3 Commits

Include renames

Author	SHA1	Message	Date
3 people	b9ad77ba07	fix(security): report unwritable .env.lock, make throttle limits configurable (#4714) ... * fix(security): report unwritable .env.lock, make throttle limits configurable envFileIsWritable() previously checked is_writable(.env) (the file), which passes in Docker even when the mutex file is root-owned by a prior env:provision run. It now checks the real write path: the directory (to create .env.tmp.* + .env.lock) and any existing .env.lock must be writable, so the app throws the clear 'run env:provision' error instead of crashing on 'Unable to open .env.lock'. The Throttle filter now reads throttle.capacity / throttle.seconds from env (default 5 per 60s); capacity <= 0 disables throttling, so operators serving sequential HTTP clients (e.g. Zabbix) are not caught by the lockout. * fix(security): address CodeRabbit review findings - Throttle: validate throttle.capacity as an integer before treating a non-positive value as 'disabled', so a non-numeric value (e.g. 'five') falls back to the default instead of silently bypassing the lockout. Apply the same validation to throttle.seconds. - envFileIsWritable(): also reject an existing non-writable .env on Windows (where rename() cannot replace a read-only destination); keep the check Windows-only since POSIX rename() replaces a read-only dest when the directory is writable. - Tests: restore the prior throttle.capacity env state in ThrottleTest (capture/restore instead of delete); add an invalid-capacity fallback case; skip the not-writable fixtures when running as root (where is_writable() is bypassed). * fix(migration): guard ConvertToCI4 key-write branches with envFileIsWritable() The migration's 'no key' and 'CI3 key' branches called rotateEncryptionKey()/rotateEncryptionKeyTransaction() directly, bypassing the envFileIsWritable() guard that checkEncryption() uses. On a fresh Docker/Compose install where the web runtime cannot write /app/.env.lock, this produced a raw 'fopen(/app/.env.lock): Permission denied' error instead of the actionable 'run php spark env:provision' message. A valid CI4 key now short-circuits to checkEncryption() (no write); every write branch is gated on envFileIsWritable() first. * fix: read provisioned encryption.key so config sees it env:provision persists the key as 'encryption.key' in .env (matching the throttle path and .env.example), but Config\Encryption only read the ENCRYPTION_KEY env var. On a fresh Docker instance the provisioned key was invisible to config('Encryption')->key, so the app believed no key existed and tried to write one -- hitting the .env.lock permission wall. Read encryption.key (via $_SERVER/$_ENV/getenv) first, then fall back to ENCRYPTION_KEY for Docker '-e' usage. Mirrors checkThrottleEncryption(). * fix: cascade encryption.key lookup past empty-string sources * refactor: extract Encryption::resolveKey() and test it without global env mutation * fix(security): decode fallback-selected encryption key like BaseConfig A key picked in the constructor fallback (notably ENCRYPTION_KEY, which BaseConfig never inspects) was assigned verbatim, bypassing the hex2bin:/base64: decode the parent applies to `encryption.key`. Route the selected key through a parseKey() helper mirroring BaseConfig's parseEncryptionKey() so prefixed values decrypt consistently, and add a pure regression test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: remove advisory ID from comments and tighten verbose comments Per review: treat GHSA advisory IDs like secrets (drop from code) and replace the multi-paragraph comments with concise one-liners that keep the non-obvious "why". No logic changes. --------- Co-authored-by: objecttothis <17935339+objecttothis@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-09-30 15:50:11 +02:00
objecttothis	61bb1a2c2a	hotfix(auth): hash throttler keys to improve security (#4646) ... * fix(auth): hash throttler keys to improve security - Use MD5 hashing for IP and username-based throttler keys to obfuscate sensitive data while maintaining functionality. * test(auth): add IPv6 throttling test and hash used throttler keys - Add a test to ensure throttling works correctly with IPv6 addresses. - Update throttler keys to use MD5 hashes for IPs and usernames for improved security and consistency. * fix(auth): handle non-scalar usernames in throttler keys - Ensure username input is validated as scalar before processing to prevent errors and maintain throttling logic integrity. * fix(auth): enhance throttler key security with HMAC hashing - Replace MD5 with HMAC-SHA256 for generating throttler keys. - Include encryption key from app configuration for added security. * test(filters): update ThrottleTest to use HMAC-SHA256 for throttler keys - Replace MD5 with HMAC-SHA256 for generating throttler keys in tests. - Introduce `check_encryption()` to ensure encryption configuration is available. * fix(events): validate encryption key on app initialization - Throw ConfigException if encryption key is missing or invalid during `pre_system` event. - Remove redundant `check_encryption()` call from Throttle filter and tests. * fix(events): improve encryption key validation in `pre_system` - Add `check_encryption()` helper call for additional security verification. - Update error message to highlight `.env` writability issues if the key is invalid. * test(filters): handle non-scalar usernames in ThrottleTest - Update `makeRequest` to validate usernames as scalar and cast them to strings before processing. - Add a test to ensure array usernames are ignored, and throttling is applied only based on IP. - Improve status code assertions for throttled requests. --------- Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com>	2026-08-20 02:27:13 +04:00
objecttothis	a2b91493c7	Feature: CodeIgniter Throttler (#4619) ... * fix(auth): throttle login attempts to prevent brute-force attacks Add Throttle filter and wire into login route to mitigate credential-stuffing/brute-force risk (redacted). - Register App\\Filters\\Throttle in Filters config - Add \"too_many_attempts\" language string for throttled responses - Add tests for Throttle filter and Login controller throttling * Correct bug causing error to not display. * i18n(login): add too_many_attempts translation for login throttling Add localized \"too many attempts\" message across all language files to support login throttling feature. Message informs users to wait before retrying after exceeding attempt limit. * fix(auth): rate limit login attempts to prevent brute-force attacks Add Throttle filter that rate limits login/migrate POST requests, keyed by IP and submitted username, using CodeIgniter's cache-based Throttler (redacted). - Wire filter into login/migrate routes - Show localized error message when rate limit exceeded - Broaden writable/cache ignore pattern to cover throttler cache file * Update app/Language/ar-EG/Login.php Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * style(i18n): use single quotes for translation array keys and values Convert double-quoted array keys and string values to single quotes across all Login.php language files for style consistency. * test(auth): update LoginTest to use throttler service directly Replace clearThrottleState's Services::resetSingle('throttler') call with Services::throttler() to reset state via the service instance. Add usedKeys property to track throttle keys used across test cases. * test(auth): skip login test assertion when migration required LoginTest now check migration-required response state before asserting HTTP 200. Prevent false failures when app force pending-migration redirect during test run. * Added missing return statements	2026-08-19 00:25:22 +04:00