br0tkasten/ansible-role-gravcms
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

fix: update settings for new grav and php82

Browse Source
This commit is contained in:
arne
2025-03-23 11:50:38 +01:00
parent 1ae0700a8c
commit 572a5ab0d0
5 changed files with 71 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files

61
files/lighttpd-grav.conf
View File

@ -1,39 +1,40 @@
##PREVENTING EXPLOITS
#$HTTP["querystring"] =~ "base64_encode[^(]*\([^)]*\)" {
# url.redirect = (".*" => "/index.php" )
#}
#$HTTP["querystring"] =~ "(<|%3C)([^s]*s)+cript.*(>|%3E)" {
# url.redirect = (".*" => "/index.php" )
#}
#$HTTP["querystring"] =~ "GLOBALS(=|\[|\%[0-9A-Z])" {
# url.redirect = (".*" => "/index.php" )
#}
#$HTTP["querystring"] =~ "_REQUEST(=|\[|\%[0-9A-Z])" {
# url.redirect = (".*" => "/index.php" )
#}
server.modules += ( "mod_redirect" )
#PREVENTING EXPLOITS
$HTTP["querystring"] =~ "base64_encode[^(]*\([^)]*\)" {
url.redirect = (".*" => "/index.php" )
}
$HTTP["querystring"] =~ "(<|%3C)([^s]*s)+cript.*(>|%3E)" {
url.redirect = (".*" => "/index.php" )
}
$HTTP["querystring"] =~ "GLOBALS(=|\[|\%[0-9A-Z])" {
url.redirect = (".*" => "/index.php" )
}
$HTTP["querystring"] =~ "_REQUEST(=|\[|\%[0-9A-Z])" {
url.redirect = (".*" => "/index.php" )
}
#REROUTING TO THE INDEX PAGE
url.rewrite-if-not-file = (
"^/(.*)$" => "/index.php/$1"
"^/(.*)$" => "/index.php?$1"
)
##IMPROVING SECURITY
#$HTTP["url"] =~ "^/(LICENSE.txt|composer.json|composer.lock|nginx.conf|web.config)$" {
# url.access-deny = ("")
#}
#$HTTP["url"] =~ "^/(.git|cache|bin|logs|backup|tests)/(.*)" {
# url.access-deny = ("")
#}
#$HTTP["url"] =~ "^/(system|user|vendor)/(.*)\.(txt|md|html|yaml|php|twig|sh|bat)$" {
# url.access-deny = ("")
#}
#$HTTP["url"] =~ "^/(\.(.*))" {
# url.access-deny = ("")
#}
#url.access-deny = (".md","~",".inc")
#IMPROVING SECURITY
$HTTP["url"] =~ "^/(LICENSE\.txt|composer\.json|composer\.lock|nginx\.conf|web\.config)$" {
url.access-deny = ("")
}
$HTTP["url"] =~ "^/(\.git|cache|bin|logs|backup|tests)/(.*)" {
url.access-deny = ("")
}
$HTTP["url"] =~ "^/(system|user|vendor)/(.*)\.(txt|md|html|htm|shtml|shtm|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|twig|sh|bat)$" {
url.access-deny = ("")
}
$HTTP["url"] =~ "^/(\.(.*))" {
url.access-deny = ("")
}
url.access-deny += (".md","~",".inc")
#PREVENT BROWSING AND SET INDEXES
$HTTP["url"] =~ "^/($|/)" {
dir-listing.activate = "disable"
$HTTP["url"] =~ "^/grav_path($|/)" {
index-file.names = ( "index.php", "index.html" , "index.htm" )
}

2
files/lighttpd-php-cgi.conf
View File

@ -3,7 +3,7 @@ fastcgi.server = ( ".php" =>
( "localhost" =>
(
"socket" => "/run/lighttpd/lighttpd-fastcgi-php-" + PID + ".socket",
"bin-path" => "/usr/bin/php-cgi"
"bin-path" => "/usr/bin/php-cgi82"
)
)
)

7
files/update-grav Normal file
View File

@ -0,0 +1,7 @@
#!/bin/ash
HTDOC="/var/www/localhost/htdocs"
cd $HTDOC
sudo -u lighttpd ./bin/gpm selfupgrade -q -n -y
sudo -u lighttpd ./bin/gpm update -q -n -y