Fix icon hover colors, text alignment, and UI improvements

api/auth.php

@@ -10,6 +10,9 @@ $body = getRequestBody();
 
 switch ($method) {
     case 'POST':
+        // Add CSRF protection for auth endpoints
+        requireSameOriginRequest();
+        
         $action = $body['action'] ?? 'login';
         
         if ($action === 'login') {
@@ -82,19 +85,18 @@ function handleLogin($body) {
         }
     }
     
-    recordFailedLogin();
+    recordFailedLogin($username);
     auditLog('login_failure', ['username' => $username]);
     jsonResponse(['success' => false, 'message' => 'Invalid credentials'], 401);
 }
 
-function recordFailedLogin() {
+function recordFailedLogin($username = '') {
     global $db;
 
     $ip = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
-    $body = getRequestBody();
     $db->insert('login_attempts', [
         'ip_address' => $ip,
-        'username' => sanitize($body['username'] ?? ''),
+        'username' => sanitize($username),
         'attempted_at' => date('Y-m-d H:i:s')
     ]);
 
@@ -236,6 +238,11 @@ function requestPasswordReset($body) {
         jsonResponse(['success' => false, 'message' => 'Email or username is required'], 400);
     }
 
+    // Validate email format if it looks like an email
+    if (strpos($identity, '@') !== false && !filter_var($identity, FILTER_VALIDATE_EMAIL)) {
+        jsonResponse(['success' => true, 'message' => 'If an account exists, a reset email has been sent.']);
+    }
+
     $matched = findUserForPasswordReset($identity);
 
     // Always return generic success to avoid username/email enumeration