FOSSBilling

admin/FOSSBilling

0 Fork 0

mirror of https://github.com/FOSSBilling/FOSSBilling.git synced 2026-11-04 11:07:37 +09:00

Commit Graph

Author SHA1 Message Date

Author	SHA1	Message	Date
Adam Daley	b491ecf4f3	Make cron CLI-only and deny non-entry PHP in DDEV nginx Reject non-CLI access to cron.php before bootstrapping, and deny direct access to non-entry-point PHP scripts and code directories in the DDEV nginx config. Ported from main commit `ac97cf279` (#4348); the nginx block uses 0.8-next's 'return 403' style.	2026-09-19 10:38:47 +01:00
Adam Daley	cc73a0298a	Protect nested theme configuration directories (#4346 ) * 🔒 Protect nested theme configuration directories * Fix WebServerSecurityConfigTest to only assert shipped Apache config The Nginx dataset read .ddev/nginx/fossbilling-security.conf, which is dev-only and isn't copied into the CI Docker test image (Dockerfile test stage only copies src, tests, and composer/phpunit configs, and .ddev is also dockerignored). file_get_contents returned false there, failing the Nginx case. Keep the .ddev hardening in place, but only test src/.htaccess. (cherry picked from commit `352a597b22`)	2026-09-19 10:05:02 +01:00

Adam Daley

b491ecf4f3

Make cron CLI-only and deny non-entry PHP in DDEV nginx

Reject non-CLI access to cron.php before bootstrapping, and deny direct
access to non-entry-point PHP scripts and code directories in the DDEV
nginx config.

Ported from main commit ac97cf279 (#4348); the nginx block uses
0.8-next's 'return 403' style.

2026-09-19 10:38:47 +01:00

Adam Daley

cc73a0298a

Protect nested theme configuration directories (#4346 )

* 🔒 Protect nested theme configuration directories

* Fix WebServerSecurityConfigTest to only assert shipped Apache config

The Nginx dataset read .ddev/nginx/fossbilling-security.conf, which is
dev-only and isn't copied into the CI Docker test image (Dockerfile test
stage only copies src, tests, and composer/phpunit configs, and .ddev is
also dockerignored). file_get_contents returned false there, failing the
Nginx case. Keep the .ddev hardening in place, but only test src/.htaccess.

(cherry picked from commit 352a597b22)

2026-09-19 10:05:02 +01:00