Security hardening: CSRF, rate limiting, session/password policy, audit log

Fixes critical pre-existing issues found during review: bulk_action.php had no auth check at all (unauthenticated download/delete of any qrcode) and built a table name from unwhitelisted user input (SQL injection); the QR generator classes wrote files from unvalidated filename/format, allowing path traversal and arbitrary file writes. Also pins chillerlan/php-qrcode to 5.0.5 since master now requires PHP 8.4, breaking the PHP 8.3 build. - CSRF tokens on all POST forms and the bulk_action.php JSON endpoint - Login rate limiting (5 attempts / 15 min) via new login_attempts table - Hardened sessions: httponly/samesite cookies, 30 min idle timeout, session regeneration on login - Forced password change for the default superadmin/superadmin account - Server-side validation in Users/DynamicQrcode/Qrcode classes - Audit log table for auth, user, and qrcode actions - Checked-in db schema (db/init.sql, migrations/) instead of relying on an opaque prebuilt db image - Production docker-compose with Nginx + php-fpm instead of the PHP dev server
2026-07-08 15:00:33 +02:00
parent 8db3158239
commit 3afe3b7698
48 changed files with 946 additions and 127 deletions
@@ -0,0 +1,66 @@
+services:
+  nginx:
+    image: "nginx:1.27-alpine"
+    restart: "unless-stopped"
+    ports:
+      - "80:80"
+      # 443 pas openzetten zodra SSL-certificaten zijn gemount (bv. via certbot-volume
+      # of een losse reverse proxy zoals Caddy/Traefik ervoor). Zie infra-fase van het plan.
+    volumes:
+      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
+      - php_dynamic_qrcode_saved_qrcode_data:/var/www/html/saved_qrcode:ro
+    depends_on:
+      - php-dynamic-qrcode
+    networks:
+      - php-dynamic-qrcode-network
+
+  php-dynamic-qrcode:
+    build:
+      context: .
+      dockerfile: Dockerfile.fpm
+    restart: "unless-stopped"
+    environment:
+      TYPE: "docker"
+      QRCODE_GENERATOR: "${QRCODE_GENERATOR:-internal-chillerlan.qrcode}"
+      BASE_URL: "${BASE_URL:?zet BASE_URL in .env, bv. https://qr.ensembia.com}"
+      DATABASE_HOST: "php-dynamic-qrcode-db"
+      DATABASE_PORT: "3306"
+      DATABASE_NAME: "${DATABASE_NAME:-qrcode}"
+      DATABASE_USER: "${DATABASE_USER:-qrcode}"
+      DATABASE_PASSWORD: "${DATABASE_PASSWORD:?zet DATABASE_PASSWORD in .env}"
+      DATABASE_PREFIX: "${DATABASE_PREFIX:-}"
+      DATABASE_CHARSET: "${DATABASE_CHARSET:-utf8}"
+    depends_on:
+      php-dynamic-qrcode-db:
+        condition: service_healthy
+    volumes:
+      - php_dynamic_qrcode_saved_qrcode_data:/var/www/html/saved_qrcode
+    networks:
+      - php-dynamic-qrcode-network
+
+  php-dynamic-qrcode-db:
+    image: "mysql:8.0"
+    restart: "unless-stopped"
+    volumes:
+      - php_dynamic_qrcode_db_data:/var/lib/mysql
+      - ./db/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
+    environment:
+      MYSQL_ROOT_PASSWORD: "${MYSQL_ROOT_PASSWORD:?zet MYSQL_ROOT_PASSWORD in .env}"
+      MYSQL_DATABASE: "${DATABASE_NAME:-qrcode}"
+      MYSQL_USER: "${DATABASE_USER:-qrcode}"
+      MYSQL_PASSWORD: "${DATABASE_PASSWORD:?zet DATABASE_PASSWORD in .env}"
+    healthcheck:
+      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-p${MYSQL_ROOT_PASSWORD}"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+    networks:
+      - php-dynamic-qrcode-network
+
+volumes:
+  php_dynamic_qrcode_db_data:
+  php_dynamic_qrcode_saved_qrcode_data:
+
+networks:
+  php-dynamic-qrcode-network:
+    driver: bridge