mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-05-06 19:19:19 +02:00
a2b1ff5f41
Items resolved: - #3 (HIGH): Move file uploads outside webroot to STORAGE_ROOT (/var/www/posterg/storage). Uploads were previously stored in public/admin/actions/data/ which is web-accessible. - #4 (HIGH): Align file paths and add media.php controller. DB paths are now storage-relative (theses/YEAR/ID/file, covers/file). New public/media.php serves files with path-traversal jail, MIME allow-list, and proper caching headers. memoire.php and search.php updated to use /media.php?path=. Also fixed: cover images were never recorded in thesis_files (broken INSERT). - #5 (HIGH): RateLimit::getClientIdentifier() now uses REMOTE_ADDR only. HTTP_X_FORWARDED_FOR and HTTP_CLIENT_IP are attacker-controlled headers that allowed unlimited rate-limit bypass by rotating spoofed IPs. - #6 (HIGH): Port public/admin/.htaccess security rules to nginx/posterg.conf. Apache .htaccess directives are silently ignored by nginx; none were active. CSP added to /admin/ location block, .log file denial added globally, autoindex off made explicit. Documented in nginx/HTACCESS_TO_NGINX.md. Supporting changes: - config/bootstrap.php: add STORAGE_ROOT constant - nginx/SECURITY_HEADERS.md: updated to reflect admin CSP and pending public CSP - docs/TODO.SECURITY.md: items #3-6 moved to resolved; priority order updated
91 lines
2.6 KiB
PHP
91 lines
2.6 KiB
PHP
<?php
|
|
/**
|
|
* Media file serving controller
|
|
*
|
|
* Serves uploaded files that are stored outside the webroot (STORAGE_ROOT).
|
|
* This is the sole access point for thesis files, covers, and annexes — they
|
|
* are never exposed as direct filesystem paths from the web server.
|
|
*
|
|
* Security:
|
|
* - Strict character whitelist on the path parameter (no path traversal)
|
|
* - realpath() jail: resolved path must stay inside STORAGE_ROOT
|
|
* - MIME type verified against an allow-list before serving
|
|
*/
|
|
require_once __DIR__ . '/../config/bootstrap.php';
|
|
|
|
// --- 1. Extract and validate the requested path -------------------------------
|
|
|
|
$requestedPath = $_GET['path'] ?? '';
|
|
|
|
// Only allow safe characters: letters, digits, forward slashes, dots, hyphens, underscores.
|
|
// This explicitly rejects null bytes, backslashes, and sequences like "../".
|
|
if (!preg_match('#^[a-zA-Z0-9/_\-.]+$#', $requestedPath) || $requestedPath === '') {
|
|
http_response_code(400);
|
|
exit;
|
|
}
|
|
|
|
// --- 2. Resolve full filesystem path and enforce storage jail -----------------
|
|
|
|
$storageRoot = defined('STORAGE_ROOT') ? STORAGE_ROOT : '/var/www/posterg/storage';
|
|
$fullPath = $storageRoot . '/' . $requestedPath;
|
|
|
|
$realStorage = realpath($storageRoot);
|
|
$realFull = realpath($fullPath);
|
|
|
|
if (
|
|
$realFull === false
|
|
|| $realStorage === false
|
|
|| strpos($realFull, $realStorage . '/') !== 0
|
|
) {
|
|
http_response_code(404);
|
|
exit;
|
|
}
|
|
|
|
if (!is_file($realFull)) {
|
|
http_response_code(404);
|
|
exit;
|
|
}
|
|
|
|
// --- 3. Verify MIME type from file content (not extension) --------------------
|
|
|
|
$finfo = new finfo(FILEINFO_MIME_TYPE);
|
|
$mimeType = $finfo->file($realFull);
|
|
|
|
$allowedMimes = [
|
|
'image/jpeg',
|
|
'image/png',
|
|
'image/gif',
|
|
'application/pdf',
|
|
'video/mp4',
|
|
'application/zip',
|
|
];
|
|
|
|
if (!in_array($mimeType, $allowedMimes, true)) {
|
|
http_response_code(403);
|
|
exit;
|
|
}
|
|
|
|
// --- 4. Send response headers -------------------------------------------------
|
|
|
|
header('Content-Type: ' . $mimeType);
|
|
header('Content-Length: ' . filesize($realFull));
|
|
header('X-Content-Type-Options: nosniff');
|
|
|
|
$ext = strtolower(pathinfo($realFull, PATHINFO_EXTENSION));
|
|
|
|
if (in_array($ext, ['jpg', 'jpeg', 'png', 'gif'], true)) {
|
|
// Images: cache publicly for 7 days
|
|
header('Cache-Control: public, max-age=604800');
|
|
} elseif ($ext === 'pdf') {
|
|
// PDFs: cache for 1 day, display inline
|
|
header('Cache-Control: public, max-age=86400');
|
|
header('Content-Disposition: inline');
|
|
} else {
|
|
// Everything else: no public caching
|
|
header('Cache-Control: private, no-store');
|
|
}
|
|
|
|
// --- 5. Stream file -----------------------------------------------------------
|
|
|
|
readfile($realFull);
|