dillard
6387d24846
Admin-scoped users (answers: who can create a 'user' account, only super or also an admin within their own scope?): - New owner_admin_id column on users (migration 004). NULL means created by super (company-wide, previous behavior); otherwise scoped to that admin's own codes. - Users::addUser/editUser/deleteUser now allow an 'admin' session, but force type='user' and owner_admin_id to their own id regardless of submitted input. user.php/users.php open up to admins with a restricted UI (no type picker, listing limited to their own created users). - New qr_compute_scope_owner_id()/qr_apply_owner_scope()/qr_has_full_visibility() helpers in includes/security.php, replacing the ad-hoc type==='admin' checks in index.php, dynamic_qrcodes.php, static_qrcodes.php and bulk_action.php. A 'user' account created by an admin is now scoped to that admin's codes instead of seeing everything company-wide. Qr code storage hardening: images were served as plain static files under the document root with no auth check at all. Storage now lives outside the web root; qrcode_image.php and qrcode_zip_download.php gate access with the same permission model as the list pages, and the bulk zip download is bound to the session that generated it. PHP 8.4 + chillerlan/php-qrcode 6.0.1: bumped since this is a dockerized app, so the PHP version shipped doesn't matter to end users. Note: the 6.0.1 tag itself only requires PHP 8.2 - the earlier "needs 8.4" read was from an unpinned clone of master, which has since moved past the tag. Fixed along the way, surfaced by testing on 8.4: - The hardcoded Imagick build (an old pinned master commit, workaround for 3.7.0 being broken on PHP 8.3+) no longer compiles on 8.4. Imagick 3.8.1 is now a normal stable release, so the workaround is gone. - config.php had display_errors=On + error_reporting(E_ALL), so PHP 8.4's new deprecation notices got dumped straight into the response before session_start() could run, breaking login outright. Also an info-disclosure risk on its own. Now logged instead of displayed. - MysqliDb::insertMulti() had an implicit nullable parameter, now explicit. - includes/auth_validate.php redirected unauthenticated requests but never called exit(), so the rest of the script kept running. - Dockerfile.fpm was missing both git (needed to clone chillerlan/php-qrcode) and the imagick extension entirely. Also removes the unused sample qr code images that shipped in the original repo; storage now lives outside the document root so they were never going to be served again.
66 lines
2.1 KiB
YAML
66 lines
2.1 KiB
YAML
services:
|
|
nginx:
|
|
image: "nginx:1.27-alpine"
|
|
restart: "unless-stopped"
|
|
ports:
|
|
- "80:80"
|
|
# Only open 443 once SSL certificates are mounted (e.g. via a certbot volume,
|
|
# or a separate reverse proxy like Caddy/Traefik in front). See the infra phase of the plan.
|
|
volumes:
|
|
- ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
|
|
depends_on:
|
|
- php-dynamic-qrcode
|
|
networks:
|
|
- php-dynamic-qrcode-network
|
|
|
|
php-dynamic-qrcode:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile.fpm
|
|
restart: "unless-stopped"
|
|
environment:
|
|
TYPE: "docker"
|
|
QRCODE_GENERATOR: "${QRCODE_GENERATOR:-internal-chillerlan.qrcode}"
|
|
BASE_URL: "${BASE_URL:?set BASE_URL in .env, e.g. https://qr.ensembia.com}"
|
|
DATABASE_HOST: "php-dynamic-qrcode-db"
|
|
DATABASE_PORT: "3306"
|
|
DATABASE_NAME: "${DATABASE_NAME:-qrcode}"
|
|
DATABASE_USER: "${DATABASE_USER:-qrcode}"
|
|
DATABASE_PASSWORD: "${DATABASE_PASSWORD:?set DATABASE_PASSWORD in .env}"
|
|
DATABASE_PREFIX: "${DATABASE_PREFIX:-}"
|
|
DATABASE_CHARSET: "${DATABASE_CHARSET:-utf8}"
|
|
depends_on:
|
|
php-dynamic-qrcode-db:
|
|
condition: service_healthy
|
|
volumes:
|
|
- php_dynamic_qrcode_saved_qrcode_data:/var/www/qrcode-storage
|
|
networks:
|
|
- php-dynamic-qrcode-network
|
|
|
|
php-dynamic-qrcode-db:
|
|
image: "mysql:8.0"
|
|
restart: "unless-stopped"
|
|
volumes:
|
|
- php_dynamic_qrcode_db_data:/var/lib/mysql
|
|
- ./db/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
|
|
environment:
|
|
MYSQL_ROOT_PASSWORD: "${MYSQL_ROOT_PASSWORD:?set MYSQL_ROOT_PASSWORD in .env}"
|
|
MYSQL_DATABASE: "${DATABASE_NAME:-qrcode}"
|
|
MYSQL_USER: "${DATABASE_USER:-qrcode}"
|
|
MYSQL_PASSWORD: "${DATABASE_PASSWORD:?set DATABASE_PASSWORD in .env}"
|
|
healthcheck:
|
|
test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-p${MYSQL_ROOT_PASSWORD}"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 10
|
|
networks:
|
|
- php-dynamic-qrcode-network
|
|
|
|
volumes:
|
|
php_dynamic_qrcode_db_data:
|
|
php_dynamic_qrcode_saved_qrcode_data:
|
|
|
|
networks:
|
|
php-dynamic-qrcode-network:
|
|
driver: bridge
|