comprehensive security hardening

This release includes major security enhancements, addressing all remaining vulnerability findings from the recent penetration test report.
* Security: Implement global CSRF protection for all AJAX requests via `ci4ms.js` prefilter and clear `csrfExcept` arrays.
* Security: Hide PHP version disclosure by actively removing the `X-Powered-By` header.
* Security: Enforce `cookie.secure = true` for session protection against MitM attacks.
* Security: Replace plaintext passwords in DevGate configuration with Bcrypt hashes.
* Security: Eliminate raw `$_SERVER` superglobal reads across core classes, replacing them with CI4 native helpers (BULGU-10).
* Security: Implement strict file extension blacklisting (.php, .phtml, etc.) and boundary validation in Fileeditor to prevent RCE.
* Security: Restrict DbBackup SQL restore with a strict statement whitelist to prevent malicious database manipulation.
* Security: Upgrade HTMLPurifier to block base64 image data URIs and filter dangerous CSS properties.
* Docs: Update CHANGELOG.md, README.md, and developer handbook with the new Security Architecture specifications.

Author: bertugfahriozer

CHANGELOG.md

@@ -4,6 +4,24 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html) conventions adapted to the existing four-component version numbers.
 
+## [0.31.9.0] - 2026-05-01
+
+### Security
+
+- **CSRF Architecture Overhaul:** Implemented centralized `ajaxPrefilter` in `ci4ms.js` for automatic CSRF token injection on all AJAX requests. elFinder route exempted from CSRF via `MediaConfig::$csrfExcept` to prevent stale-token 403 errors during multi-request operations.
+- **HTMLPurifier Hardening:** Removed `data:` URI scheme from `AllowedSchemes` to block `data:text/html;base64` XSS bypass attacks (Base64 images use a custom placeholder mechanism). Disabled `CSS.Trusted` to filter dangerous CSS properties. Enabled `HTML.TargetBlank` for automatic `rel="noopener noreferrer"` on external links. Ensured Blog and Pages controllers always persist `CustomRules::getClean()` sanitized content to the database.
+- **IP Spoofing Fix:** Removed raw `$_SERVER['HTTP_X_FORWARDED_FOR']` and `$_SERVER['HTTP_CLIENT_IP']` reads from `BackendLogFilter`. Now relies solely on CI4's `$request->getIPAddress()` which respects `App.proxyIPs` config for trusted proxy detection.
+- **Raw `$_SERVER` Elimination:** Replaced all raw `$_SERVER['HTTP_HOST']`, `$_SERVER['HTTPS']`, and `$_SERVER['SERVER_NAME']` reads with CI4's `base_url()`, `site_url()`, and `parse_url()` helpers across `Email.php`, `Ci4ms.php`, `Install.php`, and `Settings.php`.
+- **Fileeditor RCE Prevention:** Added `$dangerousExtensions` blacklist (`.php`, `.phtml`, `.phar`, `.htaccess`, etc.) to block creating, writing, or renaming executable files via the file editor. Added `file_exists()` overwrite protection for `createFile` and `realpath` boundary validation for `renameFile`.
+- **SQL Restore Hardening:** Implemented a SQL statement whitelist (`INSERT`, `CREATE TABLE`, `DROP TABLE`, etc.) and dangerous command blacklist (`LOAD_FILE`, `INTO OUTFILE`, `GRANT`, `xp_cmdshell`, etc.) in `DbBackup::restore()`. Added path traversal protection requiring backup files to reside within `WRITEPATH`.
+- **Hardcoded Credentials:** Removed plaintext passwords from `DevGate` configuration. Implemented `bcrypt` hashed passwords and enabled `$useHashedPasswords` by default to protect developer credentials.
+
+### Changed
+
+- **DevGate CLI Sync:** `php spark ci4ms:setup` now automatically updates `DevGate.php` with the admin credentials provided during installation, matching the web installer's behaviour.
+- **Proxy Configuration:** Added comprehensive Cloudflare and Nginx reverse proxy configuration examples as comments in `App.php::$proxyIPs`.
+- **URI Schemes:** Removed unused `nntp` and `news` URI schemes from HTMLPurifier configuration.
+
 ## [0.31.8.0] - 2026-04-19
 
 ### Fixed
@@ -293,6 +311,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 
 - Expanded database migrations and introduced new supporting libraries.
 
+[0.31.8.1]: https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.8.1
 [0.31.8.0]: https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.8.0
 [0.31.7.0]: https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.7.0
 [0.31.6.0]: https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.6.0

README.md

@@ -5,7 +5,7 @@ CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo
 [![Release](https://img.shields.io/github/v/release/ci4-cms-erp/ci4ms?style=for-the-badge&label=release)](https://github.com/ci4-cms-erp/ci4ms/releases)
 [![License](https://img.shields.io/github/license/ci4-cms-erp/ci4ms?style=for-the-badge)](https://github.com/ci4-cms-erp/ci4ms/blob/main/LICENSE)
 [![Build](https://img.shields.io/github/actions/workflow/status/ci4-cms-erp/ci4ms/docker-test.yml?style=for-the-badge&label=build)](https://github.com/ci4-cms-erp/ci4ms/actions)
-![PHP](https://img.shields.io/badge/PHP-%3E%3D8.1-777BB4?style=for-the-badge&logo=php&logoColor=white)
+![PHP](https://img.shields.io/badge/PHP-%3E%3D8.2-777BB4?style=for-the-badge&logo=php&logoColor=white)
 ![CodeIgniter](https://img.shields.io/badge/CodeIgniter-4.x-EF4223?style=for-the-badge&logo=codeigniter&logoColor=white)
 ![Packagist Downloads](https://img.shields.io/packagist/dt/ci4-cms-erp/ci4ms?style=for-the-badge)
 [![Stars](https://img.shields.io/github/stars/ci4-cms-erp/ci4ms?style=for-the-badge)](https://github.com/ci4-cms-erp/ci4ms/stargazers)
@@ -22,6 +22,7 @@ CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo
 - **Flexible content management:** Page and blog entries include SEO metadata, categories, tags, and full comment workflows.
 - **Media & files:** Includes elFinder-powered media management, a built-in file editor, and an in-panel log viewer.
 - **Automatic Updates:** Modernized `UpdateService` provides a "One-Click Update" system with atomic file operations, automated GitHub version discovery (bypassing 300-file limits), and secure rollback management.
+- **Security Architecture:** Global CSRF protection across all AJAX endpoints, strict HTTP security headers (CSP, HSTS, X-Frame-Options), executable file upload blacklists, and HTMLPurifier sanitization to prevent XSS and RCE attacks.
 - **Backup Support:** Updates automatically trigger a full backup of modified files before applying patches, with a dedicated management interface for restores.
 - **Theme system:** The `public/templates/*` structure and the `Modules\Theme` module enable installing or upgrading themes from ZIP packages.
 - **Setup & automation:** Offers a web-based installer (`/install`) plus a single CLI command (`php spark ci4ms:setup`) for automated installation, default data seeding, and route generation. Module scaffolding is available via `php spark make:module`.
@@ -142,15 +143,15 @@ Key files:
 | Pages            | Static page management     | SEO fields, inline shortcode parsing                  |
 | Menu             | Menu builder               | Drag-and-drop ordering, slug helpers                  |
 | Media            | Media manager              | elFinder integration, optional WebP conversion        |
-| Fileeditor       | Project file editor        | Safe read/write/rename/move/delete                    |
+| Fileeditor       | Project file editor        | Safe read/write/rename; dangerous extension blacklist |
 | Settings         | System configuration       | One-click updates, company/social/mail settings, i18n support |
 | Users            | User & role management     | Shield groups, reset tracking                         |
 | Methods          | Route → permission mapping | Module toggling, router scan                          |
 | Logs             | Log viewer                 | Browses CodeIgniter log files inside the backend      |
 | ModulesInstaller | Module ZIP installer       | Upload + cache invalidation                           |
 | Theme            | Theme manager              | ZIP upload, DB migration support, duplicate checks    |
 | Install          | Web installer              | Creates `.env`, triggers migrations                   |
-| Backup           | Database backup manager    | Create, download, and restore backups                 |
+| Backup           | Database backup manager    | Create, download, and restore with SQL sanitization   |
 | DashboardWidgets | Dashboard statistics       | Modular widget system for admin overview              |
 | LanguageManager  | Language file manager      | Edit and manage translation files from the backend    |
 
@@ -184,7 +185,7 @@ Standard CodeIgniter commands (`php spark db:seed`, `php spark key:generate`, et
 - `composer test` — runs PHPUnit.
 - The GitHub Actions workflow (`.github/workflows/docker-test.yaml`) automatically builds the Docker image and runs migrations on every push to `master`.
 - **Maintenance mode**: When `settings.maintenanceMode.scalar == 1`, the `Ci4ms` filter redirects visitors to `maintenance-mode`.
-- **Security**: `Fileeditor` and `Media` enforce `realpath` guards. Limit access in production environments.
+- **Security**: `Fileeditor` enforces `realpath` guards and a dangerous extension blacklist (`.php`, `.phtml`, `.phar`, `.htaccess`) to prevent RCE. `Backup` restore uses SQL statement whitelist to block malicious queries (`LOAD_FILE`, `GRANT`, etc.). `HTMLPurifier` config is hardened against XSS bypass (`data:` URIs blocked, `CSS.Trusted` disabled). All `$_SERVER` reads replaced with CI4 `base_url()`/`site_url()` helpers. Configure `App.php::$proxyIPs` if behind Cloudflare/Nginx.
 
 ## Additional Docs
 

app/Config/App.php

@@ -212,6 +212,38 @@ public function __construct()
      *         '192.168.5.0/24' => 'X-Real-IP',
      *     ]
      *
+     * ── Cloudflare Example ──
+     * If your site is behind Cloudflare, add their IP ranges below.
+     * Full list: https://www.cloudflare.com/ips/
+     *
+     *     [
+     *         '173.245.48.0/20'  => 'CF-Connecting-IP',
+     *         '103.21.244.0/22'  => 'CF-Connecting-IP',
+     *         '103.22.200.0/22'  => 'CF-Connecting-IP',
+     *         '103.31.4.0/22'    => 'CF-Connecting-IP',
+     *         '141.101.64.0/18'  => 'CF-Connecting-IP',
+     *         '108.162.192.0/18' => 'CF-Connecting-IP',
+     *         '190.93.240.0/20'  => 'CF-Connecting-IP',
+     *         '188.114.96.0/20'  => 'CF-Connecting-IP',
+     *         '197.234.240.0/22' => 'CF-Connecting-IP',
+     *         '198.41.128.0/17'  => 'CF-Connecting-IP',
+     *         '162.158.0.0/15'   => 'CF-Connecting-IP',
+     *         '104.16.0.0/13'    => 'CF-Connecting-IP',
+     *         '104.24.0.0/14'    => 'CF-Connecting-IP',
+     *         '172.64.0.0/13'    => 'CF-Connecting-IP',
+     *         '131.0.72.0/22'    => 'CF-Connecting-IP',
+     *     ]
+     *
+     * ── Nginx Reverse Proxy Example ──
+     * If your app runs behind a local Nginx proxy:
+     *
+     *     [
+     *         '127.0.0.1'      => 'X-Real-IP',
+     *         '10.0.0.0/8'     => 'X-Forwarded-For',
+     *         '172.16.0.0/12'  => 'X-Forwarded-For',
+     *         '192.168.0.0/16' => 'X-Forwarded-For',
+     *     ]
+     *
      * @var array<string, string>
      */
     public array $proxyIPs = [];

app/Config/ContentSecurityPolicy.php

@@ -54,21 +54,33 @@ class ContentSecurityPolicy extends BaseConfig
      *
      * @var list<string>|string
      */
-    public $scriptSrc = 'self';
+    public $scriptSrc = [
+        'self',
+        'unsafe-inline',
+        'unsafe-eval'
+    ];
 
     /**
      * Lists allowed stylesheets' URLs.
      *
      * @var list<string>|string
      */
-    public $styleSrc = 'self';
+    public $styleSrc = [
+        'self',
+        'unsafe-inline',
+        'https://fonts.googleapis.com'
+    ];
 
     /**
      * Defines the origins from which images can be loaded.
      *
      * @var list<string>|string
      */
-    public $imageSrc = 'self';
+    public $imageSrc = [
+        'self',
+        'data:',
+        'https://*'
+    ];
 
     /**
      * Restricts the URLs that can appear in a page's `<base>` element.
@@ -99,7 +111,11 @@ class ContentSecurityPolicy extends BaseConfig
      *
      * @var list<string>|string
      */
-    public $fontSrc;
+    public $fontSrc = [
+        'self',
+        'https://fonts.gstatic.com',
+        'data:'
+    ];
 
     /**
      * Lists valid endpoints for submission from `<form>` tags.
@@ -172,5 +188,5 @@ class ContentSecurityPolicy extends BaseConfig
     /**
      * Replace nonce tag automatically
      */
-    public bool $autoNonce = true;
+    public bool $autoNonce = false;
 }

app/Config/Email.php

@@ -139,8 +139,9 @@ public function __construct()
         }
 
         if (isset($settings->mail)) {
-            $this->fromEmail  = 'noreply@' . $_SERVER['HTTP_HOST'];
-            $this->fromName   = 'noreply@' . $_SERVER['HTTP_HOST'];
+            $host = parse_url(base_url(), PHP_URL_HOST) ?: 'localhost';
+            $this->fromEmail  = 'noreply@' . $host;
+            $this->fromName   = 'noreply@' . $host;
             $this->recipients = $settings->mail->recipients ?? '';
 
             $mailConfig = $settings->mail;

app/Controllers/BaseController.php

@@ -21,6 +21,16 @@
  *     class Home extends BaseController
  *
  * For security be sure to declare any new methods as protected or private.
+ *
+ * @package App\Controllers
+ *
+ * @property \CodeIgniter\HTTP\IncomingRequest $request
+ * @property \CodeIgniter\HTTP\Response $response
+ * @property \Psr\Log\LoggerInterface $logger
+ * @property \CodeIgniter\Session\Session $session
+ * @property \CodeIgniter\Validation\ValidationInterface $validator
+ * @property \ci4commonmodel\CommonModel $commonModel
+ * @property \Modules\LanguageManager\Libraries\TranslationService $translationService
  */
 abstract class BaseController extends Controller
 {
@@ -177,7 +187,7 @@ protected function getDefaultData(): array
             'alternateLinks' => [], // Default empty, filled by child controllers
             'seoConfig'      => new Seo()
         ];
-        if(is_cli()) $defData['agent']='CLI';
+        if (is_cli()) $defData['agent'] = 'CLI';
         else $defData['agent'] = $this->request->getUserAgent();
 
         // If languages are empty in cache, load them (fallback)

app/Filters/Ci4ms.php

@@ -35,8 +35,7 @@ public function __construct()
     public function before(RequestInterface $request, $arguments = null)
     {
         if (!file_exists(ROOTPATH . '.env')) {
-            $protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? "https://" : "http://";
-            return redirect()->to($protocol . $_SERVER['SERVER_NAME'] . '/install');
+            return redirect()->to(site_url('install'));
         }
         if ((bool)cache()->get('settings')['maintenanceMode']->scalar === true) return redirect()->route('maintenance-mode');
     }

app/Views/templates/default/base.php

@@ -24,7 +24,7 @@
         <link href="<?php echo base_url('templates/default/assets/ci4ms.css') ?>" rel="stylesheet" />
     <?php endif; ?>
     <link href="<?php echo base_url('templates/default/assets/modern-ci4ms.css') ?>" rel="stylesheet" />
-    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.11.3/font/bootstrap-icons.min.css">
+    <link rel="stylesheet" type="text/css" href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.11.3/font/bootstrap-icons.min.css">
 
     <link href="<?php echo base_url('be-assets/plugins/jquery-ui/jquery-ui.min.css') ?>" rel="stylesheet" />
     <?php $isMulti = ($settings->siteLanguageMode ?? 'single') === 'multi';

composer.json

@@ -17,17 +17,18 @@
         "bertugfahriozer/sql2migration": "^1.0",
         "ci4-cms-erp/ext_module_generator": "^1.1",
         "claviska/simpleimage": "4.4.0",
-        "codeigniter4/framework": "4.7.1",
+        "codeigniter4/framework": "4.7.2",
         "codeigniter4/settings": "2.2",
         "codeigniter4/shield": "1.3.0",
-        "codeigniter4/translations": "4.7.0",
+        "codeigniter4/translations": "4.7.2",
         "ezyang/htmlpurifier": "4.19",
         "gregwar/captcha": "1.3.0",
         "studio-42/elfinder": "2.1.67"
     },
     "require-dev": {
         "fakerphp/faker": "^1.9",
         "mikey179/vfsstream": "^1.6",
+        "phpstan/phpstan": "^2.1",
         "phpunit/phpunit": "^10.5.16"
     },
     "autoload": {
@@ -54,5 +55,7 @@
     },
     "scripts": {
         "test": "phpunit"
-    }
+    },
+    "minimum-stability": "dev",
+    "prefer-stable": true
 }