dillard
b5ef4ac0cb
Admin-scoped users (answers: who can create a 'user' account, only super or also an admin within their own scope?): - New owner_admin_id column on users (migration 004). NULL means created by super (company-wide, previous behavior); otherwise scoped to that admin's own codes. - Users::addUser/editUser/deleteUser now allow an 'admin' session, but force type='user' and owner_admin_id to their own id regardless of submitted input. user.php/users.php open up to admins with a restricted UI (no type picker, listing limited to their own created users). - New qr_compute_scope_owner_id()/qr_apply_owner_scope()/qr_has_full_visibility() helpers in includes/security.php, replacing the ad-hoc type==='admin' checks in index.php, dynamic_qrcodes.php, static_qrcodes.php and bulk_action.php. A 'user' account created by an admin is now scoped to that admin's codes instead of seeing everything company-wide. Qr code storage hardening: images were served as plain static files under the document root with no auth check at all. Storage now lives outside the web root; qrcode_image.php and qrcode_zip_download.php gate access with the same permission model as the list pages, and the bulk zip download is bound to the session that generated it. PHP 8.4 + chillerlan/php-qrcode 6.0.1: bumped since this is a dockerized app, so the PHP version shipped doesn't matter to end users. Note: the 6.0.1 tag itself only requires PHP 8.2 - the earlier "needs 8.4" read was from an unpinned clone of master, which has since moved past the tag. Fixed along the way, surfaced by testing on 8.4: - The hardcoded Imagick build (an old pinned master commit, workaround for 3.7.0 being broken on PHP 8.3+) no longer compiles on 8.4. Imagick 3.8.1 is now a normal stable release, so the workaround is gone. - config.php had display_errors=On + error_reporting(E_ALL), so PHP 8.4's new deprecation notices got dumped straight into the response before session_start() could run, breaking login outright. Also an info-disclosure risk on its own. Now logged instead of displayed. - MysqliDb::insertMulti() had an implicit nullable parameter, now explicit. - includes/auth_validate.php redirected unauthenticated requests but never called exit(), so the rest of the script kept running. - Dockerfile.fpm was missing both git (needed to clone chillerlan/php-qrcode) and the imagick extension entirely. Also removes the unused sample qr code images that shipped in the original repo; storage now lives outside the document root so they were never going to be served again. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
58 lines
2.2 KiB
SQL
58 lines
2.2 KiB
SQL
-- Fase 1 security hardening migration.
|
|
-- Run against an existing database (using the original
|
|
-- giandonatoinverso/php-dynamic-qr-code-db image or an older init.sql).
|
|
-- Columns/tables are only added if they don't already exist.
|
|
|
|
SET @db := DATABASE();
|
|
|
|
SET @col_exists := (
|
|
SELECT COUNT(*) FROM information_schema.COLUMNS
|
|
WHERE TABLE_SCHEMA = @db AND TABLE_NAME = 'users' AND COLUMN_NAME = 'must_change_password'
|
|
);
|
|
SET @sql := IF(@col_exists = 0,
|
|
'ALTER TABLE `users` ADD COLUMN `must_change_password` TINYINT(1) NOT NULL DEFAULT 0',
|
|
'SELECT 1');
|
|
PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;
|
|
|
|
SET @col_exists := (
|
|
SELECT COUNT(*) FROM information_schema.COLUMNS
|
|
WHERE TABLE_SCHEMA = @db AND TABLE_NAME = 'users' AND COLUMN_NAME = 'password_changed_at'
|
|
);
|
|
SET @sql := IF(@col_exists = 0,
|
|
'ALTER TABLE `users` ADD COLUMN `password_changed_at` DATETIME DEFAULT NULL',
|
|
'SELECT 1');
|
|
PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;
|
|
|
|
-- An existing superadmin account with the factory password (superadmin/superadmin)
|
|
-- must change its password on next login.
|
|
UPDATE `users`
|
|
SET `must_change_password` = 1
|
|
WHERE `username` = 'superadmin'
|
|
AND `password` = '$2y$10$xpZc5KC.aU2XHkcqhuZGFuAnqmtL4Unt8MysOyylceq.19XIyoZpG';
|
|
|
|
CREATE TABLE IF NOT EXISTS `login_attempts` (
|
|
`id` int(10) unsigned NOT NULL AUTO_INCREMENT,
|
|
`username` varchar(50) NOT NULL,
|
|
`ip_address` varchar(45) NOT NULL,
|
|
`success` tinyint(1) NOT NULL DEFAULT 0,
|
|
`attempted_at` datetime NOT NULL,
|
|
PRIMARY KEY (`id`),
|
|
KEY `username_attempted_at` (`username`, `attempted_at`),
|
|
KEY `ip_attempted_at` (`ip_address`, `attempted_at`)
|
|
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
|
|
|
|
CREATE TABLE IF NOT EXISTS `audit_log` (
|
|
`id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
|
|
`user_id` int(25) DEFAULT NULL,
|
|
`username` varchar(50) DEFAULT NULL,
|
|
`action` varchar(50) NOT NULL,
|
|
`target_type` varchar(30) DEFAULT NULL,
|
|
`target_id` varchar(50) DEFAULT NULL,
|
|
`ip_address` varchar(45) DEFAULT NULL,
|
|
`user_agent` varchar(255) DEFAULT NULL,
|
|
`created_at` datetime NOT NULL,
|
|
PRIMARY KEY (`id`),
|
|
KEY `created_at` (`created_at`),
|
|
KEY `user_id` (`user_id`)
|
|
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
|