christian and Claude Opus 5.5
5c661a4805
Mitigate PHP RCE advisories GHSA-6wmf-4rv5-p3rp / GHSA-w8hw-w9fx-j79w
...
Stopgap for the PHP RCE advisories GHSA-6wmf-4rv5-p3rp and GHSA-w8hw-w9fx-j79w
(2026-10-21): disable session.upload_progress (and fatal_error_backtraces on
PHP 8.5). Upload progress should stay off even after patched PHP is deployed.
Bump the EOL Alpine base to 3.24 so php83 receives the 8.3.36 security
release. Alpine 3.24 no longer ships /usr/bin/php for php83, so add the link.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-21 17:43:59 +02:00
christian
7360d0b08a
feat: add fullpage and maxheight parameters for enhanced screenshot options
Build Container / docker (push) Successful in 4m13s
2026-04-24 15:43:08 +02:00
christian
ada976a224
feat: enable BLOCK_PRIVATE_IPS in docker-compose for enhanced security
Build Container / docker (push) Successful in 5m19s
2026-04-21 12:53:08 +02:00
christian and Claude Sonnet 4.6
6973522c45
fix: block non-http(s) schemes, sanitize API_KEY backslash, improve viewport error message
...
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-21 12:48:18 +02:00
christian
6dc0001f9d
fix: block 0.0.0.0/8 in isPrivateIP to prevent loopback bypass
2026-04-21 12:35:31 +02:00
christian
4ab30bcc1d
feat: opt-in SSRF protection via BLOCK_PRIVATE_IPS env var
2026-04-21 12:26:54 +02:00
christian and Claude Sonnet 4.6
9295115742
fix: use hash_equals for API key comparison and update config documentation
...
- Replace direct API key comparison with hash_equals() to prevent timing oracle attacks
- Update CLAUDE.md to document all config options (URL, API_KEY, BLOCK_PRIVATE_IPS)
- Add placeholder defines to src/config.inc.php for local dev (not committed due to .gitignore)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-21 12:17:34 +02:00
christian
efc9e6510c
feat: optional API key auth via X-API-Key header or ?key= param
2026-04-21 12:11:23 +02:00
christian
e7924f462e
fix: reject zero-dimension viewport values
2026-04-21 12:04:05 +02:00
christian and Claude Sonnet 4.6
8590465c6a
fix: viewport before page load, 60ms->60s timeout, viewport cap, generic errors
...
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-21 11:49:49 +02:00
christian and Claude Sonnet 4.6
cc30d2288e
fix: sanitize API_KEY and BLOCK_PRIVATE_IPS in config generation
...
- Fix Issue 1: Normalize BLOCK_PRIVATE_IPS to safe boolean (true/false) using shell case statement to prevent PHP injection from non-boolean values like 'yes'
- Fix Issue 2: Strip single quotes from API_KEY to prevent PHP string injection if the value contains quotes
- Update docker-compose-dev.yml to document these configuration options
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-20 21:50:59 +02:00
christian
3ab7c1334f
feat: add API_KEY and BLOCK_PRIVATE_IPS config vars
2026-04-20 21:47:09 +02:00
christian
75ead2f5ad
feat: add isPrivateIP helper, fix getUserIP and addToLog
2026-04-20 21:44:32 +02:00
christian and Claude Sonnet 4.6
15720489ba
test: add failing tests for helpers functions
...
Add comprehensive tests for isPrivateIP() and getUserIP() functions.
These tests currently fail as the functions are not yet implemented.
Tests cover:
- isPrivateIP: loopback, private ranges (10/172/192), AWS metadata, public IPs
- getUserIP: REMOTE_ADDR fallback, X-Forwarded-For parsing and trimming
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-20 21:43:47 +02:00
christian
73118498c9
docs: add security hardening implementation plan
2026-04-20 09:44:48 +02:00
christian
7f9a752b57
docs: add security hardening design spec
2026-04-20 09:40:21 +02:00
christian
7323eed789
fix: enhance error handling and improve URL decoding in http2pic class and index.php
2026-04-20 07:59:06 +02:00
christian
7616dee994
fix: improve error handling and streamline screenshot response in index.php
2026-04-19 21:58:00 +02:00
christian
4a548f50e7
fix: update URL format in docker-compose and enhance error handling in http2pic class
2026-04-19 21:27:04 +02:00
christian
faea2b0899
fix: correct URL format in docker-compose files and improve viewport handling in index.php
Build Container / docker (push) Successful in 28s
2026-02-15 19:58:43 +01:00
christian
427fa24565
clarify
2026-02-15 19:29:55 +01:00
christian
086e7c7a77
full path
2025-06-10 12:00:35 +02:00
christian
181bed4449
config corrections
2025-06-10 11:57:16 +02:00
christian
6e0795bbdf
url
2025-06-10 11:55:13 +02:00
christian
5df5a0ad7a
added logging
Build Container / docker (push) Successful in 2m7s
2025-06-10 11:50:24 +02:00
christian
63b49dd282
url showing
2025-06-10 11:25:27 +02:00
christian
5e8f4e33e3
ups
2025-06-10 11:23:45 +02:00
christian
a140a35448
symlink
2025-06-10 11:21:11 +02:00
christian
a0765efc3c
ok
2025-06-10 11:16:25 +02:00
christian
543e44abc8
fine, I'll do it myself
Build Container / docker (push) Successful in 1m6s
2025-06-10 11:09:14 +02:00
christian
1443cfee12
ok only docker hub
ci / docker (push) Failing after 9m27s
2025-06-10 11:06:45 +02:00
christian
0d17b5d474
write permissions for packages
ci / docker (push) Failing after 11m14s
2025-06-10 11:02:01 +02:00
christian
3eed66b9a9
testing
ci / docker (push) Failing after 11m17s
2025-06-10 10:54:13 +02:00
christian
184e673277
correct token for docker login
ci / docker (push) Failing after 11m17s
2025-06-10 10:51:10 +02:00
christian
83926b0f9a
push only to github
ci / docker (push) Failing after 11m2s
2025-06-10 10:44:33 +02:00
christian
469ef7f5ea
container and dev preparations
ci / docker (push) Failing after 11m20s
2025-06-10 10:39:47 +02:00
christian
fbe7613f97
working prototype, many features missing
2025-01-13 15:58:58 +00:00
christian
028a4b54f4
api preparations for rework
2025-01-13 15:42:44 +00:00
christian
f54d35c312
preparations and testing for a rewrite, ditching wkhtmltopdf for chrome-driver
2025-01-12 20:13:47 +00:00
christian
cf07363a8d
preparations for rewrite
2025-01-11 23:14:09 +01:00
christian
637a781f24
changed the way the url is escaped. should fix #14
2022-03-08 22:00:58 +01:00
christian
ce3b71c934
url validation now only allows http, https and ftp urls. fixes #13
2016-11-20 23:24:01 +01:00
christian
52df764d44
added phantomjs binary
2016-11-20 23:23:27 +01:00
christian
8c446b794d
so the debug file (if exists) won't be visible to everyone
2015-10-03 18:47:05 +02:00
christian
d9e70e5abd
phantom render script
2015-10-01 15:36:32 +02:00
christian
98667473d8
fixed caching and removed faulty type variable
2015-10-01 15:17:30 +02:00
christian
43be0fdfac
added debug functin and fixed false negatives of "isURLReachable" method
2015-10-01 15:17:10 +02:00
christian
2c06b8d90e
moved lines around so they make more sense
2015-09-30 11:07:03 +02:00
christian
9d8d779ef1
added phantomjs stuff
2015-09-30 00:47:36 +02:00
christian
0b5c98ee54
added experimental support for phantomjs as rendering engine. Should work but I couldn't test it yet
2015-09-30 00:47:03 +02:00
christian
2ef269fb87
fixed variable change
2015-09-30 00:46:14 +02:00
christian
eeb9e6d1d1
added upgrade info
2015-09-29 23:12:18 +02:00
christian
5be211b209
resizing now uses right file type
2015-09-29 23:10:23 +02:00
christian
5e2248cd04
This project is now officially released under the Apache License
2015-09-29 19:54:21 +02:00
christian
8744bad966
added curl as dependency
2015-09-29 19:50:32 +02:00
christian
f926d5bb15
http2pic class with several editable options. Code is prepared for changing of rendering engines although at the moment only wkhtmltoimage is supported
2015-09-29 19:49:21 +02:00
christian
b630fcd6b6
api.php updated so it just calls the http2pic class
2015-09-29 19:38:20 +02:00
christian
65113d7131
added download link
2015-09-28 16:23:12 +02:00
christian
eceaec3df9
fixed messedup filename for non-cached images
2015-09-28 16:02:20 +02:00
christian
a51de98781
if the user didn't specify the cache id, we'll delete the image and not keep it
2015-09-28 15:56:04 +02:00
christian
193cf828c2
Opengraph goodnes
2015-09-28 15:37:52 +02:00
christian
b216bf11c8
added php example
2015-09-28 15:23:50 +02:00
christian
c19829233a
Adding cache folder if nto exist
2015-09-28 15:21:43 +02:00
christian
ef5d967aa5
added how to use section
2015-09-28 15:21:26 +02:00
christian
deb51373ad
added github fork link
2015-09-28 11:36:42 +02:00
christian
9cc7c1704d
safer input
2015-09-28 11:36:29 +02:00
christian
28daf463d1
final
2015-09-28 01:02:32 +02:00
christian
6cfccc99a1
Readme got even better
2015-09-28 01:01:50 +02:00
christian
16bc00bb48
better readme
2015-09-28 01:00:27 +02:00
christian
ea39fea3c3
readme :D
2015-09-28 00:58:41 +02:00
christian
d1a27d0d1a
don't need that anymore
2015-09-28 00:53:50 +02:00
christian
1559b55ca0
added another example
2015-09-28 00:52:27 +02:00
christian
feccae9255
beautify :D
2015-09-28 00:52:11 +02:00
christian
8d9d3758c3
initial commit
2015-09-28 00:35:10 +02:00
christianandClaude Opus 5.5