get(cache_key)
+        if cached_client is not None:
+            return cached_client
+
+        client = _PyMongoClient(*mongo_args, **client_kwargs)
+
+        cached_client = _MongoClientProxy(client)
+        _MONGO_CLIENT_CACHE[cache_key] = cached_client
+        return cached_client
@@ -7,7 +7,7 @@
   For commercial licensing inquiries: https://github.com/AIIrondev
 -->
 <!DOCTYPE html>
-<html lang="en" data-module="{{ CURRENT_MODULE }}">
+<html lang="de" data-module="{{ CURRENT_MODULE }}">
 <head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=5.0, user-scalable=yes">
@@ -63,6 +63,9 @@
        .navbar {
            box-shadow: 0 4px 14px rgba(2, 6, 23, 0.24);
            background-color: var(--module-primary-color) !important;
+            position: sticky;
+            top: 0;
+            z-index: 1900;
        }
        
        .navbar-brand {
@@ -82,6 +85,65 @@
            border-radius: 8px;
        }

+        .navbar-nav .nav-link.nav-active {
+            background-color: rgba(255, 255, 255, 0.2);
+            box-shadow: inset 0 0 0 1px rgba(255, 255, 255, 0.35);
+        }
+
+        .function-search-wrap {
+            display: flex;
+            align-items: center;
+            margin-right: 10px;
+            width: min(420px, 42vw);
+        }
+
+        .function-search-form {
+            width: 100%;
+            display: flex;
+            gap: 6px;
+            align-items: center;
+        }
+
+        .function-search-input {
+            width: 100%;
+            min-height: 38px;
+            border-radius: 10px;
+            border: 1px solid rgba(255, 255, 255, 0.3);
+            background: rgba(255, 255, 255, 0.12);
+            color: #ffffff;
+            padding: 8px 12px;
+            outline: none;
+        }
+
+        .function-search-input::placeholder {
+            color: rgba(255, 255, 255, 0.78);
+        }
+
+        .function-search-input:focus {
+            border-color: #93c5fd;
+            box-shadow: 0 0 0 2px rgba(147, 197, 253, 0.35);
+            background: rgba(255, 255, 255, 0.18);
+        }
+
+        .function-search-btn {
+            min-height: 38px;
+            border-radius: 10px;
+            border: 1px solid rgba(255, 255, 255, 0.45);
+            background: rgba(255, 255, 255, 0.15);
+            color: #ffffff;
+            padding: 7px 12px;
+            font-weight: 700;
+        }
+
+        .function-search-btn:hover {
+            background: rgba(255, 255, 255, 0.26);
+        }
+
+        .quick-link-pill {
+            border: 1px solid rgba(255, 255, 255, 0.35);
+            background: rgba(255, 255, 255, 0.08);
+        }
+
        .navbar-nav .nav-link:hover,
        .navbar-nav .nav-link:focus {
            background-color: rgba(255, 255, 255, 0.12);
@@ -255,6 +317,27 @@
            .nav-item.dropdown .dropdown-toggle {
                padding: 8px 12px;
            }
+
+            .navbar-toggler {
+                padding: 0.5rem 0.65rem;
+                border-width: 2px;
+            }
+
+            .function-search-wrap {
+                width: 100%;
+                margin: 8px 0 10px;
+            }
+
+            .navbar-nav .nav-item {
+                margin-right: 0;
+                margin-bottom: 6px;
+            }
+
+            .navbar-nav .nav-link {
+                min-height: 44px;
+                display: flex;
+                align-items: center;
+            }
            
            /* Better touch targets for mobile */
            .dropdown-toggle::after {
@@ -363,6 +446,7 @@
    {% endblock %}
 </head>
 <body>
+    {% set current_path = request.path %}
    <!-- Module Selector Bar -->
    {% if 'username' in session %}
    <div class="module-selector-bar" id="moduleBar">
@@ -396,28 +480,28 @@
            <div class="collapse navbar-collapse" id="inventoryNavContent">
                <ul class="navbar-nav me-auto mb-2 mb-lg-0" id="inventoryNavList">
                    <li class="nav-item" data-nav-fixed="true">
-                        <a class="nav-link" href="{{ url_for('home') }}">Artikel</a>
+                        <a class="nav-link {% if current_path == url_for('home') %}nav-active{% endif %}" href="{{ url_for('home') }}">Artikel</a>
                    </li>
+                    {% if 'username' in session %}
+                    <li class="nav-item" data-nav-fixed="true">
+                        <a class="nav-link quick-link-pill {% if current_path == url_for('my_borrowed_items') %}nav-active{% endif %}" href="{{ url_for('my_borrowed_items') }}">Meine Ausleihen</a>
+                    </li>
+                    <li class="nav-item" data-nav-fixed="true">
+                        <a class="nav-link quick-link-pill {% if current_path == url_for('tutorial_page') %}nav-active{% endif %}" href="{{ url_for('tutorial_page') }}">Tutorial</a>
+                    </li>
+                    {% endif %}
                    {% if 'username' in session and (session.get('admin', False) or is_admin) %}
                    <li class="nav-item">
-                        <a class="nav-link nav-priority-link" href="{{ url_for('upload_admin') }}">➕ Hochladen</a>
+                        <a class="nav-link nav-priority-link {% if current_path == url_for('upload_admin') %}nav-active{% endif %}" href="{{ url_for('upload_admin') }}">➕ Hochladen</a>
                    </li>
                    {% endif %}
                    <li class="nav-item dropdown ms-lg-auto">
-                        <a class="nav-link dropdown-toggle" href="#" id="invMoreDropdown" role="button" data-bs-toggle="dropdown" aria-expanded="false">
-                            ⋯ Mehr
+                        <a class="nav-link dropdown-toggle" href="#" id="invMoreDropdown" role="button" data-bs-toggle="dropdown" aria-expanded="false" title="Weitere Optionen">
+                            Mehr Optionen
                        </a>
                        <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="invMoreDropdown">
                            {% if 'username' in session %}
                            <li><a class="dropdown-item" href="{{ url_for('my_borrowed_items') }}">Meine Ausleihen</a></li>
-                            <li>
-                                <a class="dropdown-item" href="{{ url_for('notifications_view') }}">
-                                    Benachrichtigungen
-                                    {% if unread_notification_count and unread_notification_count > 0 %}
-                                    <span class="notif-badge">{{ unread_notification_count }}</span>
-                                    {% endif %}
-                                </a>
-                            </li>
                            <li><a class="dropdown-item" href="{{ url_for('tutorial_page') }}">Tutorial</a></li>
                            <li><hr class="dropdown-divider"></li>
                            {% endif %}
@@ -443,6 +527,19 @@
                </ul>
                <div class="d-flex">
                    {% if 'username' in session %}
+                        <div class="function-search-wrap">
+                            <form class="function-search-form" data-function-search="true">
+                                <input
+                                    class="function-search-input"
+                                    type="search"
+                                    name="function_search"
+                                    placeholder="Funktion suchen..."
+                                    list="function-search-options"
+                                    autocomplete="off"
+                                >
+                                <button class="function-search-btn" type="submit">Los</button>
+                            </form>
+                        </div>
                        <span class="navbar-text text-light me-3">{{ session['username'] }}</span>
                        <div class="dropdown me-2 user-menu-wrap">
                            <button class="btn btn-secondary dropdown-toggle user-menu-btn" type="button" id="invUserMenuDropdown" data-bs-toggle="dropdown" aria-expanded="false" data-notification-button="true">
@@ -474,28 +571,28 @@
            <div class="collapse navbar-collapse" id="libraryNavContent">
                <ul class="navbar-nav me-auto mb-2 mb-lg-0" id="libraryNavList">
                    <li class="nav-item" data-nav-fixed="true">
-                        <a class="nav-link" href="{{ url_for('library_view') }}">Medien</a>
+                        <a class="nav-link {% if current_path == url_for('library_view') %}nav-active{% endif %}" href="{{ url_for('library_view') }}">Medien</a>
                    </li>
+                    {% if 'username' in session %}
+                    <li class="nav-item" data-nav-fixed="true">
+                        <a class="nav-link quick-link-pill {% if current_path == url_for('my_borrowed_items') %}nav-active{% endif %}" href="{{ url_for('my_borrowed_items') }}">Meine Medien</a>
+                    </li>
+                    <li class="nav-item" data-nav-fixed="true">
+                        <a class="nav-link quick-link-pill {% if current_path == url_for('tutorial_page') %}nav-active{% endif %}" href="{{ url_for('tutorial_page') }}">Tutorial</a>
+                    </li>
+                    {% endif %}
                    {% if 'username' in session and (session.get('admin', False) or is_admin) %}
                    <li class="nav-item">
-                        <a class="nav-link nav-priority-link" href="{{ url_for('library_admin') }}">📖 Hochladen</a>
+                        <a class="nav-link nav-priority-link {% if current_path == url_for('library_admin') %}nav-active{% endif %}" href="{{ url_for('library_admin') }}">📖 Hochladen</a>
                    </li>
                    {% endif %}
                    <li class="nav-item dropdown ms-lg-auto">
-                        <a class="nav-link dropdown-toggle" href="#" id="libMoreDropdown" role="button" data-bs-toggle="dropdown" aria-expanded="false">
-                            ⋯ Mehr
+                        <a class="nav-link dropdown-toggle" href="#" id="libMoreDropdown" role="button" data-bs-toggle="dropdown" aria-expanded="false" title="Weitere Optionen">
+                            Mehr Optionen
                        </a>
                        <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="libMoreDropdown">
                            {% if 'username' in session %}
                            <li><a class="dropdown-item" href="{{ url_for('my_borrowed_items') }}">Meine Medien</a></li>
-                            <li>
-                                <a class="dropdown-item" href="{{ url_for('notifications_view') }}">
-                                    Benachrichtigungen
-                                    {% if unread_notification_count and unread_notification_count > 0 %}
-                                    <span class="notif-badge">{{ unread_notification_count }}</span>
-                                    {% endif %}
-                                </a>
-                            </li>
                            <li><a class="dropdown-item" href="{{ url_for('tutorial_page') }}">Tutorial</a></li>
                            <li><hr class="dropdown-divider"></li>
                            {% endif %}
@@ -520,6 +617,19 @@
                </ul>
                <div class="d-flex">
                    {% if 'username' in session %}
+                        <div class="function-search-wrap">
+                            <form class="function-search-form" data-function-search="true">
+                                <input
+                                    class="function-search-input"
+                                    type="search"
+                                    name="function_search"
+                                    placeholder="Funktion suchen..."
+                                    list="function-search-options"
+                                    autocomplete="off"
+                                >
+                                <button class="function-search-btn" type="submit">Los</button>
+                            </form>
+                        </div>
                        <span class="navbar-text text-light me-3">{{ session['username'] }}</span>
                        <div class="dropdown me-2 user-menu-wrap">
                            <button class="btn btn-secondary dropdown-toggle user-menu-btn" type="button" id="libUserMenuDropdown" data-bs-toggle="dropdown" aria-expanded="false" data-notification-button="true">
@@ -653,9 +763,9 @@
            width: 10px;
            height: 10px;
            border-radius: 50%;
-            background: #2563eb;
+            background: #dc2626;
            border: 2px solid #ffffff;
-            box-shadow: 0 0 0 1px rgba(37, 99, 235, 0.35);
+            box-shadow: 0 0 0 1px rgba(220, 38, 38, 0.35);
            display: none;
        }

@@ -720,6 +830,33 @@
        <span id="notification-toast-message"></span>
    </div>

+    <datalist id="function-search-options">
+        <option value="Artikel"></option>
+        <option value="Meine Ausleihen"></option>
+        <option value="Benachrichtigungen"></option>
+        <option value="Tutorial"></option>
+        <option value="Impressum"></option>
+        <option value="Lizenz"></option>
+        {% if library_module_enabled %}
+        <option value="Bibliothek"></option>
+        <option value="Meine Medien"></option>
+        {% endif %}
+        {% if 'username' in session and (session.get('admin', False) or is_admin) %}
+        <option value="Hochladen"></option>
+        <option value="Ausleihen Verwaltung"></option>
+        <option value="Defekte Items"></option>
+        <option value="Filter verwalten"></option>
+        <option value="Orte verwalten"></option>
+        <option value="Audit Dashboard"></option>
+        <option value="Logs"></option>
+        <option value="Benutzer verwalten"></option>
+        <option value="Neuer Benutzer"></option>
+        {% if student_cards_module_enabled %}
+        <option value="Bibliotheksausweis"></option>
+        {% endif %}
+        {% endif %}
+    </datalist>
+
    <script>
        (function(){
            function getCookie(name){
@@ -761,6 +898,126 @@
            const notificationToastTitle = document.getElementById('notification-toast-title');
            const notificationToastMessage = document.getElementById('notification-toast-message');
            let lastUnreadCount = Number({{ unread_notification_count|default(0)|int }});
+            const loginHintKey = username ? ('inventarsystem_notification_login_hint_v1_' + username) : null;
+
+            const functionSearchEntries = [
+                { label: 'Artikel', keywords: ['artikel', 'inventar', 'home'], url: {{ url_for('home')|tojson }} },
+                { label: 'Meine Ausleihen', keywords: ['meine ausleihen', 'ausleihen', 'borrowed'], url: {{ url_for('my_borrowed_items')|tojson }} },
+                { label: 'Benachrichtigungen', keywords: ['benachrichtigungen', 'nachrichten', 'notifications'], url: {{ url_for('notifications_view')|tojson }} },
+                { label: 'Tutorial', keywords: ['tutorial', 'hilfe', 'anleitung'], url: {{ url_for('tutorial_page')|tojson }} },
+                { label: 'Impressum', keywords: ['impressum'], url: {{ url_for('impressum')|tojson }} },
+                { label: 'Lizenz', keywords: ['lizenz', 'license'], url: {{ url_for('license')|tojson }} },
+                {% if library_module_enabled %}
+                { label: 'Bibliothek', keywords: ['bibliothek', 'medien'], url: {{ url_for('library_view')|tojson }} },
+                {% endif %}
+                {% if 'username' in session and (session.get('admin', False) or is_admin) %}
+                { label: 'Hochladen', keywords: ['hochladen', 'upload'], url: {{ url_for('upload_admin')|tojson }} },
+                { label: 'Ausleihen Verwaltung', keywords: ['ausleihen verwaltung', 'admin borrowings'], url: {{ url_for('admin_borrowings')|tojson }} },
+                { label: 'Defekte Items', keywords: ['defekte items', 'defekt', 'schaden'], url: {{ url_for('admin_damaged_items')|tojson }} },
+                { label: 'Filter verwalten', keywords: ['filter verwalten', 'filter'], url: {{ url_for('manage_filters')|tojson }} },
+                { label: 'Orte verwalten', keywords: ['orte verwalten', 'orte', 'location'], url: {{ url_for('manage_locations')|tojson }} },
+                { label: 'Audit Dashboard', keywords: ['audit', 'audit dashboard'], url: {{ url_for('admin_audit_dashboard')|tojson }} },
+                { label: 'Logs', keywords: ['logs', 'protokoll'], url: {{ url_for('logs')|tojson }} },
+                { label: 'Benutzer verwalten', keywords: ['benutzer verwalten', 'user'], url: {{ url_for('user_del')|tojson }} },
+                { label: 'Neuer Benutzer', keywords: ['neuer benutzer', 'register'], url: {{ url_for('register')|tojson }} },
+                {% if library_module_enabled %}
+                { label: 'Bibliotheks-Ausleihen', keywords: ['bibliotheks ausleihen', 'library loans'], url: {{ url_for('library_loans_admin')|tojson }} },
+                {% endif %}
+                {% if student_cards_module_enabled %}
+                { label: 'Bibliotheksausweis', keywords: ['bibliotheksausweis', 'student card'], url: {{ url_for('student_cards_admin')|tojson }} },
+                {% endif %}
+                {% endif %}
+            ];
+
+            function normalizeSearchText(value) {
+                return String(value || '')
+                    .toLowerCase()
+                    .replace(/[ä]/g, 'ae')
+                    .replace(/[ö]/g, 'oe')
+                    .replace(/[ü]/g, 'ue')
+                    .replace(/[ß]/g, 'ss')
+                    .trim();
+            }
+
+            function findFunctionRoute(rawValue) {
+                const input = normalizeSearchText(rawValue);
+                if (!input) {
+                    return null;
+                }
+
+                let exact = null;
+                for (const entry of functionSearchEntries) {
+                    const candidates = [entry.label].concat(entry.keywords || []);
+                    for (const candidate of candidates) {
+                        if (normalizeSearchText(candidate) === input) {
+                            exact = entry;
+                            break;
+                        }
+                    }
+                    if (exact) {
+                        break;
+                    }
+                }
+                if (exact) {
+                    return exact.url;
+                }
+
+                for (const entry of functionSearchEntries) {
+                    const candidates = [entry.label].concat(entry.keywords || []);
+                    for (const candidate of candidates) {
+                        if (normalizeSearchText(candidate).includes(input) || input.includes(normalizeSearchText(candidate))) {
+                            return entry.url;
+                        }
+                    }
+                }
+
+                return null;
+            }
+
+            function bindFunctionSearchForms() {
+                const forms = document.querySelectorAll('form[data-function-search="true"]');
+                forms.forEach(function(form) {
+                    form.addEventListener('submit', function(event) {
+                        event.preventDefault();
+                        const input = form.querySelector('input[name="function_search"]');
+                        const targetUrl = findFunctionRoute(input ? input.value : '');
+                        if (targetUrl) {
+                            window.location.href = targetUrl;
+                            return;
+                        }
+                        showInAppNotification('Keine Funktion gefunden', 'Bitte Suche verfeinern, z.B. "Defekte Items" oder "Benachrichtigungen".');
+                    });
+                });
+            }
+
+            bindFunctionSearchForms();
+
+            function maybeShowLoginNotificationHint() {
+                if (!username || !loginHintKey) {
+                    return;
+                }
+                if (window.location.pathname === notificationsPagePath) {
+                    return;
+                }
+
+                const alreadyShown = sessionStorage.getItem(loginHintKey);
+                if (alreadyShown) {
+                    return;
+                }
+
+                if (lastUnreadCount > 0) {
+                    const hintTitle = 'Neue Benachrichtigungen';
+                    const hintMessage =
+                        lastUnreadCount === 1
+                            ? 'Sie haben 1 neue Benachrichtigung. Im Nutzer-Menue finden Sie den Eintrag Benachrichtigungen.'
+                            : 'Sie haben ' + lastUnreadCount + ' neue Benachrichtigungen. Im Nutzer-Menue finden Sie den Eintrag Benachrichtigungen.';
+                    showInAppNotification(hintTitle, hintMessage);
+                }
+
+                sessionStorage.setItem(loginHintKey, 'shown');
+            }
+
+            maybeShowLoginNotificationHint();

            function updateNotificationDots(unreadCount) {
                const hasUnread = Number(unreadCount) > 0;
@@ -14,20 +14,21 @@
 <div class="container my-4">
    <div class="impressum-content bg-white p-4 shadow rounded">
        <h1 class="mb-4 text-center">Impressum</h1>
-        <p class="text-center mb-5">(Angaben gemäß § 5 TMG)</p>
+        <p class="text-center mb-5">(Angaben gemäß § 5 DDG)</p>

        <div class="impressum-section mb-4">
            <h3 class="mb-3">Kontaktinformationen</h3>
-            <p><strong>Name:</strong> . ..</p>
-            <p><strong>Adresse:</strong> Musterstraße 123<br>12345 Musterstadt<br>Deutschland</p>
-            <p><strong>E-Mail:</strong> <a href="mailto:kontakt@example.com">kontakt@example.com</a></p>
-            <p><strong>Telefon:</strong> +49 123 456789</p>
+            <address class="mb-0">
+                <p><strong>Name:</strong> Invario UG</p>
+                <p><strong>Adresse:</strong> Musterstraße 123<br>12345 Musterstadt<br>Deutschland</p>
+            </address>
+            <p><strong>E-Mail:</strong> <a href="mailto:info@invario.eu">info@invario.eu</a></p>
        </div>

        <div class="impressum-section mb-4">
            <h3 class="mb-3">Verantwortlich für den Inhalt</h3>
-            <p>(nach § 55 Abs. 2 RStV)</p>
-            <p>...<br>
+            <p>(nach § 18 Abs. 2 MStV)</p>
+            <p>Invario UG<br>
            Musterstraße 123<br>
            12345 Musterstadt<br>
            Deutschland</p>
@@ -37,7 +38,7 @@
            <h3 class="mb-3">Haftungsausschluss</h3>
            
            <h4 class="mb-2">Haftung für Inhalte</h4>
-            <p>Die Inhalte unserer Seiten wurden mit größter Sorgfalt erstellt. Für die Richtigkeit, Vollständigkeit und Aktualität der Inhalte können wir jedoch keine Gewähr übernehmen. Als Diensteanbieter sind wir gemäß § 7 Abs.1 TMG für eigene Inhalte auf diesen Seiten nach den allgemeinen Gesetzen verantwortlich. Nach §§ 8 bis 10 TMG sind wir als Diensteanbieter jedoch nicht verpflichtet, übermittelte oder gespeicherte fremde Informationen zu überwachen oder nach Umständen zu forschen, die auf eine rechtswidrige Tätigkeit hinweisen.</p>
+            <p>Die Inhalte unserer Seiten wurden mit größter Sorgfalt erstellt. Für die Richtigkeit, Vollständigkeit und Aktualität der Inhalte können wir jedoch keine Gewähr übernehmen. Als Diensteanbieter sind wir gemäß § 7 Abs. 1 DDG für eigene Inhalte auf diesen Seiten nach den allgemeinen Gesetzen verantwortlich. Nach §§ 8 bis 10 DDG sind wir als Diensteanbieter jedoch nicht verpflichtet, übermittelte oder gespeicherte fremde Informationen zu überwachen oder nach Umständen zu forschen, die auf eine rechtswidrige Tätigkeit hinweisen.</p>
            
            <h4 class="mb-2">Haftung für Links</h4>
            <p>Unser Angebot enthält Links zu externen Websites Dritter, auf deren Inhalte wir keinen Einfluss haben. Deshalb können wir für diese fremden Inhalte auch keine Gewähr übernehmen. Für die Inhalte der verlinkten Seiten ist stets der jeweilige Anbieter oder Betreiber der Seiten verantwortlich. Die verlinkten Seiten wurden zum Zeitpunkt der Verlinkung auf mögliche Rechtsverstöße überprüft. Rechtswidrige Inhalte waren zum Zeitpunkt der Verlinkung nicht erkennbar.</p>
@@ -321,11 +321,6 @@
                <li><strong>Einwilligung:</strong> Falls private Daten der Nutzer erfasst werden, muss eine explizite
                    Einwilligung vorliegen (Art. 6 Abs. 1 lit. a DSGVO).</li>
            </ol>
-            <div class="license-exception-notice" style="background-color:#f8d7da; border-color:#f5c2c7; border-left-color:#dc3545;">
-                <h3 style="color:#842029;">⚠️ Hinweis</h3>
-                <p>Dieses Dokument stellt <strong>keine Rechtsberatung</strong> dar. Bitte konsultieren Sie im Zweifelsfall
-                einen Fachanwalt für Datenschutzrecht.</p>
-            </div>
        </div>
        </div><!-- /#pane-legal -->

@@ -25,6 +25,11 @@
            <div>
              <div style="font-weight:800; color:#0f172a;">{{ n.title }}</div>
              <div style="font-size:0.9rem; color:#475569; margin-top:2px;">{{ n.message }}</div>
+              {% if n.type == 'damage_reported' %}
+              <div style="margin-top:8px;">
+                <a class="btn btn-sm btn-outline-danger" href="{{ url_for('admin_damaged_items') }}">Zu Defekte-Items Verwaltung</a>
+              </div>
+              {% endif %}
              <div style="font-size:0.78rem; color:#64748b; margin-top:6px;">
                {% if n.created_at %}{{ n.created_at.strftime('%d.%m.%Y %H:%M') }}{% else %}-{% endif %}
              </div>
@@ -30,6 +30,8 @@ services:
      dockerfile: Dockerfile
    container_name: inventarsystem-app
    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
    depends_on:
      mongodb:
        condition: service_healthy
@@ -43,7 +45,7 @@ services:
      - "8000"
    volumes:
      - ./config.json:/app/config.json:ro
-      - ./Web:/app/Web
+      - ./Web:/app/Web:ro
      - app_uploads:/app/Web/uploads
      - app_thumbnails:/app/Web/thumbnails
      - app_previews:/app/Web/previews
Author	SHA1	Message	Date
Aiirondev_dev	b94fb1cd97	Enhance security and logging in application settings and templates; update impressum legal references	2026-04-17 16:54:53 +02:00
Aiirondev_dev	ce20f569a3	Fix email link in impressum section	2026-04-13 21:58:14 +02:00
Aiirondev_dev	ec7f32994c	Remove notifications link and update impressum contact information	2026-04-13 21:44:06 +02:00
Aiirondev_dev	8358bf257f	Add login notification hint for unread messages in user menu	2026-04-13 21:30:24 +02:00
Aiirondev_dev	193495d6a2	Enhance navbar with sticky positioning and search functionality, including active link highlighting and improved mobile responsiveness	2026-04-13 21:27:12 +02:00
Aiirondev_dev	5afcaa5e19	Add damage report link to notification details	2026-04-13 21:19:32 +02:00