pcwvanbeers/assetmgt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

CMXX - Translations, Service report improvements and API security

Browse Source
This commit is contained in:
“VeLiTi”
2025-03-25 15:41:53 +01:00
parent 12abe8cb8a
commit 6fd22ede84
7 changed files with 451 additions and 123 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
api.php
View File

@@ -20,9 +20,9 @@ include './settings/config_redirector.php';
// Header security - enabled via config
//------------------------------------------
if (header_security){
header('Content-Type: application/json');
// Set strict security headers
// Strict security headers
header('Content-Type: application/json');
header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: DENY');
header('X-XSS-Protection: 1; mode=block');
@@ -30,19 +30,22 @@ if (header_security){
header('Access-Control-Allow-Origin: ' . $_ENV['ALLOWED_ORIGIN']);
header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type, Accept, Authorization');
header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
header('Referrer-Policy: strict-origin-when-cross-origin');
// Validate Content-Type
if (!str_contains($_SERVER['CONTENT_TYPE'],'application/json')) {
http_response_code(400);
exit(json_encode(['error' => 'Invalid Content-Type']));
if (!str_contains($_SERVER['CONTENT_TYPE'] ?? '', 'application/json')) {
http_response_code(400);
exit(json_encode(['error' => 'Invalid Content-Type']));
}
// Validate request size
if ($_SERVER['CONTENT_LENGTH'] > '5M') {
http_response_code(413);
exit(json_encode(['error' => 'Request too large']));
$maxRequestSize = 5 * 1024 * 1024; // 5MB in bytes
if (isset($_SERVER['CONTENT_LENGTH']) && $_SERVER['CONTENT_LENGTH'] > $maxRequestSize) {
http_response_code(413);
exit(json_encode(['error' => 'Request too large']));
}
}
}
//------------------------------------------
// Retrieve API version and Collection