Harden auth, add subtitles, vendor all assets locally
- Session cookies are HttpOnly + SameSite=Lax (Secure on HTTPS), with strict session-ID mode; the CSRF token from GET api/auth.php must now accompany every state-changing request (X-CSRF-Token header, or a csrf body field for the sendBeacon progress save), rotated at login. - Failed sign-ins are throttled per username and IP via login_attempts (created lazily, so existing installs need no migration): 5 failures a username / 20 an IP inside 15 minutes answer 429 with Retry-After. - A video's sibling .srt now appears as a CC button in the player; captions.php converts it to WebVTT (comma timestamps, legacy encodings, and the already-VTT files with out-of-spec 6-digit fractions). - Plyr and Inter ship in assets/vendor/ instead of coming from CDNs, and anime.js is gone along with all scripted animations and the motion setting — the app now runs with no internet access at all. - .htaccess denies direct access to videos/, includes/, config.php and schema.sql, so video URLs cannot bypass login on Apache. Claude-Session: https://claude.ai/code/session_01SePf61iazhCLJBefdRLBDm
This commit is contained in:
Harwinder Sekhon
@@ -2,6 +2,16 @@
|
||||
require_once __DIR__ . '/db.php';
|
||||
|
||||
if (session_status() === PHP_SESSION_NONE) {
|
||||
// Reject session IDs the server never issued (blocks session fixation),
|
||||
// and keep the cookie away from scripts and cross-site requests.
|
||||
ini_set('session.use_strict_mode', '1');
|
||||
session_set_cookie_params([
|
||||
'lifetime' => 0,
|
||||
'path' => '/',
|
||||
'secure' => !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off',
|
||||
'httponly' => true,
|
||||
'samesite' => 'Lax',
|
||||
]);
|
||||
session_start();
|
||||
}
|
||||
|
||||
@@ -10,6 +20,33 @@ function currentUserId(): ?int
|
||||
return isset($_SESSION['user_id']) ? (int)$_SESSION['user_id'] : null;
|
||||
}
|
||||
|
||||
/* ---------------------------------------------------------------------------
|
||||
* CSRF
|
||||
* The token lives in the session and reaches the SPA via GET api/auth.php
|
||||
* (and again in the login/register response, since login rotates it). Every
|
||||
* state-changing request must echo it back — fetch() sends the X-CSRF-Token
|
||||
* header; sendBeacon() can't set headers, so a `csrf` body field counts too.
|
||||
* ------------------------------------------------------------------------- */
|
||||
function csrfToken(): string
|
||||
{
|
||||
if (empty($_SESSION['csrf_token'])) {
|
||||
$_SESSION['csrf_token'] = bin2hex(random_bytes(16));
|
||||
}
|
||||
return $_SESSION['csrf_token'];
|
||||
}
|
||||
|
||||
/** 403s the request unless it carries the session's CSRF token. */
|
||||
function verifyCsrfApi(?array $body = null): void
|
||||
{
|
||||
$sent = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? $body['csrf'] ?? '';
|
||||
if (!is_string($sent) || $sent === '' || !hash_equals(csrfToken(), $sent)) {
|
||||
http_response_code(403);
|
||||
header('Content-Type: application/json');
|
||||
echo json_encode(['error' => 'Invalid session token — reload the page and try again.']);
|
||||
exit;
|
||||
}
|
||||
}
|
||||
|
||||
function currentUsername(): ?string
|
||||
{
|
||||
return $_SESSION['username'] ?? null;
|
||||
@@ -44,6 +81,7 @@ function attemptLogin(string $username, string $password): bool
|
||||
$user = $stmt->fetch();
|
||||
if ($user && password_verify($password, $user['password_hash'])) {
|
||||
session_regenerate_id(true);
|
||||
unset($_SESSION['csrf_token']); // a fresh token for the fresh session id
|
||||
$_SESSION['user_id'] = (int)$user['id'];
|
||||
$_SESSION['username'] = $user['username'];
|
||||
return true;
|
||||
@@ -51,6 +89,82 @@ function attemptLogin(string $username, string $password): bool
|
||||
return false;
|
||||
}
|
||||
|
||||
/* ---------------------------------------------------------------------------
|
||||
* Login brute-force throttle
|
||||
* Failed attempts are recorded per username + IP. Once a username collects
|
||||
* LOGIN_MAX_USER_FAILS failures (or an IP LOGIN_MAX_IP_FAILS, across any
|
||||
* usernames) inside LOGIN_FAIL_WINDOW, sign-in answers 429 until the window
|
||||
* has passed since the last failure. Retrying while blocked never verifies a
|
||||
* password, so it doesn't extend the block. A successful login clears the
|
||||
* username's failures.
|
||||
* ------------------------------------------------------------------------- */
|
||||
const LOGIN_FAIL_WINDOW = 900; // seconds
|
||||
const LOGIN_MAX_USER_FAILS = 5;
|
||||
const LOGIN_MAX_IP_FAILS = 20;
|
||||
|
||||
/** Seconds until this username/IP may try again — 0 means go ahead. */
|
||||
function loginRetryAfter(string $username, string $ip): int
|
||||
{
|
||||
// The clock math stays inside MySQL: TIMESTAMP values come back in the
|
||||
// connection's time zone, so comparing them against PHP's clock would be
|
||||
// off by the server's UTC offset.
|
||||
$recent = function (string $col, string $value): array {
|
||||
$stmt = db()->prepare(
|
||||
"SELECT COUNT(*) AS fails,
|
||||
COALESCE(TIMESTAMPDIFF(SECOND, NOW(),
|
||||
MAX(attempted_at) + INTERVAL " . LOGIN_FAIL_WINDOW . " SECOND), 0) AS retry
|
||||
FROM login_attempts
|
||||
WHERE $col = ? AND attempted_at > NOW() - INTERVAL " . LOGIN_FAIL_WINDOW . " SECOND"
|
||||
);
|
||||
$stmt->execute([$value]);
|
||||
return $stmt->fetch();
|
||||
};
|
||||
|
||||
try {
|
||||
$user = $recent('username', $username);
|
||||
$byIp = $recent('ip', $ip);
|
||||
} catch (Throwable $e) {
|
||||
return 0; // table not created yet — no failures recorded so far
|
||||
}
|
||||
|
||||
$retry = 0;
|
||||
if ((int)$user['fails'] >= LOGIN_MAX_USER_FAILS) {
|
||||
$retry = max($retry, (int)$user['retry']);
|
||||
}
|
||||
if ((int)$byIp['fails'] >= LOGIN_MAX_IP_FAILS) {
|
||||
$retry = max($retry, (int)$byIp['retry']);
|
||||
}
|
||||
return max(0, $retry);
|
||||
}
|
||||
|
||||
function recordLoginFailure(string $username, string $ip): void
|
||||
{
|
||||
$db = db();
|
||||
// Lazy creation keeps installs made before this table existed working
|
||||
// (same pattern as app_meta).
|
||||
$db->exec(
|
||||
'CREATE TABLE IF NOT EXISTS login_attempts (
|
||||
id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
|
||||
username VARCHAR(50) NOT NULL,
|
||||
ip VARCHAR(45) NOT NULL,
|
||||
attempted_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||||
INDEX idx_la_user_time (username, attempted_at),
|
||||
INDEX idx_la_ip_time (ip, attempted_at)
|
||||
) ENGINE=InnoDB'
|
||||
);
|
||||
$db->prepare('DELETE FROM login_attempts WHERE attempted_at < NOW() - INTERVAL 1 HOUR')->execute();
|
||||
$db->prepare('INSERT INTO login_attempts (username, ip) VALUES (?, ?)')->execute([$username, $ip]);
|
||||
}
|
||||
|
||||
function clearLoginFailures(string $username): void
|
||||
{
|
||||
try {
|
||||
db()->prepare('DELETE FROM login_attempts WHERE username = ?')->execute([$username]);
|
||||
} catch (Throwable $e) {
|
||||
// table doesn't exist yet — nothing to clear
|
||||
}
|
||||
}
|
||||
|
||||
/** Returns true on success, or an error-message string. */
|
||||
function registerUser(string $username, string $password): string|bool
|
||||
{
|
||||
|
||||
@@ -692,6 +692,62 @@ function quizFilePath(array $quiz): ?string
|
||||
return $file;
|
||||
}
|
||||
|
||||
/**
|
||||
* Absolute, containment-checked path of a video's sibling subtitle file
|
||||
* ("Lesson.mp4" -> "Lesson.srt"), or null if there isn't one.
|
||||
*/
|
||||
function srtFilePath(array $video): ?string
|
||||
{
|
||||
$rel = preg_replace('/\.mp4$/i', '.srt', $video['path']);
|
||||
if ($rel === null || $rel === $video['path']) {
|
||||
return null;
|
||||
}
|
||||
$file = realpath(rtrim(VIDEOS_ROOT, '/') . '/' . $rel);
|
||||
$root = realpath(VIDEOS_ROOT);
|
||||
if ($file === false || $root === false
|
||||
|| !str_starts_with($file, $root . DIRECTORY_SEPARATOR) || !is_file($file)) {
|
||||
return null;
|
||||
}
|
||||
return $file;
|
||||
}
|
||||
|
||||
/**
|
||||
* SubRip -> WebVTT (the only caption format browsers take in <track>).
|
||||
* The formats differ by a header line and the decimal separator in
|
||||
* timestamps; cue numbers are legal VTT cue identifiers and pass through.
|
||||
*/
|
||||
function srtToVtt(string $srt): string
|
||||
{
|
||||
if (str_starts_with($srt, "\xEF\xBB\xBF")) {
|
||||
$srt = substr($srt, 3);
|
||||
}
|
||||
if (!preg_match('//u', $srt)) { // not valid UTF-8 — legacy single-byte file
|
||||
$recoded = function_exists('iconv')
|
||||
? @iconv('Windows-1252', 'UTF-8//TRANSLIT', $srt)
|
||||
: (function_exists('mb_convert_encoding')
|
||||
? mb_convert_encoding($srt, 'UTF-8', 'Windows-1252') : false);
|
||||
if (is_string($recoded)) {
|
||||
$srt = $recoded;
|
||||
}
|
||||
}
|
||||
$srt = str_replace(["\r\n", "\r"], "\n", $srt);
|
||||
|
||||
// Normalise timestamps to HH:MM:SS.mmm. SRT uses a comma; generated files
|
||||
// in the wild also carry single-digit hours and six-digit fractions, and
|
||||
// the WebVTT parsing algorithm rejects any fraction that isn't exactly
|
||||
// three digits — such cues would silently drop.
|
||||
$srt = preg_replace_callback(
|
||||
'/(\d+):(\d{2}):(\d{2})[.,](\d+)/',
|
||||
fn($m) => sprintf('%02d:%s:%s.%s', $m[1], $m[2], $m[3],
|
||||
substr(str_pad($m[4], 3, '0', STR_PAD_RIGHT), 0, 3)),
|
||||
$srt
|
||||
);
|
||||
|
||||
// Some ".srt" files are already WebVTT — don't stack a second header.
|
||||
$srt = trim($srt);
|
||||
return (str_starts_with($srt, 'WEBVTT') ? $srt : "WEBVTT\n\n" . $srt) . "\n";
|
||||
}
|
||||
|
||||
/** Breadcrumb chain root -> ... -> folder. */
|
||||
function folderBreadcrumbs(array $folder): array
|
||||
{
|
||||
|
||||
Reference in New Issue
Block a user