Empêcher l’exposition des sources PHP

conf/nginx.conf

@@ -1,9 +1,17 @@
+location = __PATH__/index.php {
+    include fastcgi_params;
+    fastcgi_param SCRIPT_FILENAME __INSTALL_DIR__/public/index.php;
+    fastcgi_param HTTP_PROXY "";
+    fastcgi_pass unix:/var/run/php/php__PHP_VERSION__-fpm-__APP__.sock;
+}
+
 location __PATH__/ {
     alias __INSTALL_DIR__/public/;
     index index.php;
     client_max_body_size 260M;
     try_files $uri $uri/ @__APP__;
     location ~ /\. { deny all; }
+    location ~ \.php$ { return 404; }
 }
 
 location @__APP__ {

manifest.toml

@@ -5,7 +5,7 @@ id = "globinours"
 name = "Globinours"
 description.en = "Lightweight animal shelter management"
 description.fr = "Gestion légère et complète pour refuges animaliers"
-version = "1.0.0-rc.3~ynh8"
+version = "1.0.0-rc.3~ynh9"
 maintainers = ["OverSu"]
 
 [upstream]

scripts/_common.sh

@@ -26,6 +26,8 @@ prepare_persistent_paths() {
     chown -R "$app:$app" "$data_dir"
     chmod -R u=rwX,g=rX,o= "$install_dir"
     chmod -R u=rwX,g=,o= "$data_dir"
+    chown "$app:www-data" "$data_dir"
+    chmod 0710 "$data_dir"
     chown -R "$app:www-data" "$data_dir/media"
     chmod -R u=rwX,g=rX,o= "$data_dir/media"
 }