lyra
d2eb914637
Security:
- Add SecurityHeadersListener (X-Content-Type-Options, X-Frame-Options,
CSP, Referrer-Policy, HSTS)
- Replace document.write() with document.documentElement.innerHTML
in login JS to avoid CSP violations
- Add CSS escaping (|e('css')) to env color values in _style.html.twig
- Document CSRF protection model: nonce serves as CSRF token for POST
form path (single-use, server-generated, 120s TTL)
- Reduce TOTP verification window from 10 periods (±5 min) to 1 (±30s)
- Remove hardcoded APP_SECRET from bin/franken.sh (now uses env or
generates random)
- Remove backup code values from debug log output
- Add .env to .gitignore
Bug fixes:
- Fix ->json access on possibly-null in LoginListener
(uses null-safe operator ?->)
- Fix validReturn() not checking false from parse_url (could cause
TypeError on malformed URLs)
- Add isHit() race condition check in AcceptListener and AllowListener
- Add try/finally in Kernel::terminate() so parent::terminate() always
runs even if persist() throws
- Add input validation to GenerateBackupCodesCommand (reject count < 1)
- Use Response::HTTP_INTERNAL_SERVER_ERROR constant in GetTotpTrait
instead of literal 500
Docker/CI:
- Explicitly install curl in Docker final image (needed for healthcheck)
- Update workflow tag pattern to v*.*.* (standardize on v-prefix)
- Extract version without v-prefix for Docker image tag
- Remove stale develop branch from CI triggers
- Fix publish.yaml git remote add to use set-url on re-runs
Code quality:
- Add declare(strict_types=1) to all interface files
- Add #[AsCommand] attribute to GenerateBackupCodesCommand
- Fix BackupCodeInterface default count to match implementation (10)
- Lowercase host before TLD lookup in DomainManager
- Expand TLD list with many missing multi-part TLDs (.com.au, .co.jp,
.com.br, .co.kr, .com.tw, .co.za, etc.) to prevent open redirect
vulnerabilities
- Disable unused Symfony sessions in framework.yaml
Tests:
- Update DomainManagerTest for corrected TLD parsing (.com.au, .co.jp,
.com.br now correctly recognized as multi-part)
- Update GetTotpTraitTest for corrected error message
- Update GenerateBackupCodesCommandTest: zero count now throws exception
73 lines
1.9 KiB
Docker
73 lines
1.9 KiB
Docker
# use build image, to simplify final image
|
|
FROM php:8.5-trixie AS build
|
|
|
|
# install APCu and composer
|
|
RUN pecl install apcu && \
|
|
docker-php-ext-enable apcu
|
|
COPY --from=composer /usr/bin/composer /usr/bin/composer
|
|
RUN apt-get update && \
|
|
apt-get install -y unzip git
|
|
|
|
# symfony required environment variables
|
|
ENV APP_DEBUG=0
|
|
ENV APP_ENV=prod
|
|
ENV APP_SHARE_DIR=/data/preauth
|
|
|
|
# load application into build image
|
|
RUN mkdir -p /data/preauth
|
|
RUN mkdir -p /app/bin
|
|
WORKDIR /app
|
|
COPY ./bin/console /app/bin/console
|
|
COPY ./config /app/config
|
|
COPY ./public /app/public
|
|
COPY ./src /app/src
|
|
COPY ./templates /app/templates
|
|
COPY ./composer.json /app/composer.json
|
|
COPY ./composer.lock /app/composer.lock
|
|
COPY ./symfony.lock /app/symfony.lock
|
|
|
|
# install application dependencies
|
|
RUN composer install --no-dev --optimize-autoloader
|
|
RUN composer dump-env prod --empty
|
|
|
|
# start creating final image
|
|
FROM dunglas/frankenphp:php8.5-trixie
|
|
|
|
# install APCu and curl (needed for healthcheck)
|
|
RUN pecl install apcu && \
|
|
docker-php-ext-enable apcu
|
|
RUN apt-get update && \
|
|
apt-get install -y --no-install-recommends curl && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
# symfony required environment variables
|
|
ENV APP_DEBUG=0
|
|
ENV APP_ENV=prod
|
|
ENV APP_SHARE_DIR=/data/preauth
|
|
|
|
# load application into final image
|
|
WORKDIR /app
|
|
COPY --from=build /data/preauth /data/preauth
|
|
COPY --from=build /app /app
|
|
|
|
# configure container
|
|
COPY ./Caddyfile /etc/frankenphp/Caddyfile
|
|
RUN cp $PHP_INI_DIR/php.ini-production $PHP_INI_DIR/php.ini
|
|
RUN echo 'expose_php = off' > $PHP_INI_DIR/conf.d/restrict.ini
|
|
# console needs apc to manage cache
|
|
RUN echo 'apc.enable_cli = on' > $PHP_INI_DIR/conf.d/console.ini
|
|
|
|
# app uses var folder for cache storage
|
|
VOLUME ["/config", "/data"]
|
|
|
|
# runs http on standard port
|
|
EXPOSE 80
|
|
|
|
# healthcheck
|
|
HEALTHCHECK --interval=5m \
|
|
--retries=3 \
|
|
--start-interval=1s \
|
|
--start-period=10s \
|
|
--timeout=2s \
|
|
CMD curl http://localhost || exit 1
|