Haschek-Solutions/http2pic
2
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
95 Commits 1 Branch 11 Tags
5c661a48054d97f7835edaf3f5bfff30a73d9b9c
Commit Graph
14 Commits
Author SHA1 Message Date
christianandClaude Opus 5.5 5c661a4805 Mitigate PHP RCE advisories GHSA-6wmf-4rv5-p3rp / GHSA-w8hw-w9fx-j79w 
Stopgap for the PHP RCE advisories GHSA-6wmf-4rv5-p3rp and GHSA-w8hw-w9fx-j79w
(2026-10-21): disable session.upload_progress (and fatal_error_backtraces on
PHP 8.5). Upload progress should stay off even after patched PHP is deployed.

Bump the EOL Alpine base to 3.24 so php83 receives the 8.3.36 security
release. Alpine 3.24 no longer ships /usr/bin/php for php83, so add the link.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-21 17:43:59 +02:00
christian ada976a224 feat: enable BLOCK_PRIVATE_IPS in docker-compose for enhanced security
Build Container / docker (push) Successful in 5m19s
Details
2026-04-21 12:53:08 +02:00
christianandClaude Sonnet 4.6 6973522c45 fix: block non-http(s) schemes, sanitize API_KEY backslash, improve viewport error message 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-21 12:48:18 +02:00
christianandClaude Sonnet 4.6 cc30d2288e fix: sanitize API_KEY and BLOCK_PRIVATE_IPS in config generation 
- Fix Issue 1: Normalize BLOCK_PRIVATE_IPS to safe boolean (true/false) using shell case statement to prevent PHP injection from non-boolean values like 'yes'
- Fix Issue 2: Strip single quotes from API_KEY to prevent PHP string injection if the value contains quotes
- Update docker-compose-dev.yml to document these configuration options

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-20 21:50:59 +02:00
christian 3ab7c1334f feat: add API_KEY and BLOCK_PRIVATE_IPS config vars 2026-04-20 21:47:09 +02:00
christian 086e7c7a77 full path 2025-06-10 12:00:35 +02:00
christian 181bed4449 config corrections 2025-06-10 11:57:16 +02:00
christian 63b49dd282 url showing 2025-06-10 11:25:27 +02:00
christian 5e8f4e33e3 ups 2025-06-10 11:23:45 +02:00
christian a140a35448 symlink 2025-06-10 11:21:11 +02:00
christian a0765efc3c ok 2025-06-10 11:16:25 +02:00
christian 469ef7f5ea container and dev preparations
ci / docker (push) Failing after 11m20s
Details
2025-06-10 10:39:47 +02:00
christian f54d35c312 preparations and testing for a rewrite, ditching wkhtmltopdf for chrome-driver 2025-01-12 20:13:47 +00:00
christian cf07363a8d preparations for rewrite 2025-01-11 23:14:09 +01:00