From 2a236b02da098bfb9ce2a38432e7b08f8726f754 Mon Sep 17 00:00:00 2001 From: Nephiaust <29741794+Nephiaust@users.noreply.github.com> Date: Sun, 3 Sep 2023 19:37:53 +0930 Subject: [PATCH 01/50] Create SECURITY.md --- SECURITY.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..61335f7 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,18 @@ +# Security Policy + +## Supported Versions + +Use this section to tell people about which versions of your project are +currently being supported with security updates. + +| Version | Supported | +| ------- | ------------------ | +| 4.x.x | :white_check_mark: | + +## Reporting a Vulnerability + +Use this section to tell people how to report a vulnerability. + +Tell them where to go, how often they can expect to get an update on a +reported vulnerability, what to expect if the vulnerability is accepted or +declined, etc. From a0c989ad948c20aafa50a780ee2b02165ea7539b Mon Sep 17 00:00:00 2001 From: Nephiaust <29741794+Nephiaust@users.noreply.github.com> Date: Sun, 3 Sep 2023 19:41:11 +0930 Subject: [PATCH 02/50] Create psalm.yml --- .github/workflows/psalm.yml | 38 +++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 .github/workflows/psalm.yml diff --git a/.github/workflows/psalm.yml b/.github/workflows/psalm.yml new file mode 100644 index 0000000..23a0e26 --- /dev/null +++ b/.github/workflows/psalm.yml @@ -0,0 +1,38 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: Psalm Security Scan + +on: + push: + branches: [ "master" ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ "master" ] + schedule: + - cron: '43 10 * * 6' + +permissions: + contents: read + +jobs: + php-security: + runs-on: ubuntu-latest + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status + + steps: + - name: Checkout code + uses: actions/checkout@v3 + + - name: Psalm Security Scan + uses: psalm/psalm-github-security-scan@f3e6fd9432bc3e44aec078572677ce9d2ef9c287 + + - name: Upload Security Analysis results to GitHub + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: results.sarif From 531359ac6bbcdd1606b19944a3d65cd93ef4db7d Mon Sep 17 00:00:00 2001 From: Nephiaust <29741794+Nephiaust@users.noreply.github.com> Date: Sun, 3 Sep 2023 19:50:20 +0930 Subject: [PATCH 03/50] Update psalm.yml --- .github/workflows/psalm.yml | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/.github/workflows/psalm.yml b/.github/workflows/psalm.yml index 23a0e26..3e892a5 100644 --- a/.github/workflows/psalm.yml +++ b/.github/workflows/psalm.yml @@ -12,7 +12,7 @@ on: # The branches below must be a subset of the branches above branches: [ "master" ] schedule: - - cron: '43 10 * * 6' + - cron: '27 4 * * 5' permissions: contents: read @@ -31,6 +31,20 @@ jobs: - name: Psalm Security Scan uses: psalm/psalm-github-security-scan@f3e6fd9432bc3e44aec078572677ce9d2ef9c287 + with: + security_analysis: true + report_file: results.sarif + + - name: Upload Security Analysis results to GitHub + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: results.sarif + + - name: Psalm – Static Analysis for PHP + uses: psalm/psalm-github-actions@2.3.0 + with: + security_analysis: true + report_file: results.sarif - name: Upload Security Analysis results to GitHub uses: github/codeql-action/upload-sarif@v2 From 9fc8263323834b0d69ff9df6c7a775f86954fe9b Mon Sep 17 00:00:00 2001 From: Nephiaust <29741794+Nephiaust@users.noreply.github.com> Date: Sun, 3 Sep 2023 19:52:51 +0930 Subject: [PATCH 04/50] Update psalm.yml --- .github/workflows/psalm.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/psalm.yml b/.github/workflows/psalm.yml index 3e892a5..97bade1 100644 --- a/.github/workflows/psalm.yml +++ b/.github/workflows/psalm.yml @@ -31,9 +31,6 @@ jobs: - name: Psalm Security Scan uses: psalm/psalm-github-security-scan@f3e6fd9432bc3e44aec078572677ce9d2ef9c287 - with: - security_analysis: true - report_file: results.sarif - name: Upload Security Analysis results to GitHub uses: github/codeql-action/upload-sarif@v2 From 4bea39d6ff6c54c66d6f52f2d51a16bf3f9c5611 Mon Sep 17 00:00:00 2001 From: Nephiaust <29741794+Nephiaust@users.noreply.github.com> Date: Sun, 3 Sep 2023 19:54:41 +0930 Subject: [PATCH 05/50] Disabled composer requirements --- .github/workflows/psalm.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/psalm.yml b/.github/workflows/psalm.yml index 97bade1..8fd28e2 100644 --- a/.github/workflows/psalm.yml +++ b/.github/workflows/psalm.yml @@ -31,6 +31,9 @@ jobs: - name: Psalm Security Scan uses: psalm/psalm-github-security-scan@f3e6fd9432bc3e44aec078572677ce9d2ef9c287 + with: + composer_require_dev: false + composer_ignore_platform_reqs: false - name: Upload Security Analysis results to GitHub uses: github/codeql-action/upload-sarif@v2 @@ -40,6 +43,8 @@ jobs: - name: Psalm – Static Analysis for PHP uses: psalm/psalm-github-actions@2.3.0 with: + composer_require_dev: false + composer_ignore_platform_reqs: false security_analysis: true report_file: results.sarif From 11d79c349e5459dfe95ddf16abe0dd7c30b8d544 Mon Sep 17 00:00:00 2001 From: Nephiaust <29741794+Nephiaust@users.noreply.github.com> Date: Sun, 3 Sep 2023 19:58:57 +0930 Subject: [PATCH 06/50] Reset of palm... --- .github/workflows/psalm.yml | 51 ++++++++----------------------------- 1 file changed, 10 insertions(+), 41 deletions(-) diff --git a/.github/workflows/psalm.yml b/.github/workflows/psalm.yml index 8fd28e2..c9aaa71 100644 --- a/.github/workflows/psalm.yml +++ b/.github/workflows/psalm.yml @@ -1,54 +1,23 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. +name: Psalm Static analysis -name: Psalm Security Scan - -on: - push: - branches: [ "master" ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ "master" ] - schedule: - - cron: '27 4 * * 5' - -permissions: - contents: read +on: [push, pull_request] jobs: - php-security: + psalm: + name: Psalm runs-on: ubuntu-latest - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status - steps: - name: Checkout code - uses: actions/checkout@v3 - - - name: Psalm Security Scan - uses: psalm/psalm-github-security-scan@f3e6fd9432bc3e44aec078572677ce9d2ef9c287 - with: - composer_require_dev: false - composer_ignore_platform_reqs: false + uses: actions/checkout@v2 - - name: Upload Security Analysis results to GitHub - uses: github/codeql-action/upload-sarif@v2 + - name: Psalm + uses: docker://ghcr.io/psalm/psalm-github-actions:5.7.7 with: - sarif_file: results.sarif - - - name: Psalm – Static Analysis for PHP - uses: psalm/psalm-github-actions@2.3.0 - with: - composer_require_dev: false - composer_ignore_platform_reqs: false + composer_require_dev: true + composer_ignore_platform_reqs: true security_analysis: true report_file: results.sarif - - name: Upload Security Analysis results to GitHub - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@v1 with: sarif_file: results.sarif From 5cff19d05f2d31b2ceee7be7023d5bdb7c3fff27 Mon Sep 17 00:00:00 2001 From: Nephiaust <29741794+Nephiaust@users.noreply.github.com> Date: Sun, 3 Sep 2023 20:00:16 +0930 Subject: [PATCH 07/50] Update psalm.yml --- .github/workflows/psalm.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/psalm.yml b/.github/workflows/psalm.yml index c9aaa71..761fc67 100644 --- a/.github/workflows/psalm.yml +++ b/.github/workflows/psalm.yml @@ -13,7 +13,7 @@ jobs: - name: Psalm uses: docker://ghcr.io/psalm/psalm-github-actions:5.7.7 with: - composer_require_dev: true + composer_require_dev: false composer_ignore_platform_reqs: true security_analysis: true report_file: results.sarif From 5abfc628a49df401e8df30db74cbcf8fc474258b Mon Sep 17 00:00:00 2001 From: Nephiaust <29741794+Nephiaust@users.noreply.github.com> Date: Sun, 3 Sep 2023 20:04:18 +0930 Subject: [PATCH 08/50] Create composer.json --- composer.json | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 composer.json diff --git a/composer.json b/composer.json new file mode 100644 index 0000000..7a4a3e2 --- /dev/null +++ b/composer.json @@ -0,0 +1,34 @@ +{ + "authors": [ + { + "name": "Philipinho (Philip)", + "homepage": "https://github.com/Philipinho", + "role": "Developer" + }, + { + "name": "7s9n (Hussein Sarea)", + "homepage": "https://github.com/7s9n", + "role": "Contributor" + } + { + "name": "ankheur (Pierrick Rancoeur)", + "homepage": "https://github.com/ankheur", + "role": "Contributor" + } + { + "name": "terzinnorbert", + "homepage": "https://github.com/terzinnorbert", + "role": "Contributor" + } + { + "name": "myckgoncalves (Myck Gonçalves)", + "homepage": "https://github.com/myckgoncalves", + "role": "Contributor" + } + { + "name": "rastating", + "homepage": "https://github.com/rastating", + "role": "Contributor" + } + ] +} From 2f7fccd17c6d408c64b62fae293a5d111c97a8b9 Mon Sep 17 00:00:00 2001 From: Nephiaust <29741794+Nephiaust@users.noreply.github.com> Date: Sun, 3 Sep 2023 20:07:16 +0930 Subject: [PATCH 09/50] Update composer.json --- composer.json | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/composer.json b/composer.json index 7a4a3e2..10ea3b1 100644 --- a/composer.json +++ b/composer.json @@ -1,4 +1,9 @@ { + "name": "composer/composer", + "type": "library", + "description": "Composer helps you declare, manage and install dependencies of PHP projects. It ensures you have the right stack everywhere.", + "keywords": [ + ], "authors": [ { "name": "Philipinho (Philip)", @@ -9,26 +14,29 @@ "name": "7s9n (Hussein Sarea)", "homepage": "https://github.com/7s9n", "role": "Contributor" - } + }, { "name": "ankheur (Pierrick Rancoeur)", "homepage": "https://github.com/ankheur", "role": "Contributor" - } + }, { "name": "terzinnorbert", "homepage": "https://github.com/terzinnorbert", "role": "Contributor" - } + }, { "name": "myckgoncalves (Myck Gonçalves)", "homepage": "https://github.com/myckgoncalves", "role": "Contributor" - } + }, { "name": "rastating", "homepage": "https://github.com/rastating", "role": "Contributor" } - ] + ], + "require": { + "php": "^7.2.5 || ^8.0" + } } From 3fa8ddb5ae0ae9b23b5434a30f12abbb4075a899 Mon Sep 17 00:00:00 2001 From: Nephiaust <29741794+Nephiaust@users.noreply.github.com> Date: Sun, 3 Sep 2023 20:11:09 +0930 Subject: [PATCH 10/50] Updated to Upload-sarif@v2 Also removed stuff about composer, since a basic one exists to satisfy requirements for one. --- .github/workflows/psalm.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/psalm.yml b/.github/workflows/psalm.yml index 761fc67..9f7d5a9 100644 --- a/.github/workflows/psalm.yml +++ b/.github/workflows/psalm.yml @@ -13,11 +13,9 @@ jobs: - name: Psalm uses: docker://ghcr.io/psalm/psalm-github-actions:5.7.7 with: - composer_require_dev: false - composer_ignore_platform_reqs: true security_analysis: true report_file: results.sarif - name: Upload Security Analysis results to GitHub - uses: github/codeql-action/upload-sarif@v1 + uses: github/codeql-action/upload-sarif@v2 with: sarif_file: results.sarif From 9224ce9fe1fbe17a2f6eaa82ab3d873a4d34fe76 Mon Sep 17 00:00:00 2001 From: Nephiaust <29741794+Nephiaust@users.noreply.github.com> Date: Sun, 3 Sep 2023 20:19:32 +0930 Subject: [PATCH 11/50] Added permissions to code scan --- .github/workflows/psalm.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.github/workflows/psalm.yml b/.github/workflows/psalm.yml index 9f7d5a9..aa9764a 100644 --- a/.github/workflows/psalm.yml +++ b/.github/workflows/psalm.yml @@ -4,6 +4,20 @@ on: [push, pull_request] jobs: psalm: + permissions: + actions: read + checks: read + contents: read + deployments: none + id-token: none + issues: write + discussions: read + packages: read + pages: none + pull-requests: write + repository-projects: read + security-events: write + statuses: write name: Psalm runs-on: ubuntu-latest steps: From 6ba29edc71ab9aedf4bb4553a355773d7109a309 Mon Sep 17 00:00:00 2001 From: Nephiaust <29741794+Nephiaust@users.noreply.github.com> Date: Sun, 3 Sep 2023 20:27:46 +0930 Subject: [PATCH 12/50] Back ported code from donejeh https://github.com/donejeh/Simple-PHP-Blog/commit/6f211f7748b3f289bee6ae0600f11ab6c7e9dd83 --- admin.php | 1 + 1 file changed, 1 insertion(+) diff --git a/admin.php b/admin.php index 6a0163e..8edab0c 100644 --- a/admin.php +++ b/admin.php @@ -61,6 +61,7 @@
"; ?>
Welcome ,
- - +"; ?>
"; + echo '
"; - echo substr($des, 0, 100); + echo substr($des, 0, 100); - echo '
'; -} + echo '- +
@@ -44,7 +45,7 @@
"; + echo '
"; - echo substr($des, 0, 100); + echo substr($des, 0, 100); - echo '