dillard
feb5380b28
Fixes critical pre-existing issues found during review: bulk_action.php had no auth check at all (unauthenticated download/delete of any qrcode) and built a table name from unwhitelisted user input (SQL injection); the QR generator classes wrote files from unvalidated filename/format, allowing path traversal and arbitrary file writes. Also pins chillerlan/php-qrcode to 5.0.5 since master now requires PHP 8.4, breaking the PHP 8.3 build. - CSRF tokens on all POST forms and the bulk_action.php JSON endpoint - Login rate limiting (5 attempts / 15 min) via new login_attempts table - Hardened sessions: httponly/samesite cookies, 30 min idle timeout, session regeneration on login - Forced password change for the default superadmin/superadmin account - Server-side validation in Users/DynamicQrcode/Qrcode classes - Audit log table for auth, user, and qrcode actions - Checked-in db schema (db/init.sql, migrations/) instead of relying on an opaque prebuilt db image - Production docker-compose with Nginx + php-fpm instead of the PHP dev server Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
15 lines
435 B
PHP
15 lines
435 B
PHP
<?php
|
|
/**
|
|
* Centrale bootstrap voor elke entrypoint: config laden, sessie starten met
|
|
* verharde instellingen, sessie-timeout en verplichte wachtwoordwijziging afdwingen.
|
|
*
|
|
* Vervangt de losse "session_start(); require_once 'config/config.php';" aanroepen.
|
|
*/
|
|
|
|
require_once __DIR__ . '/../config/config.php';
|
|
require_once __DIR__ . '/security.php';
|
|
|
|
qr_session_start();
|
|
qr_enforce_session_timeout();
|
|
qr_enforce_password_change();
|