From 91a9670e22594b64710348bdf44aa2e84b9fedc6 Mon Sep 17 00:00:00 2001 From: Yassine Doghri Date: Tue, 25 May 2021 10:40:22 +0000 Subject: [PATCH] refactor: update app starter files to CI4 4.1.2 --- app/Config/App.php | 168 +--------------------- app/Config/Autoload.php | 18 +++ app/Config/ContentSecurityPolicy.php | 21 ++- app/Config/Events.php | 2 +- app/Config/Exceptions.php | 12 ++ app/Config/Mimes.php | 34 ++--- app/Config/Modules.php | 2 +- app/Config/Security.php | 16 --- app/Views/errors/html/debug.css | 63 +++++--- app/Views/errors/html/error_exception.php | 118 ++++++--------- env | 42 +++--- public/.htaccess | 44 ++++-- public/index.php | 19 +-- spark | 48 +++---- 14 files changed, 226 insertions(+), 381 deletions(-) diff --git a/app/Config/App.php b/app/Config/App.php index fdfb92fb..82e27e39 100644 --- a/app/Config/App.php +++ b/app/Config/App.php @@ -34,7 +34,7 @@ class App extends BaseConfig * * http://cdn.example.com/ */ - public string $mediaBaseURL = 'http://127.0.0.2:8080/'; + public string $mediaBaseURL = 'http://localhost:8080/'; /** * -------------------------------------------------------------------------- @@ -216,87 +216,6 @@ class App extends BaseConfig */ public bool $sessionRegenerateDestroy = false; - /** - * -------------------------------------------------------------------------- - * Cookie Prefix - * -------------------------------------------------------------------------- - * - * Set a cookie name prefix if you need to avoid collisions. - * - * @deprecated use Config\Cookie::$prefix property instead. - */ - public string $cookiePrefix = ''; - - /** - * -------------------------------------------------------------------------- - * Cookie Domain - * -------------------------------------------------------------------------- - * - * Set to `.your-domain.com` for site-wide cookies. - * - * @deprecated use Config\Cookie::$domain property instead. - */ - public string $cookieDomain = ''; - - /** - * -------------------------------------------------------------------------- - * Cookie Path - * -------------------------------------------------------------------------- - * - * Typically will be a forward slash. - * - * @deprecated use Config\Cookie::$path property instead. - */ - public string $cookiePath = '/'; - - /** - * -------------------------------------------------------------------------- - * Cookie Secure - * -------------------------------------------------------------------------- - * - * Cookie will only be set if a secure HTTPS connection exists. - * - * @deprecated use Config\Cookie::$secure property instead. - */ - public bool $cookieSecure = false; - - /** - * -------------------------------------------------------------------------- - * Cookie HttpOnly - * -------------------------------------------------------------------------- - * - * Cookie will only be accessible via HTTP(S) (no JavaScript). - * - * @var boolean - * - * @deprecated use Config\Cookie::$httponly property instead. - */ - public bool $cookieHTTPOnly = true; - - /** - * -------------------------------------------------------------------------- - * Cookie SameSite - * -------------------------------------------------------------------------- - * - * Configure cookie SameSite setting. Allowed values are: - * - None - * - Lax - * - Strict - * - '' - * - * Alternatively, you can use the constant names: - * - `Cookie::SAMESITE_NONE` - * - `Cookie::SAMESITE_LAX` - * - `Cookie::SAMESITE_STRICT` - * - * Defaults to `Lax` for compatibility with modern browsers. Setting `''` - * (empty string) means default SameSite attribute set by browsers (`Lax`) - * will be set on cookies. If set to `None`, `$cookieSecure` must also be set. - * - * @deprecated use Config\Cookie::$samesite property instead. - */ - public string $cookieSameSite = 'Lax'; - /** * -------------------------------------------------------------------------- * Reverse Proxy IPs @@ -317,91 +236,6 @@ class App extends BaseConfig */ public string | array $proxyIPs = ''; - /** - * -------------------------------------------------------------------------- - * CSRF Token Name - * -------------------------------------------------------------------------- - * - * The token name. - * - * @deprecated Use `Config\Security` $tokenName property instead of using this property. - */ - public string $CSRFTokenName = 'csrf_test_name'; - - /** - * -------------------------------------------------------------------------- - * CSRF Header Name - * -------------------------------------------------------------------------- - * - * The header name. - * - * @deprecated Use `Config\Security` $headerName property instead of using this property. - */ - public string $CSRFHeaderName = 'X-CSRF-TOKEN'; - - /** - * -------------------------------------------------------------------------- - * CSRF Cookie Name - * -------------------------------------------------------------------------- - * - * The cookie name. - * - * @deprecated Use `Config\Security` $cookieName property instead of using this property. - */ - public string $CSRFCookieName = 'csrf_cookie_name'; - - /** - * -------------------------------------------------------------------------- - * CSRF Expire - * -------------------------------------------------------------------------- - * - * The number in seconds the token should expire. - * - * @deprecated Use `Config\Security` $expire property instead of using this property. - */ - public int $CSRFExpire = 7200; - - /** - * -------------------------------------------------------------------------- - * CSRF Regenerate - * -------------------------------------------------------------------------- - * - * Regenerate token on every submission? - * - * @deprecated Use `Config\Security` $regenerate property instead of using this property. - */ - public bool $CSRFRegenerate = true; - - /** - * -------------------------------------------------------------------------- - * CSRF Redirect - * -------------------------------------------------------------------------- - * - * Redirect to previous page with error on failure? - * - * @deprecated Use `Config\Security` $redirect property instead of using this property. - */ - public bool $CSRFRedirect = true; - - /** - * -------------------------------------------------------------------------- - * CSRF SameSite - * -------------------------------------------------------------------------- - * - * Setting for CSRF SameSite cookie token. Allowed values are: - * - None - * - Lax - * - Strict - * - '' - * - * Defaults to `Lax` as recommended in this link: - * - * @see https://portswigger.net/web-security/csrf/samesite-cookies - * - * @deprecated Use `Config\Security` $samesite property instead of using this property. - */ - public string $CSRFSameSite = 'Lax'; - /** * -------------------------------------------------------------------------- * Content Security Policy diff --git a/app/Config/Autoload.php b/app/Config/Autoload.php index 209af318..b74370e8 100644 --- a/app/Config/Autoload.php +++ b/app/Config/Autoload.php @@ -65,4 +65,22 @@ class Autoload extends AutoloadConfig * @var array */ public $classmap = []; + + /** + * ------------------------------------------------------------------- + * Files + * ------------------------------------------------------------------- + * The files array provides a list of paths to __non-class__ files + * that will be autoloaded. This can be useful for bootstrap operations + * or for loading functions. + * + * Prototype: + * ``` + * $files = [ + * '/path/to/my/file.php', + * ]; + * ``` + * @var array + */ + public $files = []; } diff --git a/app/Config/ContentSecurityPolicy.php b/app/Config/ContentSecurityPolicy.php index c4d17653..ae5374e2 100644 --- a/app/Config/ContentSecurityPolicy.php +++ b/app/Config/ContentSecurityPolicy.php @@ -35,7 +35,7 @@ class ContentSecurityPolicy extends BaseConfig * * @var string|string[]|null */ - public string | array | null $defaultSrc; + public string | array | null $defaultSrc = null; /** * Lists allowed scripts' URLs. @@ -65,7 +65,7 @@ class ContentSecurityPolicy extends BaseConfig * * @var string|string[]|null */ - public string | array | null $baseURI; + public string | array | null $baseURI = null; /** * Lists the URLs for workers and embedded frame contents @@ -102,14 +102,21 @@ class ContentSecurityPolicy extends BaseConfig * * @var string|string[]|null */ - public string | array | null $frameAncestors; + public string | array | null $frameAncestors = null; + + /** + * The frame-src directive restricts the URLs which may be loaded into nested browsing contexts. + * + * @var string[]|string|null + */ + public string | array | null $frameSrc = null; /** * Restricts the origins allowed to deliver video and audio. * * @var string|string[]|null */ - public string | array | null $mediaSrc; + public string | array | null $mediaSrc = null; /** * Allows control over Flash and other plugins. @@ -121,19 +128,19 @@ class ContentSecurityPolicy extends BaseConfig /** * @var string|string[]|null */ - public string | array | null $manifestSrc; + public string | array | null $manifestSrc = null; /** * Limits the kinds of plugins a page may invoke. * * @var string|string[]|null */ - public string | array | null $pluginTypes; + public string | array | null $pluginTypes = null; /** * List of actions allowed. * * @var string|string[]|null */ - public string | array | null $sandbox; + public string | array | null $sandbox = null; } diff --git a/app/Config/Events.php b/app/Config/Events.php index 47224b1e..59cc1e6c 100644 --- a/app/Config/Events.php +++ b/app/Config/Events.php @@ -49,7 +49,7 @@ Events::on('pre_system', function () { * * @phpstan-ignore-next-line */ - if (CI_DEBUG) { + if (CI_DEBUG && ! is_cli()) { Events::on('DBQuery', 'CodeIgniter\Debug\Toolbar\Collectors\Database::collect',); Services::toolbar()->respond(); } diff --git a/app/Config/Exceptions.php b/app/Config/Exceptions.php index b11e9b3f..f264eee9 100644 --- a/app/Config/Exceptions.php +++ b/app/Config/Exceptions.php @@ -41,4 +41,16 @@ class Exceptions extends BaseConfig * Default: APPPATH.'Views/errors' */ public string $errorViewPath = APPPATH . 'Views/errors'; + + /** + * -------------------------------------------------------------------------- + * HIDE FROM DEBUG TRACE + * -------------------------------------------------------------------------- + * Any data that you would like to hide from the debug trace. + * In order to specify 2 levels, use "/" to separate. + * ex. ['server', 'setup/password', 'secret_token'] + * + * @var string[] + */ + public array $sensitiveDataInTrace = []; } diff --git a/app/Config/Mimes.php b/app/Config/Mimes.php index 2229f039..759ccac6 100644 --- a/app/Config/Mimes.php +++ b/app/Config/Mimes.php @@ -207,6 +207,8 @@ class Mimes 'application/msword', 'application/x-zip', ], + 'xlsb' => 'application/vnd.ms-excel.sheet.binary.macroEnabled.12', + 'xlsm' => 'application/vnd.ms-excel.sheet.macroEnabled.12', 'word' => ['application/msword', 'application/octet-stream'], 'xl' => 'application/excel', 'eml' => 'message/rfc822', @@ -311,32 +313,26 @@ class Mimes $proposedExtension = trim(strtolower($proposedExtension)); - if ($proposedExtension === '') { + if ($proposedExtension !== '') { + if (array_key_exists($proposedExtension, static::$mimes) && in_array( + $type, + is_string(static::$mimes[$proposedExtension]) ? [ + static::$mimes[$proposedExtension], + ] : static::$mimes[$proposedExtension], + true + )) { + // The detected mime type matches with the proposed extension. + return $proposedExtension; + } + // An extension was proposed, but the media type does not match the mime type list. return null; } - if ( - array_key_exists($proposedExtension, static::$mimes) && - in_array( - $type, - is_string(static::$mimes[$proposedExtension]) - ? [static::$mimes[$proposedExtension]] - : static::$mimes[$proposedExtension], - true, - ) - ) { - // The detected mime type matches with the proposed extension. - return $proposedExtension; - } - // Reverse check the mime type list if no extension was proposed. // This search is order sensitive! foreach (static::$mimes as $ext => $types) { - if ( - (is_string($types) && $types === $type) || - (is_array($types) && in_array($type, $types, true)) - ) { + if ((is_string($types) && $types === $type) || (is_array($types) && in_array($type, $types, true))) { return $ext; } } diff --git a/app/Config/Modules.php b/app/Config/Modules.php index c87ce571..5fe2b53a 100644 --- a/app/Config/Modules.php +++ b/app/Config/Modules.php @@ -12,7 +12,7 @@ class Modules extends BaseModules * -------------------------------------------------------------------------- * * If true, then auto-discovery will happen across all elements listed in - * $activeExplorers below. If false, no auto-discovery will happen at all, + * $aliases below. If false, no auto-discovery will happen at all, * giving a slight performance boost. * * @var boolean diff --git a/app/Config/Security.php b/app/Config/Security.php index c5b533f7..d0f31414 100644 --- a/app/Config/Security.php +++ b/app/Config/Security.php @@ -61,20 +61,4 @@ class Security extends BaseConfig * Redirect to previous page with error on failure. */ public bool $redirect = true; - - /** - * -------------------------------------------------------------------------- - * CSRF SameSite - * -------------------------------------------------------------------------- - * - * Setting for CSRF SameSite cookie token. - * - * Allowed values are: None - Lax - Strict - ''. - * - * Defaults to `Lax` as recommended in this link: - * @see https://portswigger.net/web-security/csrf/samesite-cookies - * - * @var string 'Lax'|'None'|'Strict' - */ - public string $samesite = 'Lax'; } diff --git a/app/Views/errors/html/debug.css b/app/Views/errors/html/debug.css index ec6dc81f..2ef43583 100644 --- a/app/Views/errors/html/debug.css +++ b/app/Views/errors/html/debug.css @@ -1,8 +1,19 @@ +:root { + --main-bg-color: #fff; + --main-text-color: #555; + --dark-text-color: #222; + --light-text-color: #c7c7c7; + --brand-primary-color: #e06e3f; + --light-bg-color: #ededee; + --dark-bg-color: #404040; +} + body { height: 100%; - background: #fafafa; - font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; - color: #777; + background: var(--main-bg-color); + font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, + sans-serif, "Apple Color Emoji", "Segoe UI Emoji"; + color: var(--main-text-color); font-weight: 300; margin: 0; padding: 0; @@ -11,7 +22,7 @@ h1 { font-weight: lighter; letter-spacing: 0.8; font-size: 3rem; - color: #222; + color: var(--dark-text-color); margin: 0; } h1.headline { @@ -30,11 +41,15 @@ p.lead { padding: 1rem; } .header { - background: #85271f; - color: #fff; + background: var(--light-bg-color); + color: var(--dark-text-color); +} +.header .container { + padding: 1rem 1.75rem 1.75rem 1.75rem; } .header h1 { - color: #fff; + font-size: 2.5rem; + font-weight: 500; } .header p { font-size: 1.2rem; @@ -42,7 +57,7 @@ p.lead { line-height: 2.5; } .header a { - color: rgba(255, 255, 255, 0.5); + color: var(--brand-primary-color); margin-left: 2rem; display: none; text-decoration: none; @@ -51,6 +66,10 @@ p.lead { display: inline; } +.footer { + background: var(--dark-bg-color); + color: var(--light-text-color); +} .footer .container { border-top: 1px solid #e7e7e7; margin-top: 1rem; @@ -58,11 +77,12 @@ p.lead { } .source { - background: #333; - color: #c7c7c7; + background: #343434; + color: var(--light-text-color); padding: 0.5em 1em; border-radius: 5px; font-family: Menlo, Monaco, Consolas, "Courier New", monospace; + font-size: 0.85rem; margin: 0; overflow-x: scroll; } @@ -74,8 +94,8 @@ p.lead { } .source .line .highlight { display: block; - background: #555; - color: #fff; + background: var(--dark-text-color); + color: var(--light-text-color); } .source span.highlight .number { color: #fff; @@ -96,24 +116,25 @@ p.lead { padding: 0rem 1rem; line-height: 2.7; text-decoration: none; - color: #a7a7a7; - background: #f1f1f1; - border: 1px solid #e7e7e7; + color: var(--dark-text-color); + background: var(--light-bg-color); + border: 1px solid rgba(0, 0, 0, 0.15); border-bottom: 0; border-top-left-radius: 5px; border-top-right-radius: 5px; display: inline-block; } .tabs a:hover { - background: #e7e7e7; - border-color: #e1e1e1; + background: var(--light-bg-color); + border-color: rgba(0, 0, 0, 0.15); } .tabs a.active { - background: #fff; + background: var(--main-bg-color); + color: var(--main-text-color); } .tab-content { - background: #fff; - border: 1px solid #efefef; + background: var(--main-bg-color); + border: 1px solid rgba(0, 0, 0, 0.15); } .content { padding: 1rem; @@ -167,7 +188,7 @@ td pre { font-weight: bold; } .trace td { - background: #e7e7e7; + background: var(--light-bg-color); padding: 0 1rem; } .trace td pre { diff --git a/app/Views/errors/html/error_exception.php b/app/Views/errors/html/error_exception.php index 815f7990..845953b1 100644 --- a/app/Views/errors/html/error_exception.php +++ b/app/Views/errors/html/error_exception.php @@ -1,10 +1,9 @@ +$errorId = uniqid('error', true); ?> @@ -14,11 +13,7 @@ $errorId = uniqid('error', true); <?= esc($title) ?>