dillard
feb5380b28
Fixes critical pre-existing issues found during review: bulk_action.php had no auth check at all (unauthenticated download/delete of any qrcode) and built a table name from unwhitelisted user input (SQL injection); the QR generator classes wrote files from unvalidated filename/format, allowing path traversal and arbitrary file writes. Also pins chillerlan/php-qrcode to 5.0.5 since master now requires PHP 8.4, breaking the PHP 8.3 build. - CSRF tokens on all POST forms and the bulk_action.php JSON endpoint - Login rate limiting (5 attempts / 15 min) via new login_attempts table - Hardened sessions: httponly/samesite cookies, 30 min idle timeout, session regeneration on login - Forced password change for the default superadmin/superadmin account - Server-side validation in Users/DynamicQrcode/Qrcode classes - Audit log table for auth, user, and qrcode actions - Checked-in db schema (db/init.sql, migrations/) instead of relying on an opaque prebuilt db image - Production docker-compose with Nginx + php-fpm instead of the PHP dev server Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
105 lines
3.6 KiB
Docker
105 lines
3.6 KiB
Docker
FROM php:8.3
|
|
|
|
RUN if [ "$(grep '^VERSION_ID=' /etc/os-release | cut -d '=' -f 2 | tr -d '"')" -eq "9" ]; then \
|
|
sed -i -e 's/deb.debian.org/archive.debian.org/g' \
|
|
-e 's/security.debian.org/archive.debian.org/g' \
|
|
-e '/stretch-updates/d' /etc/apt/sources.list; \
|
|
fi
|
|
|
|
# Download script to install PHP extensions and dependencies
|
|
ADD https://github.com/mlocati/docker-php-extension-installer/releases/latest/download/install-php-extensions /usr/local/bin/
|
|
|
|
RUN chmod +x /usr/local/bin/install-php-extensions
|
|
|
|
RUN DEBIAN_FRONTEND=noninteractive apt-get update -q \
|
|
&& DEBIAN_FRONTEND=noninteractive apt-get install -qq -y \
|
|
curl \
|
|
dnsutils \
|
|
git \
|
|
iputils-ping \
|
|
less \
|
|
libzip-dev \
|
|
libjpeg62-turbo-dev \
|
|
libpng-dev \
|
|
libfreetype6-dev \
|
|
nano \
|
|
net-tools \
|
|
procps \
|
|
tar \
|
|
tini \
|
|
zip unzip \
|
|
# iconv, mbstring and pdo_sqlite are omitted as they are already installed
|
|
&& PHP_EXTENSIONS=" \
|
|
amqp \
|
|
bcmath \
|
|
bz2 \
|
|
calendar \
|
|
event \
|
|
exif \
|
|
gd \
|
|
gettext \
|
|
intl \
|
|
ldap \
|
|
memcached \
|
|
mysqli \
|
|
opcache \
|
|
pdo_mysql \
|
|
pdo_pgsql \
|
|
pgsql \
|
|
redis \
|
|
soap \
|
|
sockets \
|
|
xsl \
|
|
zip \
|
|
" \
|
|
&& case "$PHP_VERSION" in \
|
|
5.6.*) PHP_EXTENSIONS="$PHP_EXTENSIONS mcrypt mysql";; \
|
|
7.0.*|7.1.*) PHP_EXTENSIONS="$PHP_EXTENSIONS mcrypt";; \
|
|
esac \
|
|
# Install Imagick from master on PHP >= 8.3, because imagick 3.7.0 broke on latest PHP releases and Imagick maintainers don't care to tag a newer release
|
|
&& if [ $(php -r 'echo PHP_VERSION_ID;') -lt 80300 ]; then \
|
|
PHP_EXTENSIONS="$PHP_EXTENSIONS imagick"; \
|
|
else PHP_EXTENSIONS="$PHP_EXTENSIONS https://api.github.com/repos/Imagick/imagick/tarball/28f27044e435a2b203e32675e942eb8de620ee58"; \
|
|
fi \
|
|
&& install-php-extensions $PHP_EXTENSIONS \
|
|
&& if command -v a2enmod; then a2enmod rewrite; fi
|
|
|
|
# Install Composer.
|
|
ENV PATH=$PATH:/root/composer/vendor/bin \
|
|
COMPOSER_ALLOW_SUPERUSER=1 \
|
|
COMPOSER_HOME=/root/composer
|
|
RUN cd /opt \
|
|
# Download installer and check for its integrity.
|
|
&& curl -sSL https://getcomposer.org/installer > composer-setup.php \
|
|
&& curl -sSL https://composer.github.io/installer.sha384sum > composer-setup.sha384sum \
|
|
&& sha384sum --check composer-setup.sha384sum \
|
|
# Install Composer 2.
|
|
&& php composer-setup.php --install-dir=/usr/local/bin --filename=composer --2 \
|
|
# Remove installer files.
|
|
&& rm /opt/composer-setup.php /opt/composer-setup.sha384sum
|
|
|
|
RUN docker-php-source extract
|
|
RUN docker-php-ext-install pdo_mysql zip exif pcntl gd
|
|
RUN docker-php-ext-install mysqli && docker-php-ext-enable mysqli
|
|
RUN docker-php-ext-install gettext && docker-php-ext-enable gettext
|
|
RUN docker-php-ext-install sockets && docker-php-ext-enable sockets
|
|
|
|
RUN mkdir -p /opt && chmod 777 /opt
|
|
WORKDIR /opt
|
|
# Vastgezet op 5.0.5 (laatste 5.x-release): vanaf 6.0.0 vereist de library PHP >= 8.4,
|
|
# terwijl deze image op PHP 8.3 draait. Een ongepinde clone van master is bovendien
|
|
# een reproduceerbaarheids-/supply-chain-risico (build kan zonder waarschuwing breken).
|
|
RUN git clone --branch 5.0.5 --depth 1 https://github.com/chillerlan/php-qrcode.git \
|
|
&& chmod -R 777 ./php-qrcode
|
|
RUN cp ./php-qrcode/composer.json /var/www/html/composer.json
|
|
RUN mkdir -p /var/www/html/test && chmod 777 /var/www/html/test
|
|
RUN cp ./php-qrcode/examples/image.php /var/www/html/test/image.php
|
|
RUN cp -R ./php-qrcode/src /var/www/html/
|
|
|
|
WORKDIR /var/www/html
|
|
RUN composer update
|
|
COPY ./src ./
|
|
RUN chmod 755 *;
|
|
EXPOSE 80
|
|
CMD ["php", "-S", "0.0.0.0:80"]
|