mirror of
https://github.com/opensourcepos/opensourcepos.git
synced 2026-04-19 06:18:22 -04:00
e70395bb85
* Fix: Improve allowedHostnames .env configuration and fail-fast in production Addresses GitHub issue #4480: .env app.allowedHostnames does not work as intended ## Problem - CodeIgniter 4 cannot override array properties from .env - Setting app.allowedHostnames.0, app.allowedHostnames.1 did NOT populate the array - Application always fell back to 'localhost' silently in production - Host header injection protection was effectively disabled ## Solution 1. Support comma-separated .env values: app.allowedHostnames = 'domain1.com,domain2.com' 2. Fail explicitly in production if not configured (throws RuntimeException) 3. Allow localhost fallback in development/testing with ERROR-level logging 4. Update documentation with clear setup instructions ## Changes - app/Config/App.php: Parse comma-separated .env values, fail in production - .env.example: Update format documentation - INSTALL.md: Add prominent security section - tests/Config/AppTest.php: Comprehensive tests for new behavior Fixes #4480 Related: GHSA-jchf-7hr6-h4f3 --------- Co-authored-by: Ollama <ollama@steganos.dev>
82 lines
3.0 KiB
Plaintext
82 lines
3.0 KiB
Plaintext
#--------------------------------------------------------------------
|
|
# ENVIRONMENT
|
|
#--------------------------------------------------------------------
|
|
|
|
CI_ENVIRONMENT = production
|
|
|
|
#--------------------------------------------------------------------
|
|
# SECURITY: ALLOWED HOSTNAMES
|
|
#--------------------------------------------------------------------
|
|
# CRITICAL: Whitelist of allowed hostnames to prevent Host Header
|
|
# Injection attacks (GHSA-jchf-7hr6-h4f3).
|
|
#
|
|
# REQUIRED IN PRODUCTION: Application will fail to start if not configured.
|
|
# In development, falls back to 'localhost' with an error log.
|
|
#
|
|
# Configure with comma-separated list of domains/subdomains:
|
|
# app.allowedHostnames = 'yourdomain.com,www.yourdomain.com'
|
|
#
|
|
# For local development:
|
|
# app.allowedHostnames = 'localhost'
|
|
#
|
|
# Note: Do not include protocol (http/https) or port numbers.
|
|
app.allowedHostnames = ''
|
|
|
|
#--------------------------------------------------------------------
|
|
# DATABASE
|
|
#--------------------------------------------------------------------
|
|
|
|
database.default.hostname = 'localhost'
|
|
database.default.database = 'ospos'
|
|
database.default.username = 'admin'
|
|
database.default.password = 'pointofsale'
|
|
database.default.DBDriver = 'MySQLi'
|
|
database.default.DBPrefix = 'ospos_'
|
|
|
|
database.development.hostname = 'localhost'
|
|
database.development.database = 'ospos'
|
|
database.development.username = 'admin'
|
|
database.development.password = 'pointofsale'
|
|
database.development.DBDriver = 'MySQLi'
|
|
database.development.DBPrefix = 'ospos_'
|
|
|
|
database.tests.hostname = 'localhost'
|
|
database.tests.database = 'ospos'
|
|
database.tests.username = 'admin'
|
|
database.tests.password = 'pointofsale'
|
|
database.tests.DBDriver = 'MySQLi'
|
|
database.tests.DBPrefix = 'ospos_'
|
|
|
|
#--------------------------------------------------------------------
|
|
# ENCRYPTION
|
|
#--------------------------------------------------------------------
|
|
|
|
encryption.key = ''
|
|
|
|
#--------------------------------------------------------------------
|
|
# LOGGER
|
|
# - 0 = Disables logging, Error logging TURNED OFF
|
|
# - 1 = Emergency Messages - System is unusable
|
|
# - 2 = Alert Messages - Action Must Be Taken Immediately
|
|
# - 3 = Critical Messages - Application component unavailable, unexpected exception.
|
|
# - 4 = Runtime Errors - Don't need immediate action, but should be monitored.
|
|
# - 5 = Warnings - Exceptional occurrences that are not errors.
|
|
# - 6 = Notices - Normal but significant events.
|
|
# - 7 = Info - Interesting events, like user logging in, etc.
|
|
# - 8 = Debug - Detailed debug information.
|
|
# - 9 = All Messages
|
|
#--------------------------------------------------------------------
|
|
|
|
logger.threshold = 0
|
|
app.db_log_enabled = false
|
|
|
|
#--------------------------------------------------------------------
|
|
# HONEYPOT
|
|
#--------------------------------------------------------------------
|
|
|
|
honeypot.hidden = true
|
|
honeypot.label = 'Fill This Field'
|
|
honeypot.name = 'honeypot'
|
|
honeypot.template = '<label>{label}</label><input type="text" name="{name}" value="">'
|
|
honeypot.container = '<div style="display:none">{template}</div>'
|