dillard
3afe3b7698
Fixes critical pre-existing issues found during review: bulk_action.php had no auth check at all (unauthenticated download/delete of any qrcode) and built a table name from unwhitelisted user input (SQL injection); the QR generator classes wrote files from unvalidated filename/format, allowing path traversal and arbitrary file writes. Also pins chillerlan/php-qrcode to 5.0.5 since master now requires PHP 8.4, breaking the PHP 8.3 build. - CSRF tokens on all POST forms and the bulk_action.php JSON endpoint - Login rate limiting (5 attempts / 15 min) via new login_attempts table - Hardened sessions: httponly/samesite cookies, 30 min idle timeout, session regeneration on login - Forced password change for the default superadmin/superadmin account - Server-side validation in Users/DynamicQrcode/Qrcode classes - Audit log table for auth, user, and qrcode actions - Checked-in db schema (db/init.sql, migrations/) instead of relying on an opaque prebuilt db image - Production docker-compose with Nginx + php-fpm instead of the PHP dev server
54 lines
1.7 KiB
YAML
54 lines
1.7 KiB
YAML
services:
|
|
php-dynamic-qrcode:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
restart: "unless-stopped"
|
|
environment:
|
|
TYPE: "${TYPE:-docker}"
|
|
QRCODE_GENERATOR: "${QRCODE_GENERATOR:-internal-chillerlan.qrcode}"
|
|
BASE_URL: "${BASE_URL:-http://localhost}"
|
|
DATABASE_HOST: "php-dynamic-qrcode-db"
|
|
DATABASE_PORT: "3306"
|
|
DATABASE_NAME: "${DATABASE_NAME:-qrcode}"
|
|
DATABASE_USER: "${DATABASE_USER:-qrcode}"
|
|
DATABASE_PASSWORD: "${DATABASE_PASSWORD:?zet DATABASE_PASSWORD in .env}"
|
|
DATABASE_PREFIX: "${DATABASE_PREFIX:-}"
|
|
DATABASE_CHARSET: "${DATABASE_CHARSET:-utf8}"
|
|
ports:
|
|
- "80:80"
|
|
depends_on:
|
|
php-dynamic-qrcode-db:
|
|
condition: service_healthy
|
|
volumes:
|
|
- php_dynamic_qrcode_saved_qrcode_data:/var/www/html/saved_qrcode
|
|
networks:
|
|
- php-dynamic-qrcode-network
|
|
|
|
php-dynamic-qrcode-db:
|
|
image: "mysql:8.0"
|
|
restart: "unless-stopped"
|
|
volumes:
|
|
- php_dynamic_qrcode_db_data:/var/lib/mysql
|
|
- ./db/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
|
|
environment:
|
|
MYSQL_ROOT_PASSWORD: "${MYSQL_ROOT_PASSWORD:?zet MYSQL_ROOT_PASSWORD in .env}"
|
|
MYSQL_DATABASE: "${DATABASE_NAME:-qrcode}"
|
|
MYSQL_USER: "${DATABASE_USER:-qrcode}"
|
|
MYSQL_PASSWORD: "${DATABASE_PASSWORD:?zet DATABASE_PASSWORD in .env}"
|
|
healthcheck:
|
|
test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-p${MYSQL_ROOT_PASSWORD}"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 10
|
|
networks:
|
|
- php-dynamic-qrcode-network
|
|
|
|
volumes:
|
|
php_dynamic_qrcode_db_data:
|
|
php_dynamic_qrcode_saved_qrcode_data:
|
|
|
|
networks:
|
|
php-dynamic-qrcode-network:
|
|
driver: bridge
|