Geoff MooreandClaude Sonnet 5
43200d7dfe
- bootstrap.php: disable display_errors/display_startup_errors in favour of PHP's own error log, so an uncaught engine error can never leak a stack trace or filesystem path to a client. - LoginRateLimiter: cap tracked address/identity buckets at 20000, evicting the least recently active first, so a distributed flood of distinct addresses or login names cannot grow login-attempts.json without bound. - Logger: prune expired audit logs probabilistically (1-in-100) instead of on every request, since every request already builds a Logger and a full directory scan on each one scales with total rotated log files. Found during a self-review security audit; full findings available on request. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
23 lines
1.1 KiB
PHP
23 lines
1.1 KiB
PHP
<?php
|
|
/** Shared entry-point setup: loads configuration into $config and registers the NeoCMS class autoloader. */
|
|
|
|
// Keep stack traces and filesystem paths out of responses; every engine warning still reaches PHP's own error log.
|
|
error_reporting(E_ALL);
|
|
ini_set('display_errors', '0');
|
|
ini_set('display_startup_errors', '0');
|
|
ini_set('log_errors', '1');
|
|
|
|
require_once __DIR__ . '/config.php';
|
|
|
|
// URL prefix of the site root: "/neocms" for http://localhost/neocms/, "" for a site at the domain root.
|
|
// Derived from this script's URL unless config.local.php sets 'basePath' (e.g. behind a path-rewriting proxy).
|
|
$config['basePath'] = rtrim((string) ($config['basePath'] ?? (preg_match('#^(.*)/cms/#', $_SERVER['SCRIPT_NAME'] ?? '', $neoBase) ? $neoBase[1] : '')), '/');
|
|
// The site root on disk is always the folder containing cms/, whatever DOCUMENT_ROOT says.
|
|
$config['siteRoot'] ??= dirname(__DIR__);
|
|
$config['security']['cookiePath'] = $config['basePath'] . '/cms';
|
|
|
|
spl_autoload_register(function ($class) {
|
|
$classPath = str_replace('\\', DIRECTORY_SEPARATOR, $class);
|
|
require_once __DIR__ . "/src/{$classPath}.php";
|
|
});
|