fix: harden portable host installation

2026-09-01 19:26:10 +02:00
parent 5b2c64ff39
commit 323afaf832
6 changed files with 37 additions and 24 deletions
@@ -13,7 +13,7 @@ Portable PHP/MariaDB implementation of the JOBcard & Client Management System. T
 ## Installation on a standard host

 1. Create a MariaDB/MySQL database and database user.
-2. Upload the repository outside the public web root where possible.
+2. Upload the repository outside the public web root.
 3. Set the virtual host/document root to the `public/` directory.
 4. Copy `.env.example` to `.env` and replace every placeholder with production values.
 5. Restrict `.env` permissions, for example `chmod 600 .env`.
@@ -32,10 +32,10 @@ The installer must be run once against a new database. It creates the schema and
 - Create a Virtualmin virtual server and MariaDB database/user.
 - Set the virtual server PHP version to PHP 8.2+ and use PHP-FPM.
 - Set the document root to `jobcard-system/public`.
- Enable Apache `mod_rewrite`; the included `public/.htaccess` routes requests to `public/index.php`.
+- Enable Apache `mod_rewrite` and permit `AllowOverride FileInfo` (or configure equivalent virtual-host rewrite rules); the included `public/.htaccess` routes requests to `public/index.php`.
 - Enable HTTPS with Virtualmin/Let's Encrypt.
 - Run `php bin/install.php` from the application directory using the same PHP version configured for the domain.
- Keep `.env`, `config/`, `database/`, `bin/` and `tests/` outside the public document root when the Virtualmin layout allows it. If the repository root must be inside the domain, the included rules deny common sensitive file types and the public root remains `public/`.
+- The `public/` directory is mandatory as the virtual server document root. Never configure the repository root as the document root; `public/.htaccess` cannot protect files located in parent directories.
 - Schedule database and upload backups using the hosting provider's backup system or cron.

 ## Nginx alternative