From a80c3d1e3d34d0cb11f09d0ca23a8aa6d463ff82 Mon Sep 17 00:00:00 2001 From: Robert Date: Fri, 23 Dec 2022 06:19:02 -0500 Subject: [PATCH] docs --- composer.json | 14 ++++ public/main.page | 7 ++ src/documentation/IMPORTANT.txt | 42 +++++++++++ src/documentation/SecurityURLs.txt | 5 +- src/documentation/chgrp_on_folders.txt | 26 ++----- src/documentation/mysql8.txt | 6 -- src/documentation/nginx-default-conf.txt | 88 ++++++++++++------------ src/documentation/old_debuging.txt | 7 -- 8 files changed, 113 insertions(+), 82 deletions(-) create mode 100644 src/documentation/IMPORTANT.txt delete mode 100644 src/documentation/old_debuging.txt diff --git a/composer.json b/composer.json index 2f05501..e881a3d 100644 --- a/composer.json +++ b/composer.json @@ -1,4 +1,18 @@ { + "name": "tryingtoscale/tts_project", + "type": "project", + "description": "A modern PHP Framework, sample Project.", + "keywords": ["PHP TTS Framework", "TTS Project"], + "homepage": "https://git.mysnippetsofcode.com/tts/tts_project", + "license": "MIT", + "authors": [ + { + "name": "Robert Strutts", + "email": "Robert@TryingToScale.com", + "homepage": "https://TryingToScale.com", + "role": "Developer" + } + ], "require-dev": { "phpunit/phpunit": "^9.5" } diff --git a/public/main.page b/public/main.page index fa4a010..2cdb475 100644 --- a/public/main.page +++ b/public/main.page @@ -2,6 +2,13 @@ declare(strict_types=1); +$show_all_startup_errors = false; +if ($show_all_startup_errors) { + ini_set('display_errors', 1); + ini_set('display_startup_errors', 1); + error_reporting(E_ALL); +} + require '../src/before_main.php'; \bs_tts\site_helper::set_all_projects(['mockup','ex','live']); \bs_tts\site_helper::set_default_project("mockup"); diff --git a/src/documentation/IMPORTANT.txt b/src/documentation/IMPORTANT.txt new file mode 100644 index 0000000..3cebde8 --- /dev/null +++ b/src/documentation/IMPORTANT.txt @@ -0,0 +1,42 @@ +Please note that main.inc.php, which should be called by index.php or main.page, does +the following: + +unset($_REQUEST); +unset($_GET); +unset($_POST); + +So, you must use a Sanitizer to get those input vars!!! +...in your input file: +use \bs_tts\use_io as IO; +... + $required_post_string_field = new IO(); + $required_post_string_field->input_type = INPUTS::post; + $required_post_string_field->field_filter = FIELD_FILTER::raw_string; + $required_post_string_field->escape_html = HTML_FLAG::escape; + $required_post_string_field->validation_rule = 'required'; + $required_post_string_field->use_db_filter = DB_FILTER::OFF; + $required_post_string_field->skip_the_db = false; +return [ + 'name' => $required_post_string_field, + 'address' => $required_post_string_field, +]; + +...After that, in your output file, you will pass in the input data of type IO: +use \bs_tts\safer_io as SafeIO; +... + $safer_html = []; + $errors = []; + foreach(SafeIO::html_escape_and_sanitize($input) as $html) { + $key = $html['name'] ?? ""; + $safer_html[$key] = $html['html']; + + if (\bs_tts\common::get_count($html['errors'])) { + $errors[$key] = $html['errors'][$key]; + } + } +... +Alternatively; use the built in PHP filter_input function. + +Likewise, if not using sanitize... then for all HTML output use + \bs_tts\safer_io::h(...) to escape it. + diff --git a/src/documentation/SecurityURLs.txt b/src/documentation/SecurityURLs.txt index fba4134..2d1dfe5 100644 --- a/src/documentation/SecurityURLs.txt +++ b/src/documentation/SecurityURLs.txt @@ -2,7 +2,4 @@ https://docs.php.earth/security/intro/ https://github.com/paragonie/awesome-appsec https://github.com/FallibleInc/security-guide-for-developers/blob/master/security-checklist.md -https://www.php.net/manual/en/security.php - -use GO myVault -Make a new GIT user&PUBKEY w/ only PULL access \ No newline at end of file +https://www.php.net/manual/en/security.php \ No newline at end of file diff --git a/src/documentation/chgrp_on_folders.txt b/src/documentation/chgrp_on_folders.txt index 129c8af..9358dda 100644 --- a/src/documentation/chgrp_on_folders.txt +++ b/src/documentation/chgrp_on_folders.txt @@ -1,27 +1,13 @@ These are my suggestions to lock things down, make a group called let's say coders. -The group coders is all the web developers on your team. -# So let's make the group for coders: -$sudo groupadd -g 10000 coders -# Let's add out first web developer to the new group called coders: -$sudo usermod -a -G yourUSERNAME coders - -# If you made the coders group, let's assign it to the project: -sudo chgrp -R coders /var/www/new_dev/ -# Let's make that group Sticky, so new files/folder will belong to it: -sudo find /var/www/new_dev/ -type d -exec chmod g+s {} \; -# Let's allow coders to read/write to the project, but everyone else like -# ... the web server have just Read access. -sudo find /var/www/new_dev/ -type f -exec chmod 664 {} \; -# Assign Read/Write/eXecute to all coders and -# ... execute bit only for others like web-server, etc...to the view files/folders. -sudo find /var/www/new_dev/ -type d -exec chmod 775 {} \; +sudo find /var/www/tts_project/ -type f -exec chmod 664 {} \; +sudo find /var/www/tts_project/ -type d -exec chmod 775 {} \; # Assuming your web server belongs to the group called www-data, let's allow the # ... server to modify these important folders only: -sudo chgrp -R www-data /var/www/new_dev/logs -sudo chgrp -R www-data /var/www/new_dev/configs -sudo chgrp -R www-data /var/www/new_dev/services +sudo chgrp -R www-data /var/www/tts_project/logs +sudo chgrp -R www-data /var/www/tts_project/configs +sudo chgrp -R www-data /var/www/tts_project/services # So, you probably want to allow cron-jobs to run code. Let's make it executable: -sudo chown +x /var/www/new_dev/cli_cron \ No newline at end of file +sudo chown +x /var/www/tts_project/cli_cron \ No newline at end of file diff --git a/src/documentation/mysql8.txt b/src/documentation/mysql8.txt index 3459d1d..02bb833 100644 --- a/src/documentation/mysql8.txt +++ b/src/documentation/mysql8.txt @@ -1,9 +1,3 @@ -cd /tmp/ && wget https://dev.mysql.com/get/mysql-apt-config_0.8.10-1_all.deb -dpkg -i mysql-apt-config_0.8.10-1_all.deb -apt update -apt install mysql-server mysql-client -mysql_upgrade -uroot -p - [[[[ mysql_native_password ]]]] NOt new one!!!! nano /etc/mysql/mysql.conf.d/mysqld.cnf diff --git a/src/documentation/nginx-default-conf.txt b/src/documentation/nginx-default-conf.txt index 484bd99..cb1a247 100644 --- a/src/documentation/nginx-default-conf.txt +++ b/src/documentation/nginx-default-conf.txt @@ -1,45 +1,43 @@ - location ^~ /frames/tts_framework/src/ { - deny all; - return 403; - } - - location ^~ /frames/tts_framework/vendor/ { - deny all; - return 403; - } - - location ^~ /tts_project/vendor/ { - deny all; - return 403; - } - - location ^~ /tts_project/src/ { - deny all; - return 403; - } - - location /tts_project/ { - # ONLY allow these DOMAINS: - if ( $http_host !~* ^(127.0.0.1|localhost|mysite.com)$ ) { - return 444; - } - - rewrite ^/tts_project/([^/]*)/([^/]*)/([^/]*)/([^/]*)\.html$ /tts_project/index.php?project=$1&route=/$2/$3&m=$4 last; - try_files $uri $uri/ =404; -} - -location ~ /\.ht { - deny all; -} - -location ~ /\.git { - deny all; -} - -location ~ composer.* { - deny all; -} - -location ~ README { - deny all; -} +# Become Root: +$sudo -i + +$ cd /etc/nginx/sites-enabled +$ cp default tts_project +$ nano tts_project +Some where in side of your SERVER BLOCK, add the following: + + + root /var/www/tts_project/public; + + index main.page; + + error_log /var/log/nginx/tts.log; + + server_name YOUR-WEB-SITE_DOMAIN_GOES_HERE!!; + + location / { + gzip_static on; + try_files $uri /main.page$is_args$args; + } + + location = /main.page { + gzip on; +# Replace php-fpm with unix:/var/run/php/php8.2-fpm.sock +# Your Version of PHP goes there... 8.2 or later... + fastcgi_pass php-fpm; + + fastcgi_split_path_info ^(.+?\.page)(/.*)$; + try_files $fastcgi_script_name =404; + set $path_info $fastcgi_path_info; + fastcgi_param PATH_INFO $path_info; + fastcgi_index main.page; + include fastcgi.conf; + + fastcgi_param SCRIPT_FILENAME $request_filename; + fastcgi_param SCRIPT_NAME $fastcgi_script_name; + + +# fastcgi_intercept_errors on; +# mirror @logging; +# mirror_request_body off; + } \ No newline at end of file diff --git a/src/documentation/old_debuging.txt b/src/documentation/old_debuging.txt deleted file mode 100644 index 5a1ada8..0000000 --- a/src/documentation/old_debuging.txt +++ /dev/null @@ -1,7 +0,0 @@ -$prj = $_GET['project'] ?? false; -if ($prj === 'mockup') { - ini_set('display_errors', 1); - ini_set('display_startup_errors', 1); - error_reporting(E_ALL); -} -