mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-05-06 11:09:18 +02:00
a2b1ff5f41
Items resolved: - #3 (HIGH): Move file uploads outside webroot to STORAGE_ROOT (/var/www/posterg/storage). Uploads were previously stored in public/admin/actions/data/ which is web-accessible. - #4 (HIGH): Align file paths and add media.php controller. DB paths are now storage-relative (theses/YEAR/ID/file, covers/file). New public/media.php serves files with path-traversal jail, MIME allow-list, and proper caching headers. memoire.php and search.php updated to use /media.php?path=. Also fixed: cover images were never recorded in thesis_files (broken INSERT). - #5 (HIGH): RateLimit::getClientIdentifier() now uses REMOTE_ADDR only. HTTP_X_FORWARDED_FOR and HTTP_CLIENT_IP are attacker-controlled headers that allowed unlimited rate-limit bypass by rotating spoofed IPs. - #6 (HIGH): Port public/admin/.htaccess security rules to nginx/posterg.conf. Apache .htaccess directives are silently ignored by nginx; none were active. CSP added to /admin/ location block, .log file denial added globally, autoindex off made explicit. Documented in nginx/HTACCESS_TO_NGINX.md. Supporting changes: - config/bootstrap.php: add STORAGE_ROOT constant - nginx/SECURITY_HEADERS.md: updated to reflect admin CSP and pending public CSP - docs/TODO.SECURITY.md: items #3-6 moved to resolved; priority order updated
38 lines
1.0 KiB
PHP
38 lines
1.0 KiB
PHP
<?php
|
|
/**
|
|
* Simple configuration for website
|
|
*/
|
|
|
|
// Define application root
|
|
define('APP_ROOT', dirname(__DIR__));
|
|
|
|
// Storage directory for uploaded files — intentionally outside the webroot
|
|
// so no uploaded content is ever directly web-accessible (items #3 & #4).
|
|
// Files are served through public/media.php which validates paths and MIME types.
|
|
define('STORAGE_ROOT', '/var/www/posterg/storage');
|
|
|
|
// Error reporting
|
|
if (php_sapi_name() === 'cli-server') {
|
|
// Development mode
|
|
error_reporting(E_ALL);
|
|
ini_set('display_errors', '1');
|
|
} else {
|
|
// Production mode
|
|
error_reporting(E_ALL);
|
|
ini_set('display_errors', '0');
|
|
ini_set('log_errors', '1');
|
|
}
|
|
|
|
// Simple helper function for including templates
|
|
function include_template($name) {
|
|
$path = APP_ROOT . '/includes/' . $name;
|
|
if (file_exists($path)) {
|
|
include $path;
|
|
}
|
|
}
|
|
|
|
// Autoload Composer dependencies if available
|
|
if (file_exists(APP_ROOT . '/vendor/autoload.php')) {
|
|
require_once APP_ROOT . '/vendor/autoload.php';
|
|
}
|