christian
7360d0b08a
feat: add fullpage and maxheight parameters for enhanced screenshot options
Build Container / docker (push) Successful in 4m13s
2026-04-24 15:43:08 +02:00
christian
ada976a224
feat: enable BLOCK_PRIVATE_IPS in docker-compose for enhanced security
Build Container / docker (push) Successful in 5m19s
2026-04-21 12:53:08 +02:00
christian and Claude Sonnet 4.6
6973522c45
fix: block non-http(s) schemes, sanitize API_KEY backslash, improve viewport error message
...
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-21 12:48:18 +02:00
christian
6dc0001f9d
fix: block 0.0.0.0/8 in isPrivateIP to prevent loopback bypass
2026-04-21 12:35:31 +02:00
christian
4ab30bcc1d
feat: opt-in SSRF protection via BLOCK_PRIVATE_IPS env var
2026-04-21 12:26:54 +02:00
christian and Claude Sonnet 4.6
9295115742
fix: use hash_equals for API key comparison and update config documentation
...
- Replace direct API key comparison with hash_equals() to prevent timing oracle attacks
- Update CLAUDE.md to document all config options (URL, API_KEY, BLOCK_PRIVATE_IPS)
- Add placeholder defines to src/config.inc.php for local dev (not committed due to .gitignore)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-21 12:17:34 +02:00
christian
efc9e6510c
feat: optional API key auth via X-API-Key header or ?key= param
2026-04-21 12:11:23 +02:00
christian
e7924f462e
fix: reject zero-dimension viewport values
2026-04-21 12:04:05 +02:00
christian and Claude Sonnet 4.6
8590465c6a
fix: viewport before page load, 60ms->60s timeout, viewport cap, generic errors
...
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-21 11:49:49 +02:00
christian and Claude Sonnet 4.6
cc30d2288e
fix: sanitize API_KEY and BLOCK_PRIVATE_IPS in config generation
...
- Fix Issue 1: Normalize BLOCK_PRIVATE_IPS to safe boolean (true/false) using shell case statement to prevent PHP injection from non-boolean values like 'yes'
- Fix Issue 2: Strip single quotes from API_KEY to prevent PHP string injection if the value contains quotes
- Update docker-compose-dev.yml to document these configuration options
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-20 21:50:59 +02:00
christian
3ab7c1334f
feat: add API_KEY and BLOCK_PRIVATE_IPS config vars
2026-04-20 21:47:09 +02:00
christian
75ead2f5ad
feat: add isPrivateIP helper, fix getUserIP and addToLog
2026-04-20 21:44:32 +02:00
christian and Claude Sonnet 4.6
15720489ba
test: add failing tests for helpers functions
...
Add comprehensive tests for isPrivateIP() and getUserIP() functions.
These tests currently fail as the functions are not yet implemented.
Tests cover:
- isPrivateIP: loopback, private ranges (10/172/192), AWS metadata, public IPs
- getUserIP: REMOTE_ADDR fallback, X-Forwarded-For parsing and trimming
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-20 21:43:47 +02:00
christian
73118498c9
docs: add security hardening implementation plan
2026-04-20 09:44:48 +02:00
christian
7f9a752b57
docs: add security hardening design spec
2026-04-20 09:40:21 +02:00
christian
7323eed789
fix: enhance error handling and improve URL decoding in http2pic class and index.php
2026-04-20 07:59:06 +02:00
christian
7616dee994
fix: improve error handling and streamline screenshot response in index.php
2026-04-19 21:58:00 +02:00
christian
4a548f50e7
fix: update URL format in docker-compose and enhance error handling in http2pic class
2026-04-19 21:27:04 +02:00
christian
faea2b0899
fix: correct URL format in docker-compose files and improve viewport handling in index.php
Build Container / docker (push) Successful in 28s
2026-02-15 19:58:43 +01:00
christian
427fa24565
clarify
2026-02-15 19:29:55 +01:00
christian
086e7c7a77
full path
2025-06-10 12:00:35 +02:00
christian
181bed4449
config corrections
2025-06-10 11:57:16 +02:00
christian
6e0795bbdf
url
2025-06-10 11:55:13 +02:00
christian
5df5a0ad7a
added logging
Build Container / docker (push) Successful in 2m7s
2025-06-10 11:50:24 +02:00
christian
63b49dd282
url showing
2025-06-10 11:25:27 +02:00
christian
5e8f4e33e3
ups
2025-06-10 11:23:45 +02:00
christian
a140a35448
symlink
2025-06-10 11:21:11 +02:00
christian
a0765efc3c
ok
2025-06-10 11:16:25 +02:00
christian
543e44abc8
fine, I'll do it myself
Build Container / docker (push) Successful in 1m6s
2025-06-10 11:09:14 +02:00
christian
1443cfee12
ok only docker hub
ci / docker (push) Failing after 9m27s
2025-06-10 11:06:45 +02:00
christian
0d17b5d474
write permissions for packages
ci / docker (push) Failing after 11m14s
2025-06-10 11:02:01 +02:00
christian
3eed66b9a9
testing
ci / docker (push) Failing after 11m17s
2025-06-10 10:54:13 +02:00
christian
184e673277
correct token for docker login
ci / docker (push) Failing after 11m17s
2025-06-10 10:51:10 +02:00
christian
83926b0f9a
push only to github
ci / docker (push) Failing after 11m2s
2025-06-10 10:44:33 +02:00
christian
469ef7f5ea
container and dev preparations
ci / docker (push) Failing after 11m20s
2025-06-10 10:39:47 +02:00
christian
fbe7613f97
working prototype, many features missing
2025-01-13 15:58:58 +00:00
christian
028a4b54f4
api preparations for rework
2025-01-13 15:42:44 +00:00
christian
f54d35c312
preparations and testing for a rewrite, ditching wkhtmltopdf for chrome-driver
2025-01-12 20:13:47 +00:00
christian
cf07363a8d
preparations for rewrite
2025-01-11 23:14:09 +01:00
christian
637a781f24
changed the way the url is escaped. should fix #14
2022-03-08 22:00:58 +01:00
christian
ce3b71c934
url validation now only allows http, https and ftp urls. fixes #13
2016-11-20 23:24:01 +01:00
christian
52df764d44
added phantomjs binary
2016-11-20 23:23:27 +01:00
christian
8c446b794d
so the debug file (if exists) won't be visible to everyone
2015-10-03 18:47:05 +02:00
christian
d9e70e5abd
phantom render script
2015-10-01 15:36:32 +02:00
christian
98667473d8
fixed caching and removed faulty type variable
2015-10-01 15:17:30 +02:00
christian
43be0fdfac
added debug functin and fixed false negatives of "isURLReachable" method
2015-10-01 15:17:10 +02:00
christian
2c06b8d90e
moved lines around so they make more sense
2015-09-30 11:07:03 +02:00
christian
9d8d779ef1
added phantomjs stuff
2015-09-30 00:47:36 +02:00
christian
0b5c98ee54
added experimental support for phantomjs as rendering engine. Should work but I couldn't test it yet
2015-09-30 00:47:03 +02:00
christian
2ef269fb87
fixed variable change
2015-09-30 00:46:14 +02:00
christian
eeb9e6d1d1
added upgrade info
2015-09-29 23:12:18 +02:00
christian
5be211b209
resizing now uses right file type
2015-09-29 23:10:23 +02:00
christian
5e2248cd04
This project is now officially released under the Apache License
2015-09-29 19:54:21 +02:00
christian
8744bad966
added curl as dependency
2015-09-29 19:50:32 +02:00
christian
f926d5bb15
http2pic class with several editable options. Code is prepared for changing of rendering engines although at the moment only wkhtmltoimage is supported
2015-09-29 19:49:21 +02:00
christian
b630fcd6b6
api.php updated so it just calls the http2pic class
2015-09-29 19:38:20 +02:00
christian
65113d7131
added download link
2015-09-28 16:23:12 +02:00
christian
eceaec3df9
fixed messedup filename for non-cached images
2015-09-28 16:02:20 +02:00
christian
a51de98781
if the user didn't specify the cache id, we'll delete the image and not keep it
2015-09-28 15:56:04 +02:00
christian
193cf828c2
Opengraph goodnes
2015-09-28 15:37:52 +02:00
christian
b216bf11c8
added php example
2015-09-28 15:23:50 +02:00
christian
c19829233a
Adding cache folder if nto exist
2015-09-28 15:21:43 +02:00
christian
ef5d967aa5
added how to use section
2015-09-28 15:21:26 +02:00
christian
deb51373ad
added github fork link
2015-09-28 11:36:42 +02:00
christian
9cc7c1704d
safer input
2015-09-28 11:36:29 +02:00
christian
28daf463d1
final
2015-09-28 01:02:32 +02:00
christian
6cfccc99a1
Readme got even better
2015-09-28 01:01:50 +02:00
christian
16bc00bb48
better readme
2015-09-28 01:00:27 +02:00
christian
ea39fea3c3
readme :D
2015-09-28 00:58:41 +02:00
christian
d1a27d0d1a
don't need that anymore
2015-09-28 00:53:50 +02:00
christian
1559b55ca0
added another example
2015-09-28 00:52:27 +02:00
christian
feccae9255
beautify :D
2015-09-28 00:52:11 +02:00
christian
8d9d3758c3
initial commit
2015-09-28 00:35:10 +02:00
christian
