From 28d8e418ed9ac9970c34e311c495050a666969f9 Mon Sep 17 00:00:00 2001 From: Josh North Date: Tue, 10 Aug 2021 09:48:35 -0400 Subject: [PATCH] Remediate other vulns --- .htaccess | 1 + inc/header.inc.php | 1 + src/index.php | 9 +++++++++ webfonts/index.php | 9 +++++++++ 4 files changed, 20 insertions(+) diff --git a/.htaccess b/.htaccess index ed19066..5854ceb 100644 --- a/.htaccess +++ b/.htaccess @@ -1 +1,2 @@ RedirectMatch 404 /\.git + diff --git a/inc/header.inc.php b/inc/header.inc.php index ee77971..a7f76bd 100644 --- a/inc/header.inc.php +++ b/inc/header.inc.php @@ -82,6 +82,7 @@ $timenow = $timeplus->format('Y-m-d H:i:s'); header("X-Frame-Options: SAMEORIGIN"); header("X-Content-Type-Options: nosniff"); + header("Content-Security-Policy: default-src 'self'; script-src 'self'"); //header("Content-Security-Policy: script-src 'self' 'unsafe-inline'; script-src-elem 'self'; script-src-attr 'self'; style-src 'self'; style-src-elem 'self'; style-src-attr 'self'; img-src 'self'; connect-src 'self'; frame-src 'self'; font-src 'self'; media-src 'self'; object-src 'self'; manifest-src 'self'; worker-src 'self'; prefetch-src 'self'; form-action 'self'; frame-ancestors 'self'; default-src 'self'", false); if (!empty($_GET['a'])) { echo '
' . print_r($_POST, true) . '
'; diff --git a/src/index.php b/src/index.php index 6858dd0..520c7d7 100644 --- a/src/index.php +++ b/src/index.php @@ -15,4 +15,13 @@ * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ + ini_set('session.gc_maxlifetime', 24*60*60); // MIN SESSION + ini_set('session.gc_probability', 1); // GC RATES + ini_set('session.gc_divisor', 100); // TIMES + ini_set('session.use_cookies', '1'); + ini_set('session.use_only_cookies', '1'); + ini_set('session.cookie_secure', '0'); + ini_set('session.cookie_httponly', '0'); + ini_set('session.cookie_samesite', 'Lax'); + diff --git a/webfonts/index.php b/webfonts/index.php index 6858dd0..520c7d7 100644 --- a/webfonts/index.php +++ b/webfonts/index.php @@ -15,4 +15,13 @@ * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ + ini_set('session.gc_maxlifetime', 24*60*60); // MIN SESSION + ini_set('session.gc_probability', 1); // GC RATES + ini_set('session.gc_divisor', 100); // TIMES + ini_set('session.use_cookies', '1'); + ini_set('session.use_only_cookies', '1'); + ini_set('session.cookie_secure', '0'); + ini_set('session.cookie_httponly', '0'); + ini_set('session.cookie_samesite', 'Lax'); +