mirror of
https://github.com/HolgerHatGarKeineNode/einundzwanzig-app.git
synced 2026-05-05 04:54:53 +00:00
Claude
d46c0161fe
- Trust the Forge reverse proxy and force https URLs in production so generated absolute URLs match the actual TLS termination. - Reject Nostr profile photo URLs that aren't http(s) or that resolve to loopback / private (RFC1918) addresses to close an SSRF vector in FetchNostrProfileJob. - Tighten image upload validation across meetup, course, and lecturer create/edit components: explicit mimes whitelist (jpeg, png, webp), max 5 MiB, and dimension cap of 4000x4000. - Replace the silent "skip if exists" branch in LnurlAuthController with updateOrCreate so concurrent callers cannot race on the k1 record. - Validate github_data on Meetup edit, decoding the JSON, and keep only the whitelisted keys (top, left, state) with strict type coercion to prevent storing arbitrary attacker-controlled JSON.
70 lines
1.8 KiB
PHP
70 lines
1.8 KiB
PHP
<?php
|
|
|
|
namespace App\Providers;
|
|
|
|
use App\Support\Carbon;
|
|
use Illuminate\Cache\RateLimiting\Limit;
|
|
use Illuminate\Contracts\Auth\Authenticatable;
|
|
use Illuminate\Database\Eloquent\Model;
|
|
use Illuminate\Foundation\Events\DiagnosingHealth;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\Date;
|
|
use Illuminate\Support\Facades\Event;
|
|
use Illuminate\Support\Facades\RateLimiter;
|
|
use Illuminate\Support\Facades\Route;
|
|
use Illuminate\Support\Facades\URL;
|
|
use Illuminate\Support\ServiceProvider;
|
|
use Laravel\Nightwatch\Facades\Nightwatch;
|
|
use Laravel\Nightwatch\Http\Middleware\Sample;
|
|
use Livewire\Livewire;
|
|
|
|
class AppServiceProvider extends ServiceProvider
|
|
{
|
|
/**
|
|
* Register any application services.
|
|
*/
|
|
public function register(): void
|
|
{
|
|
Date::use(
|
|
Carbon::class
|
|
);
|
|
}
|
|
|
|
/**
|
|
* Bootstrap any application services.
|
|
*/
|
|
public function boot(): void
|
|
{
|
|
$this->configureRateLimiting();
|
|
|
|
if ($this->app->environment('production')) {
|
|
URL::forceScheme('https');
|
|
}
|
|
|
|
Livewire::setUpdateRoute(function ($handle) {
|
|
return Route::post('/livewire/update', $handle)
|
|
->middleware(['web', Sample::rate(0)]);
|
|
});
|
|
|
|
Nightwatch::user(fn (Authenticatable $user) => [
|
|
'name' => $user->name,
|
|
]);
|
|
|
|
Event::listen(function (DiagnosingHealth $event) {
|
|
Nightwatch::dontSample();
|
|
});
|
|
|
|
Model::preventLazyLoading(app()->environment('local'));
|
|
}
|
|
|
|
/**
|
|
* Configure the rate limiters for the application.
|
|
*/
|
|
protected function configureRateLimiting(): void
|
|
{
|
|
RateLimiter::for('calendar', function (Request $request) {
|
|
return Limit::perMinute(60)->by($request->ip());
|
|
});
|
|
}
|
|
}
|