mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-11-09 11:10:08 +01:00
Pontoporeia
554fc57455
The passive scan flagged 3x MEDIUM 'PHPSESSID missing Secure' and an
admin-login cookie missing HttpOnly. Root cause was not the cookie code
but scheme detection: every call site read $_SERVER['HTTPS'] directly,
which is unset when TLS is terminated in front of PHP-FPM, so the Secure
flag was silently dropped.
Add RequestUtil::isSecure()/baseUrl() as the single scheme detector:
1. $_SERVER['HTTPS'] (direct TLS)
2. X-Forwarded-Proto — only from a loopback/private peer, so a remote
client cannot spoof it
3. SERVER_PORT == 443
Replace all 8 inline $_SERVER['HTTPS'] idioms (App, AdminAuth, 4x filepond
endpoints, validate-access, admin/acces, SystemController self-ping).
nginx: forward the scheme to php-fpm in all 4 fastcgi blocks
(fastcgi_param HTTPS $https + X-Forwarded-Proto $scheme) and uncomment
server_tokens off. Config validated with nginx -t (real config, alpine
container).
AdminAuth: logout() now clears the session cookie with the same
path/domain/secure/httponly/samesite it was set with, instead of the
legacy positional setcookie() that dropped SameSite.
Tests (+24, 340 total):
- RequestUtilTest: scheme detection incl. proxy trust boundaries
- SessionCookieTest: logout emits a hardened deletion cookie
- PeerTubeIntegrationTest: PeerTube keeps using its absolute instance_url
and is unaffected by scheme changes (Guzzle MockHandler)
- NginxConfigTest: pins HTTPS forwarding, HSTS includeSubDomains,
server_tokens off
PeerTube uses an absolute instance_url from the DB and never derives URLs
from the request, so the integration is unchanged — the regression tests
lock that invariant in.
44 lines
1.9 KiB
PHP
44 lines
1.9 KiB
PHP
<?php
|
|
require_once __DIR__ . '/../../bootstrap.php';
|
|
require_once __DIR__ . '/../../src/AdminAuth.php';
|
|
require_once __DIR__ . '/../../src/ShareLink.php';
|
|
require_once APP_ROOT . '/src/EmailObfuscator.php';
|
|
|
|
App::adminGuard();
|
|
|
|
// ── Liens d'accès étudiant·e ──────────────────────────────────────────────────
|
|
$shareLink = ShareLink::make();
|
|
$links = $shareLink->listActive();
|
|
$archivedLinks = $shareLink->listArchived();
|
|
|
|
require_once APP_ROOT . '/src/RequestUtil.php';
|
|
$baseUrl = RequestUtil::baseUrl();
|
|
|
|
// ── Demandes d'accès aux fichiers ─────────────────────────────────────────────
|
|
require_once APP_ROOT . '/src/Database.php';
|
|
require_once APP_ROOT . '/src/Controllers/FileAccessController.php';
|
|
|
|
$db = new Database();
|
|
$siteSettings = $db->getAllSettings();
|
|
|
|
$controller = FileAccessController::create();
|
|
$vars = $controller->handle();
|
|
extract($vars);
|
|
|
|
// ── Page setup ────────────────────────────────────────────────────────────────
|
|
$pageTitle = 'Accès';
|
|
$isAdmin = true;
|
|
$bodyClass = 'admin-body';
|
|
$extraJs = ['/assets/js/app/clipboard.js', '/assets/js/app/acces-password.js'];
|
|
|
|
// Flash data for newly created/updated links (password display in modals)
|
|
$newLinkSlug = $_SESSION['_flash_new_link_slug'] ?? null;
|
|
$newLinkPassword = $_SESSION['_flash_new_link_password'] ?? null;
|
|
unset($_SESSION['_flash_new_link_slug'], $_SESSION['_flash_new_link_password']);
|
|
|
|
require_once APP_ROOT . '/templates/head.php';
|
|
echo '<link rel="stylesheet" href="/assets/css/file-access.css">';
|
|
include APP_ROOT . '/templates/header.php';
|
|
include APP_ROOT . '/templates/admin/acces.php';
|
|
require_once APP_ROOT . '/templates/admin/footer.php';
|