tbh/breadcrumb-the-shire
1
0
Fork 0
forked from fa/breadcrumb-the-shire
Code Pull Requests Activity
Files
22966fdacfa2dbedcfdd3f62c161bef38aaeebbc
breadcrumb-the-shire/docker/php/php.ini

24 lines
611 B
INI
Raw Normal View History

fix(security): harden PHP configuration for dev and production Apply consistent security settings to both environments so issues surface early in development rather than first appearing in prod. Both environments: - expose_php=Off — hide PHP version from X-Powered-By - allow_url_include=Off — prevent remote file inclusion - open_basedir=/var/www:/tmp — restrict filesystem access - disable_functions — block shell execution functions unused by the app - Session: strict_mode, httponly, samesite=Lax, use_only_cookies Production additionally: - display_errors=0, log_errors=1 - session.cookie_secure=1 (HTTPS-only) Removed deprecated sid_length/sid_bits_per_character (PHP 8.5+). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-13 19:58:23 +01:00
; --- Error handling (verbose for development) ---
baseline
2026-02-04 23:31:53 +01:00
display_errors=1
display_startup_errors=1
change php ini
2026-03-22 12:42:00 +01:00
error_reporting=E_ALL & ~E_DEPRECATED
fix(security): harden PHP configuration for dev and production Apply consistent security settings to both environments so issues surface early in development rather than first appearing in prod. Both environments: - expose_php=Off — hide PHP version from X-Powered-By - allow_url_include=Off — prevent remote file inclusion - open_basedir=/var/www:/tmp — restrict filesystem access - disable_functions — block shell execution functions unused by the app - Session: strict_mode, httponly, samesite=Lax, use_only_cookies Production additionally: - display_errors=0, log_errors=1 - session.cookie_secure=1 (HTTPS-only) Removed deprecated sid_length/sid_bits_per_character (PHP 8.5+). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-13 19:58:23 +01:00
log_errors=1
; --- Resource limits ---
fix: resolve all quality gate failures — i18n key, typography tokens, PHPStan errors, style - Add missing i18n key "LDAP attribute map could not be encoded" (de+en) - Replace raw font-weight/line-height with design tokens in app-topbar.css - Fix import ordering in SchedulerRunService.php (php-cs-fixer) - Fix PHPStan mock chain errors in DebitorDetailServiceTest and TenantSsoServiceTest (PHPUnit 12 API) - Simplify redundant comparison in NotificationService dedupe window - Add PHPStan type hint for mock callback array in SchedulerJobFailedNotificationListenerTest - Fix undefined variable and add flow-analysis suppression in login().php - Increase dev PHP memory_limit to 1G for PHPStan (prod stays 256M) All 6 quality gates now pass: QG-001 (1618 tests), QG-002 (0 errors), QG-003 (6630 assertions), QG-006 (0 fixable), QG-008, QG-009. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-13 19:06:12 +02:00
memory_limit=1G
add composer-unused, comprehensive docs, and project restructure - Add icanhazstring/composer-unused as dev dependency for dependency hygiene checks - Add German documentation (docs/) covering architecture, conventions, workflows, and developer checklists - Add API layer (ApiAuth, ApiBootstrap, ApiResponse), audit, scheduler, custom fields, and SSO services - Add Microsoft OIDC SSO, API token management, and user lifecycle features - Add swagger-ui vendor integration and OpenAPI spec - Add production Docker setup and bin/ scripts - Update composer dependencies, config, templates, and frontend assets throughout Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-02-22 15:27:35 +01:00
upload_max_filesize=10M
post_max_size=12M
fix(security): harden PHP configuration for dev and production Apply consistent security settings to both environments so issues surface early in development rather than first appearing in prod. Both environments: - expose_php=Off — hide PHP version from X-Powered-By - allow_url_include=Off — prevent remote file inclusion - open_basedir=/var/www:/tmp — restrict filesystem access - disable_functions — block shell execution functions unused by the app - Session: strict_mode, httponly, samesite=Lax, use_only_cookies Production additionally: - display_errors=0, log_errors=1 - session.cookie_secure=1 (HTTPS-only) Removed deprecated sid_length/sid_bits_per_character (PHP 8.5+). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-13 19:58:23 +01:00
; --- Security hardening (match prod to catch issues early) ---
expose_php=Off
allow_url_include=Off
open_basedir=/var/www:/tmp
disable_functions=exec,passthru,shell_exec,system,proc_open,popen,parse_ini_file,show_source
; --- Session hardening ---
session.use_strict_mode=1
session.cookie_httponly=1
session.cookie_samesite=Lax
session.use_only_cookies=1
session.use_trans_sid=0
Copy Permalink