mirror of
https://github.com/FOSSBilling/FOSSBilling.git
synced 2026-11-04 19:17:46 +09:00
Adam Daley
b491ecf4f3
Reject non-CLI access to cron.php before bootstrapping, and deny direct
access to non-entry-point PHP scripts and code directories in the DDEV
nginx config.
Ported from main commit ac97cf279 (#4348); the nginx block uses
0.8-next's 'return 403' style.
31 lines
1.2 KiB
PHP
31 lines
1.2 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use Symfony\Component\Filesystem\Path;
|
|
|
|
test('theme configuration directories are protected at any nesting depth', function (): void {
|
|
// Only the shipped Apache configuration is asserted here.
|
|
// .ddev/nginx/fossbilling-security.conf is dev-only and isn't copied into the CI test image.
|
|
$configuration = file_get_contents(Path::join(__DIR__, '..', '..', 'src/.htaccess'));
|
|
|
|
expect($configuration)->not->toBeFalse()
|
|
->and($configuration)->toContain('RewriteCond %{REQUEST_URI} ^/themes/(?:[^/]+/)+config/ [NC]');
|
|
});
|
|
|
|
test('cron entry point refuses non-CLI execution before bootstrapping', function (): void {
|
|
$cron = file_get_contents(Path::join(__DIR__, '..', '..', 'src/cron.php'));
|
|
|
|
expect($cron)->not->toBeFalse()
|
|
->and($cron)->toMatch(
|
|
"/if\s*\(\s*php_sapi_name\(\)\s*!==\s*'cli'\s*\)\s*\{\s*exit\s*\(/s"
|
|
);
|
|
|
|
$guardPosition = strpos((string) $cron, 'php_sapi_name()');
|
|
$bootstrapPosition = strpos((string) $cron, 'require_once __DIR__');
|
|
|
|
expect($guardPosition)->not->toBeFalse()
|
|
->and($bootstrapPosition)->not->toBeFalse()
|
|
->and($guardPosition)->toBeLessThan($bootstrapPosition);
|
|
});
|