xBeaTz
d97605f801
- Fixed SQL injection vulnerabilities with prepared statements - Added column whitelist protection for dynamic termin updates - Extracted iCloud credentials into protected config file - Moved sensitive configuration files out of webroot - Added authentication and admin checks to PVE APIs - Added CSRF protection to write operations and APIs - Disabled debug output in production mode - Added centralized configuration handling - Protected sensitive directories with access rules - Added initial project security documentation
35 lines
1.6 KiB
Markdown
35 lines
1.6 KiB
Markdown
# ANJUMA Dashboard – Sicherheits-Refactoring TODO
|
||
|
||
## Phase 1 – Schnelle Erfolge (CRITICAL) ✅ COMPLETE
|
||
|
||
- [x] SQL Injection in Data.class.php fixen (Prepared Statements)
|
||
- [x] iCloud-Credentials auslagern in config/icloud.php
|
||
- [x] .htaccess für config/ und storage/ erstellen
|
||
- [x] config.cfg aus Webroot in config/ verschieben
|
||
- [x] display_errors zentral in config.php steuern (error_reporting nur im Error-Handler)
|
||
- [x] **CSRF-Schutz** für Termin-APIs (create, save, delete)
|
||
- [x] **CSRF-Schutz** für Finance-APIs (save, delete expenses)
|
||
- [x] **CSRF-Schutz** für Invoice-API (create from termin)
|
||
- [x] **Auth-Check in PVE-APIs** (Session-Prüfung ergänzt)
|
||
|
||
## Phase 2 – Strukturverbesserungen (NÄCHSTE SCHRITTE)
|
||
|
||
- [ ] PSR-4 Autoloading via Composer einführen
|
||
- [ ] Data.class.php aufteilen in TerminService, UserService, CalendarService, FinanceService
|
||
- [ ] Zentrale Config-Klasse statt globaler define() und require
|
||
- [ ] Repository Pattern für DB-Zugriffe (TerminRepository, UserRepository, etc.)
|
||
- [ ] Template-Engine (Twig oder einfaches PHP-Template-System)
|
||
- [ ] Router einführen (Front Controller Pattern)
|
||
|
||
## Phase 3 – Langfristig
|
||
|
||
- [ ] Datenbank-Migrationen (Phinx oder Doctrine Migrations)
|
||
- [ ] Indizes optimieren (EXPLAIN-Analyse der häufigsten Queries)
|
||
- [ ] Unit-Tests für Business-Logik (PHPUnit)
|
||
- [ ] Logging-System (Monolog) statt debugLog() in Datei
|
||
- [ ] CI/CD Pipeline (Gitea Actions)
|
||
- [ ] Docker-Compose für lokale Entwicklung
|
||
- [ ] API-Rate-Limiting für externe APIs (iCloud, Proxmox)
|
||
- [ ] Monitoring (Health-Checks, Alerting)
|
||
</create_file>
|