Jared Vititoe
5b2a2c271e
- Add authentication failure logging to AuthMiddleware (session expiry, access denied, unauthenticated access attempts) - Add UrlHelper for secure URL generation with host validation against configurable ALLOWED_HOSTS whitelist - Add OutputHelper with consistent XSS-safe escaping functions (h, attr, json, url, css, truncate, date, cssClass) - Add validation to AuditLogModel query parameters (pagination limits, date format validation, action/entity type validation, IP sanitization) - Add APP_DOMAIN and ALLOWED_HOSTS configuration options Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
95 lines
3.4 KiB
PHP
95 lines
3.4 KiB
PHP
<?php
|
|
// Load environment variables
|
|
$envFile = __DIR__ . '/../.env';
|
|
if (!file_exists($envFile)) {
|
|
die('Configuration error: .env file not found. Copy .env.example to .env and configure your database settings.');
|
|
}
|
|
$envVars = parse_ini_file($envFile, false, INI_SCANNER_TYPED);
|
|
|
|
// Strip quotes from values if present (parse_ini_file may include them)
|
|
if ($envVars) {
|
|
foreach ($envVars as $key => $value) {
|
|
if (is_string($value)) {
|
|
if ((substr($value, 0, 1) === '"' && substr($value, -1) === '"') ||
|
|
(substr($value, 0, 1) === "'" && substr($value, -1) === "'")) {
|
|
$envVars[$key] = substr($value, 1, -1);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
// Global configuration
|
|
$GLOBALS['config'] = [
|
|
// Database settings
|
|
'DB_HOST' => $envVars['DB_HOST'] ?? 'localhost',
|
|
'DB_USER' => $envVars['DB_USER'] ?? 'root',
|
|
'DB_PASS' => $envVars['DB_PASS'] ?? '',
|
|
'DB_NAME' => $envVars['DB_NAME'] ?? 'tinkertickets',
|
|
|
|
// URL settings
|
|
'BASE_URL' => '', // Empty since we're serving from document root
|
|
'ASSETS_URL' => '/assets', // Assets URL
|
|
'API_URL' => '/api', // API URL
|
|
|
|
// Domain settings for external integrations (webhooks, links, etc.)
|
|
// Set APP_DOMAIN in .env to override
|
|
'APP_DOMAIN' => $envVars['APP_DOMAIN'] ?? null,
|
|
// Allowed hosts for HTTP_HOST validation (comma-separated in .env)
|
|
'ALLOWED_HOSTS' => array_filter(array_map('trim',
|
|
explode(',', $envVars['ALLOWED_HOSTS'] ?? 'localhost,127.0.0.1')
|
|
)),
|
|
|
|
// Session settings
|
|
'SESSION_TIMEOUT' => 3600, // 1 hour in seconds
|
|
'SESSION_REGENERATE_INTERVAL' => 300, // Regenerate session ID every 5 minutes
|
|
|
|
// CSRF settings
|
|
'CSRF_LIFETIME' => 3600, // 1 hour in seconds
|
|
|
|
// Pagination settings
|
|
'PAGINATION_DEFAULT' => 15, // Default items per page
|
|
'PAGINATION_MAX' => 100, // Maximum items per page
|
|
|
|
// File upload settings
|
|
'MAX_UPLOAD_SIZE' => 10485760, // 10MB in bytes
|
|
'ALLOWED_FILE_TYPES' => [
|
|
'image/jpeg',
|
|
'image/png',
|
|
'image/gif',
|
|
'image/webp',
|
|
'application/pdf',
|
|
'text/plain',
|
|
'text/csv',
|
|
'application/msword',
|
|
'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
|
|
'application/vnd.ms-excel',
|
|
'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
|
|
'application/zip',
|
|
'application/x-7z-compressed',
|
|
'application/x-tar',
|
|
'application/gzip'
|
|
],
|
|
'UPLOAD_DIR' => __DIR__ . '/../uploads',
|
|
|
|
// Rate limiting
|
|
'RATE_LIMIT_DEFAULT' => 100, // Requests per minute for general
|
|
'RATE_LIMIT_API' => 60, // Requests per minute for API
|
|
|
|
// Audit log settings
|
|
'AUDIT_LOG_RETENTION_DAYS' => 90,
|
|
|
|
// Timezone settings
|
|
// Default: America/New_York (EST/EDT)
|
|
// Common options: America/Chicago (CST), America/Denver (MST), America/Los_Angeles (PST), UTC
|
|
'TIMEZONE' => $envVars['TIMEZONE'] ?? 'America/New_York',
|
|
'TIMEZONE_OFFSET' => null // Will be calculated below
|
|
];
|
|
|
|
// Set PHP default timezone
|
|
date_default_timezone_set($GLOBALS['config']['TIMEZONE']);
|
|
|
|
// Calculate UTC offset for JavaScript (in minutes, negative for west of UTC)
|
|
$now = new DateTime('now', new DateTimeZone($GLOBALS['config']['TIMEZONE']));
|
|
$GLOBALS['config']['TIMEZONE_OFFSET'] = $now->getOffset() / 60; // Convert seconds to minutes
|
|
$GLOBALS['config']['TIMEZONE_ABBREV'] = $now->format('T'); // e.g., "EST", "EDT"
|
|
?>
|