fa/breadcrumb-the-shire
1
0
Fork 1
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity
456 Commits 1 Branch 0 Tags
61c1d18e95c0a421e8306572c65dab5d95d4e645
Commit Graph

5 Commits

Author SHA1 Message Date
fs
3053a77cde fix(security): prevent browser caching of dynamic pages 
Add Cache-Control: no-store to all PHP-rendered pages so the browser
never serves a stale admin/auth page from its back-forward cache.
Static assets (CSS, JS, images) keep their 30-day expiry unchanged.

Uses fastcgi_hide_header to suppress PHP's default Cache-Control
before setting the definitive header via Nginx.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-13 19:37:13 +01:00
fs
ad8f30cb09 feat(security): add Content-Security-Policy headers with strict script-src 
Eliminate all inline scripts to enable script-src 'self' without
'unsafe-inline', providing strong XSS mitigation via CSP.

Inline script removal:
- login.phtml: replace inline APP_ASSET_BASE with data-asset-base
  attribute + app-boot.js (matching default.phtml pattern)
- api-docs: extract SwaggerUI init to js/pages/admin-api-docs-index.js
- docs: extract checkbox enablement to js/pages/admin-docs-index.js
- language-switcher: replace onchange handler with data-auto-submit
  attribute + js/components/app-auto-submit.js event listener

CSP policy (dev + prod nginx):
  default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline';
  img-src 'self' data:; font-src 'self'; connect-src 'self';
  form-action 'self'; base-uri 'self'; frame-ancestors 'none';
  manifest-src 'self'

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-13 19:24:10 +01:00
fs
8f4dd5840d major update 2026-03-04 15:56:58 +01:00
fs
25370a1a55 add composer-unused, comprehensive docs, and project restructure 
- Add icanhazstring/composer-unused as dev dependency for dependency hygiene checks
- Add German documentation (docs/) covering architecture, conventions, workflows, and developer checklists
- Add API layer (ApiAuth, ApiBootstrap, ApiResponse), audit, scheduler, custom fields, and SSO services
- Add Microsoft OIDC SSO, API token management, and user lifecycle features
- Add swagger-ui vendor integration and OpenAPI spec
- Add production Docker setup and bin/ scripts
- Update composer dependencies, config, templates, and frontend assets throughout

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-02-22 15:27:35 +01:00
fs
cd59ccd99b baseline 2026-02-04 23:31:53 +01:00