xBeaTz
d97605f801
- Fixed SQL injection vulnerabilities with prepared statements - Added column whitelist protection for dynamic termin updates - Extracted iCloud credentials into protected config file - Moved sensitive configuration files out of webroot - Added authentication and admin checks to PVE APIs - Added CSRF protection to write operations and APIs - Disabled debug output in production mode - Added centralized configuration handling - Protected sensitive directories with access rules - Added initial project security documentation
1.6 KiB
1.6 KiB
ANJUMA Dashboard – Sicherheits-Refactoring TODO
Phase 1 – Schnelle Erfolge (CRITICAL) ✅ COMPLETE
- SQL Injection in Data.class.php fixen (Prepared Statements)
- iCloud-Credentials auslagern in config/icloud.php
- .htaccess für config/ und storage/ erstellen
- config.cfg aus Webroot in config/ verschieben
- display_errors zentral in config.php steuern (error_reporting nur im Error-Handler)
- CSRF-Schutz für Termin-APIs (create, save, delete)
- CSRF-Schutz für Finance-APIs (save, delete expenses)
- CSRF-Schutz für Invoice-API (create from termin)
- Auth-Check in PVE-APIs (Session-Prüfung ergänzt)
Phase 2 – Strukturverbesserungen (NÄCHSTE SCHRITTE)
- PSR-4 Autoloading via Composer einführen
- Data.class.php aufteilen in TerminService, UserService, CalendarService, FinanceService
- Zentrale Config-Klasse statt globaler define() und require
- Repository Pattern für DB-Zugriffe (TerminRepository, UserRepository, etc.)
- Template-Engine (Twig oder einfaches PHP-Template-System)
- Router einführen (Front Controller Pattern)
Phase 3 – Langfristig
- Datenbank-Migrationen (Phinx oder Doctrine Migrations)
- Indizes optimieren (EXPLAIN-Analyse der häufigsten Queries)
- Unit-Tests für Business-Logik (PHPUnit)
- Logging-System (Monolog) statt debugLog() in Datei
- CI/CD Pipeline (Gitea Actions)
- Docker-Compose für lokale Entwicklung
- API-Rate-Limiting für externe APIs (iCloud, Proxmox)
- Monitoring (Health-Checks, Alerting) </create_file>