mirror of
https://github.com/myronblair/tomsjavajive
synced 2026-07-28 09:12:36 -05:00
myron
186ac0cb6d
- admin/api/upload-splash.php had NO admin-auth check (included the public customer header, not admin/includes/header.php) and both upload endpoints trusted the client-supplied MIME type and filename extension, so an attacker could name a file "shell.php", spoof Content-Type: image/png, and get PHP written into a web-reachable uploads/ directory. Added AdminAuth check and centralized real-content validation (getimagesize + server-side extension mapping) in a new handleImageUpload() helper used by both admin/upload-image.php and admin/api/upload-splash.php. - Removed CURLOPT_SSL_VERIFYPEER => false from the CyberMail email calls in includes/email.php and includes/functions.php (MITM risk on the API key). Rewrote functions.php's sendEmail() as a thin wrapper around Email::send() so there's one implementation instead of two that could drift (this is what had the second copy of the TLS bypass). - Escaped customer-controlled fields (customer_name, tracking info, reset URL) before interpolating into outbound HTML emails — name is free text from registration/checkout with no length/char restriction, so it was stored-HTML-injectable into every transactional email. - Fixed api/redeem-gift-card.php referencing a nonexistent `balance` column on gift_cards (actual column is current_balance) — gift card redemption was completely broken, always returning "no remaining balance". - Fixed api/submit-review.php inserting into nonexistent `content`/`status` columns on reviews (actual columns are `comment`/`is_approved`) — review submission was crashing on every request. - Hardened .htaccess: block /db/*, /.git/*, and *.sql. Live site currently serves db/schema.sql and the full .git directory (including .git/config, which contains a GitHub PAT with push access) over HTTP — the existing config/includes RedirectMatch rules are also not being enforced live, see report for details; this needs a server-level fix too. - Cleaned up README's leftover install instructions pointing at a deleted create-admin.php with a documented default password. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
95 lines
3.0 KiB
ApacheConf
95 lines
3.0 KiB
ApacheConf
# Tom's Java Jive - Apache Configuration
|
|
|
|
# Enable URL rewriting
|
|
RewriteEngine On
|
|
|
|
# Force HTTPS (uncomment in production)
|
|
RewriteCond %{HTTPS} off
|
|
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
|
|
|
|
# Remove trailing slashes
|
|
RewriteCond %{REQUEST_FILENAME} !-d
|
|
RewriteCond %{REQUEST_URI} (.+)/$
|
|
RewriteRule ^ %1 [L,R=301]
|
|
|
|
# Protect sensitive directories
|
|
RedirectMatch 403 /config/.*$
|
|
RedirectMatch 403 /includes/.*\.php$
|
|
RedirectMatch 403 /install/.*$
|
|
RedirectMatch 403 /db/.*$
|
|
|
|
# Block .git (full source + commit history, including any credentials ever
|
|
# committed to it) from ever being served. NOTE: on the live server this
|
|
# repo's .git directory lives inside the docroot itself (deployed via
|
|
# `git clone` directly into public_html) and was confirmed reachable over
|
|
# HTTP (.git/config, .git/logs/HEAD, etc. all returned real content) even
|
|
# though the RedirectMatch rules above were also confirmed NOT blocking
|
|
# /config/*.php or /includes/*.php live — meaning .htaccess directives are
|
|
# not being fully honored by the current web server. This needs a server
|
|
# config fix (vhost-level deny, or moving .git outside the docroot) in
|
|
# addition to this file — see review notes.
|
|
RedirectMatch 403 /\.git/.*$
|
|
RedirectMatch 403 /\.git$
|
|
|
|
<FilesMatch "\.sql$">
|
|
<IfModule mod_authz_core.c>
|
|
Require all denied
|
|
</IfModule>
|
|
<IfModule !mod_authz_core.c>
|
|
Order allow,deny
|
|
Deny from all
|
|
</IfModule>
|
|
</FilesMatch>
|
|
|
|
# Set default charset
|
|
AddDefaultCharset UTF-8
|
|
|
|
# Disable directory listing
|
|
Options -Indexes
|
|
|
|
# Set timezone (optional)
|
|
# php_value date.timezone "America/New_York"
|
|
|
|
# Increase upload limits (adjust as needed)
|
|
php_value upload_max_filesize 10M
|
|
php_value post_max_size 10M
|
|
|
|
# Enable compression (optional)
|
|
<IfModule mod_deflate.c>
|
|
AddOutputFilterByType DEFLATE text/html text/plain text/css text/javascript application/javascript application/json
|
|
</IfModule>
|
|
|
|
# Browser caching (optional)
|
|
<IfModule mod_expires.c>
|
|
ExpiresActive On
|
|
ExpiresByType image/jpg "access plus 1 year"
|
|
ExpiresByType image/jpeg "access plus 1 year"
|
|
ExpiresByType image/png "access plus 1 year"
|
|
ExpiresByType image/webp "access plus 1 year"
|
|
ExpiresByType text/css "access plus 1 month"
|
|
ExpiresByType application/javascript "access plus 1 month"
|
|
</IfModule>
|
|
|
|
# Security headers
|
|
<IfModule mod_headers.c>
|
|
Header set X-Content-Type-Options "nosniff"
|
|
Header set X-Frame-Options "SAMEORIGIN"
|
|
Header set X-XSS-Protection "1; mode=block"
|
|
</IfModule>
|
|
|
|
# Custom error pages (optional)
|
|
# ErrorDocument 404 /404.php
|
|
# ErrorDocument 500 /500.php
|
|
# SEO ADDITIONS
|
|
RewriteCond %{HTTP_HOST} ^www\.tomsjavajive\.com [NC]
|
|
RewriteRule ^(.*)$ https://tomsjavajive.com/$1 [R=301,L]
|
|
<IfModule mod_expires.c>
|
|
ExpiresActive On
|
|
ExpiresByType image/jpg "access plus 1 year"
|
|
ExpiresByType image/jpeg "access plus 1 year"
|
|
ExpiresByType image/png "access plus 1 year"
|
|
ExpiresByType image/webp "access plus 1 year"
|
|
ExpiresByType text/css "access plus 1 month"
|
|
ExpiresByType application/javascript "access plus 1 month"
|
|
</IfModule>
|