Geoff MooreandClaude Sonnet 5
8946915bfe
Users (Tools > Users) - Everyone can update their display name, email and password; administrators can add, edit, invite (one-time link), block and delete accounts. - Accounts in config.local.php stay locked to config (the main administrator); CMS accounts live in data/users.json. Sign-in is by login name. - Roles are now editor and administrator (publisher is an alias of editor). - Account protection: password hashes only (12-72 characters), administrator password confirmation for sensitive actions, rate-limited failures, hashed single-use invite tokens, self-lockout guards, sessions of blocked/deleted users end on the next request, every account event audited without secrets. - dataDirectory can move data outside the web root; the dashboard recommends it. Media library - Upload images, documents, video and audio, sorted into four categories by extension. - Extension allow-list; executables, scripts, HTML/SVG, archives, legacy and macro Office files refused; content sniffing; files containing code refused; PDFs with scripts refused; Office/OpenDocument packages inspected for macros and embedded objects. - Media library button in the editor inserts an image, document link, video or audio. Navigation menus, pages and interface - The site scan detects primary/secondary navigation and seeds Navigation Menus; menus can be renamed, edited and deleted but not created by the CMS; a scan button finds new navigation. - New page wizard (template, name, navigation group) in the Pages dialogue; new pages stay private drafts until published; pages can be used as templates. - Deleted pages can be recovered from the Dashboard. - Full-width top bar with the user at the top right, device icons, consistent buttons. Tests and docs updated (tests/run.php, README, ARCHITECTURE, DEVELOPMENT, CHANGELOG). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
25 lines
917 B
Plaintext
25 lines
917 B
Plaintext
<?php
|
|
|
|
/**
|
|
* Copy this file to config.local.php and replace the example values.
|
|
* config.local.php is ignored by Git and denied by the supplied Apache rules.
|
|
*/
|
|
return [
|
|
'authentication' => [
|
|
'admin' => '$2y$10$replace-with-a-real-password-hash',
|
|
],
|
|
'roles' => [
|
|
'admin' => 'administrator',
|
|
],
|
|
// Live sites: store CMS data (accounts, drafts, revisions) OUTSIDE the web root, as an absolute path PHP can write to,
|
|
// for example '/var/neocms-data'. The default cms/data/ is protected only by .htaccess.
|
|
// 'dataDirectory' => '/var/neocms-data',
|
|
// Set this to true when HTTPS is terminated by a trusted reverse proxy.
|
|
'security' => [
|
|
'cookieSecure' => true,
|
|
// Uncomment only where local audit-retention policy differs from the secure defaults.
|
|
// 'auditMaxFileBytes' => 10 * 1024 * 1024,
|
|
// 'auditRetentionDays' => 90,
|
|
],
|
|
];
|