oversu/Globinours
oversu/Globinours
Watch
1
0
Fork
You've already forked Globinours
 0
Code Issues 2 Pull requests Projects Releases 13 Packages Wiki Activity

fix: fiabiliser les portées et médias publics

Browse source
This commit is contained in:
Alexandre NOEL 2026-09-15 18:39:00 +02:00
commit 4493357590
11 changed files with 121 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

25
app/Services/SecurityService.php
View file

@ -24,13 +24,12 @@ final class SecurityService
public static function hardenRuntimeFiles(): void
{
$root = dirname(__DIR__, 2);
$marker = $root . '/storage/.security-hardened';
$marker = $root . '/storage/.security-hardened-v2';
if (is_file($marker) && filemtime($marker) > time() - 86400) {
return;
}
foreach (
[
$root . '/data',
$root . '/storage',
$root . '/data/private-media',
$root . '/data/medical-documents',
@ -45,6 +44,13 @@ final class SecurityService
@chmod($dir, 0700);
}
}
// `public/media` may be a symlink into `data` (notably on YunoHost).
// Keep the data root traversable without making its private contents
// listable, then restore web-safe permissions only below public media.
if (is_dir($root . '/data')) {
@chmod($root . '/data', 0710);
}
self::hardenPublicTree($root . '/public/media');
foreach (
[
$root . '/.env',
@ -94,4 +100,19 @@ final class SecurityService
@chmod($item->getPathname(), $item->isDir() ? 0700 : 0600);
}
}
private static function hardenPublicTree(string $path): void
{
if (!is_dir($path)) {
return;
}
@chmod($path, 0755);
$it = new RecursiveIteratorIterator(
new RecursiveDirectoryIterator($path, FilesystemIterator::SKIP_DOTS),
RecursiveIteratorIterator::SELF_FIRST,
);
foreach ($it as $item) {
@chmod($item->getPathname(), $item->isDir() ? 0755 : 0644);
}
}
}