mirror of
https://github.com/opensourcepos/opensourcepos.git
synced 2026-09-13 13:57:34 -04:00
objecttothis
61bb1a2c2a
* fix(auth): hash throttler keys to improve security - Use MD5 hashing for IP and username-based throttler keys to obfuscate sensitive data while maintaining functionality. * test(auth): add IPv6 throttling test and hash used throttler keys - Add a test to ensure throttling works correctly with IPv6 addresses. - Update throttler keys to use MD5 hashes for IPs and usernames for improved security and consistency. * fix(auth): handle non-scalar usernames in throttler keys - Ensure username input is validated as scalar before processing to prevent errors and maintain throttling logic integrity. * fix(auth): enhance throttler key security with HMAC hashing - Replace MD5 with HMAC-SHA256 for generating throttler keys. - Include encryption key from app configuration for added security. * test(filters): update ThrottleTest to use HMAC-SHA256 for throttler keys - Replace MD5 with HMAC-SHA256 for generating throttler keys in tests. - Introduce `check_encryption()` to ensure encryption configuration is available. * fix(events): validate encryption key on app initialization - Throw ConfigException if encryption key is missing or invalid during `pre_system` event. - Remove redundant `check_encryption()` call from Throttle filter and tests. * fix(events): improve encryption key validation in `pre_system` - Add `check_encryption()` helper call for additional security verification. - Update error message to highlight `.env` writability issues if the key is invalid. * test(filters): handle non-scalar usernames in ThrottleTest - Update `makeRequest` to validate usernames as scalar and cast them to strings before processing. - Add a test to ensure array usernames are ignored, and throttling is applied only based on IP. - Improve status code assertions for throttled requests. --------- Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com>
77 lines
2.5 KiB
PHP
77 lines
2.5 KiB
PHP
<?php
|
|
|
|
namespace Config;
|
|
|
|
use CodeIgniter\Events\Events;
|
|
use CodeIgniter\Exceptions\ConfigException;
|
|
use CodeIgniter\Exceptions\FrameworkException;
|
|
use CodeIgniter\HotReloader\HotReloader;
|
|
use App\Events\Db_log;
|
|
use App\Events\Load_config;
|
|
use App\Events\Method;
|
|
|
|
/*
|
|
* --------------------------------------------------------------------
|
|
* Application Events
|
|
* --------------------------------------------------------------------
|
|
* Events allow you to tap into the execution of the program without
|
|
* modifying or extending core files. This file provides a central
|
|
* location to define your events, though they can always be added
|
|
* at run-time, also, if needed.
|
|
*
|
|
* You create code that can execute by subscribing to events with
|
|
* the 'on()' method. This accepts any form of callable, including
|
|
* Closures, that will be executed when the event is triggered.
|
|
*
|
|
* Example:
|
|
* Events::on('create', [$myInstance, 'myMethod']);
|
|
*/
|
|
|
|
Events::on('pre_system', static function (): void {
|
|
if (ENVIRONMENT !== 'testing') {
|
|
helper('security');
|
|
check_encryption();
|
|
|
|
$encryptionKey = config('Encryption')->key;
|
|
if (empty($encryptionKey) || strlen($encryptionKey) < 64) {
|
|
throw new ConfigException('Encryption key could not be provisioned. Check that .env is writable.');
|
|
}
|
|
|
|
if (ini_get('zlib.output_compression')) {
|
|
throw FrameworkException::forEnabledZlibOutputCompression();
|
|
}
|
|
|
|
while (ob_get_level() > 0) {
|
|
ob_end_flush();
|
|
}
|
|
|
|
ob_start(static fn ($buffer) => $buffer);
|
|
}
|
|
|
|
/*
|
|
* --------------------------------------------------------------------
|
|
* Debug Toolbar Listeners.
|
|
* --------------------------------------------------------------------
|
|
* If you delete, they will no longer be collected.
|
|
*/
|
|
if (CI_DEBUG && ! is_cli()) {
|
|
Events::on('DBQuery', 'CodeIgniter\Debug\Toolbar\Collectors\Database::collect');
|
|
service('toolbar')->respond();
|
|
// Hot Reload route - for framework use on the hot reloader.
|
|
if (ENVIRONMENT === 'development') {
|
|
service('routes')->get('__hot-reload', static function (): void {
|
|
(new HotReloader())->run();
|
|
});
|
|
}
|
|
}
|
|
});
|
|
|
|
$config = new Load_config();
|
|
Events::on('post_controller_constructor', [$config, 'load_config']);
|
|
|
|
$db_log = new Db_log();
|
|
Events::on('DBQuery', [$db_log, 'db_log_queries']);
|
|
|
|
$method = new Method();
|
|
Events::on('pre_controller', [$method, 'validate_method']);
|