kzbkowskiandClaude Sonnet 5
b313c126ce
Config backup, a Docker dev/prod split, and a Gitea-built release image.
Added
- /settings -> General -> "Configuration backup": JSON export/import of the
panel's general settings + attribute definitions
(App\Services\ConfigBackupService); audited as config.export / config.import.
Export can leave out the attribute-encryption key. No AD data included.
- docker/compose.dev.yaml: live-reload dev stack that bind-mounts the working
tree. docker/php/Dockerfile is now multi-stage (base -> dev / prod).
- .github/workflows/release.yml: on every vX.Y.Z tag, builds the prod image and
pushes gitea.kzbikowski.pl/kzbkowski/adconsole:{X.Y.Z,X.Y,latest}.
Changed
- docker/compose.yaml: self-contained prod image (app code + composer install
--no-dev baked in via COPY); persistent state in docker/data/{app_storage,db};
defaults to the released image (ADCONSOLE_VERSION pins a tag, ADCONSOLE_IMAGE
replaces the ref). Apache now honours public/.htaccess (AllowOverride All).
Run from the repo root with --env-file .env.
- Repo root now holds only README.md; CHANGELOG / CONTRIBUTING / SECURITY /
CODE_OF_CONDUCT moved under docs/.
Upgrade notes: docs/upgrading.md#v110--docker-layout. Full log: docs/CHANGELOG.md.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JKT9p3bfP8RZesExdYCS52
54 lines
2.0 KiB
Markdown
54 lines
2.0 KiB
Markdown
# Security policy
|
|
|
|
## Reporting a vulnerability
|
|
|
|
**Please do not open a public issue for security problems.**
|
|
|
|
Email the maintainer at **`mail@kzbikowski.pl`** with the subject prefixed
|
|
`[ADconsole security]`. If the host offers private vulnerability reporting, that
|
|
channel is fine too.
|
|
|
|
Please include:
|
|
|
|
- affected version / commit
|
|
- a description and impact assessment
|
|
- reproduction steps or a proof of concept
|
|
- any suggested fix
|
|
|
|
You'll get an acknowledgement within a few working days. Please give a
|
|
reasonable window for a fix before public disclosure; we'll credit you in the
|
|
release notes unless you'd rather stay anonymous.
|
|
|
|
## Scope
|
|
|
|
In scope: authentication and the `AD_LOGIN_GROUP` gate, authorisation between
|
|
modules, LDAP query/filter construction (injection), handling of the service
|
|
account credentials, the attribute-encryption feature, session handling, CSRF,
|
|
XSS in the Blade views, privilege escalation via the bulk actions.
|
|
|
|
Out of scope: issues that require a already-privileged panel account performing
|
|
actions it is legitimately delegated to do in AD; missing hardening that is the
|
|
operator's responsibility (see below); vulnerabilities in Laravel, LdapRecord or
|
|
other dependencies (report those upstream — do tell us so we can pin/patch).
|
|
|
|
## Operator responsibilities
|
|
|
|
ADconsole is a privileged tool. When you deploy it, **you** are responsible for:
|
|
|
|
- Serving it over HTTPS only, reachable from admin networks / VPN only.
|
|
- `APP_DEBUG=false`, `APP_ENV=production`.
|
|
- An encrypted LDAP channel (`LDAP_SSL` / `LDAP_TLS`) and, ideally,
|
|
`LDAP_TLS_VERIFY=true`.
|
|
- Delegating the service account **only** the AD rights you actually use
|
|
([active-directory.md](active-directory.md)).
|
|
- Keeping `AD_LOGIN_GROUP` small and audited.
|
|
- Protecting `.env` (file mode `600`) — it contains the service-account password.
|
|
- Applying updates promptly.
|
|
|
|
See the [hardening checklist](deployment.md#hardening-checklist).
|
|
|
|
## Supported versions
|
|
|
|
The latest release on `main` receives security fixes. This is a
|
|
community/self-hosted project with no long-term-support branches.
|