fix: harden CMS security controls

cms/config.php

@@ -1,19 +1,66 @@
 <?php
-/*
- * Authentication stores the usernames and passwords for people to be able to use the CMS.
- * This will be used as well to write to the audit log once it has been implemented in code.
+/**
+ * NeoCMS site configuration.
+ *
+ * Keep credentials in the ignored config.local.php override rather than this tracked defaults file.
+ * No account is enabled by default; configure a password hash and role before exposing /cms/.
  */
 
 $config = [
     'authentication' => [
-        // Store password hashes generated with password_hash(...), not plaintext passwords.
-        // Default password for this sample hash is: change-this-password
-        'admin' => '$2y$10$.MiUOFPR.L9osXyKuUjqx.VeZeeD3bHrQrmPQAOzXSfWj.nene1ey',
+        // 'admin' => '$2y$10$replace-with-a-real-password-hash',
     ],
-    // Enable the auditing system
+    // Grant each user the least powerful role they need: editor, publisher, or administrator.
+    'roles' => [
+        // 'admin' => 'administrator',
+    ],
+    // Session expiry and login throttling. Set cookieSecure to true behind a TLS reverse proxy.
+    'security' => [
+        'idleTimeout' => 1800,
+        'absoluteTimeout' => 43200,
+        'cookieSecure' => null,
+        'loginWindowSeconds' => 900,
+        'loginLockoutSeconds' => 900,
+        'loginMaxAttempts' => 5,
+        'loginMaxAddressAttempts' => 20,
+        'maxContentBytes' => 5 * 1024 * 1024,
+        'maxRequestBytes' => 6 * 1024 * 1024,
+        'maxManagedPages' => 5000,
+        'maxScannedEntries' => 20000,
+        'maxDraftBytes' => 250 * 1024 * 1024,
+        'maxSchedules' => 100,
+        'maxScheduledBytes' => 250 * 1024 * 1024,
+        'maxRevisionsPerPage' => 50,
+        'maxRevisionsTotal' => 2000,
+        'maxRevisionBytes' => 500 * 1024 * 1024,
+        'auditMaxFileBytes' => 10 * 1024 * 1024,
+        'auditRetentionDays' => 90,
+    ],
+    // Upload constraints limit both individual image complexity and total disk consumption.
+    'uploads' => [
+        'maxFileBytes' => 10 * 1024 * 1024,
+        'maxWidth' => 8192,
+        'maxHeight' => 8192,
+        'maxPixels' => 24 * 1024 * 1024,
+        'maxFiles' => 2000,
+        'maxTotalBytes' => 500 * 1024 * 1024,
+    ],
+    // Record authentication and content-management activity in daily files under cms/logs/.
     'audit' => true,
-    // Set to true if you do not want to see the welcome page and want to go straight to your site
+    // Skip the built-in welcome page and open the public site immediately after login.
     'skipWelcomePage' => false,
-    // Show full URL of the page being edited on the control bar
-    'showFullUrl' => true
+    // Display the path of the page being edited in the administration toolbar.
+    'showFullUrl' => true,
+    // CSS class used to mark page regions as editable. Use a single class name without a leading dot.
+    'editableClass' => 'editable',
 ];
+
+// Merge deployment credentials and overrides from the untracked local configuration, when present.
+$localConfigPath = __DIR__ . '/config.local.php';
+if (is_file($localConfigPath)) {
+    $localConfig = require $localConfigPath;
+    if (!is_array($localConfig)) {
+        throw new \RuntimeException('cms/config.local.php must return an array');
+    }
+    $config = array_replace_recursive($config, $localConfig);
+}