jaredandClaude Opus 4.8
b2c19745eb
Lint / PHP (phpcs PSR-12) (push) Successful in 20s
Lint / JS (eslint) (push) Successful in 11s
Lint / PHP requirements (version + extensions) (push) Successful in 52s
Security / PHP Security (semgrep) (push) Successful in 2m6s
Lint / Deploy (push) Successful in 13s
Lint / Notify on failure (push) Has been skipped
Trusted-proxy hardening (defense-in-depth for Authelia forward-auth): - AuthMiddleware now only honors Remote-* identity headers when REMOTE_ADDR is in a configured TRUSTED_PROXIES allowlist; otherwise it refuses with 403 and logs an 'untrusted_proxy' security event. Previously anything that could reach PHP directly could spoof Remote-User/Remote-Groups and log in as admin. - New config TRUSTED_PROXIES (comma-separated, from .env). Empty = enforcement off, so this is backward compatible until the allowlist is set on a host. Requirements checks (so a PHP upgrade dropping an extension can't silently break features like avatars again): - config/requirements.php: single source of truth for min PHP version and required extensions (ldap, mysqli, curl, mbstring, fileinfo, json). - scripts/check_requirements.php: CI script that fails the build if the environment doesn't satisfy them. - New 'requirements' CI job installs those extensions and runs the check; deploy now depends on it. - api/health.php: adds php_extensions + php_version checks so production monitoring surfaces the drift (returns 503 if a required extension is gone). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
29 lines
1.0 KiB
PHP
29 lines
1.0 KiB
PHP
<?php
|
|
|
|
/**
|
|
* Runtime requirements — single source of truth.
|
|
*
|
|
* Consumed by:
|
|
* - scripts/check_requirements.php (CI: fails the build if unmet)
|
|
* - api/health.php (production: surfaces drift to monitoring)
|
|
*
|
|
* This exists because a PHP upgrade once silently dropped the ldap extension,
|
|
* which broke avatars with no visible error. Keep this list in sync with the
|
|
* extensions the code actually relies on.
|
|
*/
|
|
|
|
return [
|
|
// Minimum supported PHP version (production runs 8.4).
|
|
'min_php_version' => '8.2',
|
|
|
|
// Extensions the application requires to function.
|
|
'required_extensions' => [
|
|
'ldap', // api/user_avatar.php — lldap avatar lookups
|
|
'mysqli', // helpers/Database.php — all data access
|
|
'curl', // helpers/NotificationHelper.php, SynapseHelper.php — Matrix
|
|
'mbstring', // multibyte string handling
|
|
'fileinfo', // api/upload_attachment.php — MIME validation
|
|
'json', // request/response encoding (bundled, but assert anyway)
|
|
],
|
|
];
|