Thanakorn
ae98dcdcdd
- .htaccess: refuse .git, .env, docker, nodejs, sdlc*, scripts, archives and app internals; security headers, HSTS over TLS, optional HTTPS redirect - uploads served through app/file.php to signed-in users only - Apache/PHP hardening config for the container (ServerTokens, expose_php) - least-privilege DB account and APP_SECRET_KEY via docker/php/provision.php; SMTP passwords re-encrypted with a random IV (secret_box.php) - Socket.IO rooms from a PHP-signed token; /emit and cron refuse empty secrets - escape notification text; CLI guards on build scripts; no fixed demo password
12 lines
330 B
INI
12 lines
330 B
INI
; PHP hardening for the wms-app container.
|
|
expose_php = Off
|
|
display_errors = Off
|
|
display_startup_errors = Off
|
|
log_errors = On
|
|
|
|
; Session defaults; app/session.php sets the same per request (plus Secure over HTTPS).
|
|
session.use_strict_mode = 1
|
|
session.use_only_cookies = 1
|
|
session.cookie_httponly = 1
|
|
session.cookie_samesite = Lax
|