Carlos Arias
3f69000d27
Two self-contained framework fixes, no schema dependencies: - throttle(): exempt trusted callers via new Functions::isTrustedIp() — loopback, the server's own IP, and an optional TRUSTED_IPS config allowlist (IPs/CIDRs). Fixes the SSG build (which fetches the read API from the box thousands of times per build) tripping the public rate limit and baking empty data into the deploy. Public client IPs stay limited. - public/index.php: set secure session cookie params (httponly, SameSite=Lax, secure on https) before session_start, so session/login state rides on a hardened cookie. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FMQeUnUrAeexcZ7P2Hxa6G
23 lines
676 B
PHP
23 lines
676 B
PHP
<?php
|
|
// Harden the session cookie before it is created (login state rides on it).
|
|
if (session_status() !== PHP_SESSION_ACTIVE) {
|
|
$https = (($_SERVER['HTTPS'] ?? '') !== '' && $_SERVER['HTTPS'] !== 'off')
|
|
|| ($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '') === 'https';
|
|
session_set_cookie_params([
|
|
'lifetime' => 0,
|
|
'path' => '/',
|
|
'httponly' => true,
|
|
'secure' => $https,
|
|
'samesite' => 'Lax',
|
|
]);
|
|
}
|
|
@session_start();
|
|
require dirname(__DIR__) . '/vendor/autoload.php';
|
|
require dirname(__DIR__) . '/config.php';
|
|
|
|
define('VIEWS_PATH', __DIR__);
|
|
|
|
|
|
$bootstrap = new Bootstrap();
|
|
$bootstrap->init();
|
|
|