jric11/huntingclubroster
1
0
Fork 0
generated from jric11/baseProject
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Chat's updates for security, db and workflow
Security and workflow regressions / regression (push) Has been cancelled
Details

Browse Source
This commit is contained in:
James Richie
2026-10-20 06:45:30 -04:00
parent 02223083f6
commit 1e63076123
116 changed files with 3252 additions and 2932 deletions
Download Patch File Download Diff File Expand all files Collapse all files
main.php
+14 -4
View File
@@ -1,18 +1,28 @@
<?php
declare(strict_types=1);
ini_set('display_errors','0');
ini_set('log_errors','1');
header('X-Content-Type-Options: nosniff');
header('Referrer-Policy: no-referrer');
header('X-Frame-Options: DENY');
header('Cache-Control: no-store');
set_exception_handler(function (Throwable $e): void {
error_log((string) $e);
http_response_code(500);
echo 'The application could not complete this request. Please try again later.';
$status=$e instanceof AppException?$e->status:($e instanceof InvalidArgumentException?422:500);
$message=$status<500?$e->getMessage():'The application could not complete this request. Please try again later.';
if($e instanceof PDOException && $e->getCode()==='23000'){$status=409;$message='This record already exists or is still referenced by another record.';}
if($status>=500)error_log((string)$e);
http_response_code($status);
if(strtolower($_SERVER['HTTP_X_REQUESTED_WITH']??'')==='xmlhttprequest'){
header('Content-Type: application/json');echo json_encode(['ok'=>false,'error'=>$message]);
}else{header('Content-Type: text/html; charset=UTF-8');echo '<!doctype html><html lang="en"><title>Request could not be completed</title><main><h1>Request could not be completed</h1><p>'.htmlspecialchars($message,ENT_QUOTES,'UTF-8').'</p><p><a href="main.php">Return to the application</a></p></main></html>';}
});
require_once __DIR__ . '/classes/Base.php';
$application = new Base();
$https = !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off';
$https = Transport::https($_SERVER,getenv('HCR_TRUSTED_PROXIES')?:'');
header("Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'");
header('Permissions-Policy: camera=(), microphone=(), geolocation=()');
if($https&&(string)$application->getSettings()->Environment==='Production')header('Strict-Transport-Security: max-age=31536000');
if ((string) $application->getSettings()->Environment === 'Production' && !$https) {
http_response_code(400);
exit('HTTPS is required. Open the secure application URL.');