popertots/Crussell
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: configure env-based DAV_ADMIN_PASSWORD and add security headers

Browse Source 
Ultraworked with Sisyphus (https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
This commit is contained in:
popertots
2026-05-31 10:55:43 +01:00
co-authored by Sisyphus
parent 1a6947a9b6
commit d7857766fb
4 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/handlers/bookings/manage.go
+2
View File
@@ -1583,6 +1583,8 @@ func AdminApproveEditRequestHandler(w http.ResponseWriter, r *http.Request) {
// Build update query for bookings table // Build update query for bookings table
if newStartTime != nil || notes != nil { if newStartTime != nil || notes != nil {
// setClauses contains only hardcoded column name assignments ("start_time = $N", "notes = $N").
// Column names are never derived from user input. User values are in args and always parameterised.
var setClauses []string var setClauses []string
var args []interface{} var args []interface{}
argNum := 1 argNum := 1
compose.yml
+1
View File
@@ -41,6 +41,7 @@ services:
POSTGRES_DB: ${POSTGRES_DB} POSTGRES_DB: ${POSTGRES_DB}
POSTGRES_USER: ${POSTGRES_USER} POSTGRES_USER: ${POSTGRES_USER}
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD} POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
DAV_ADMIN_PASSWORD: ${DAV_ADMIN_PASSWORD:-admin} # Must be set in production
volumes: volumes:
- ./sabredav:/var/www/dav - ./sabredav:/var/www/dav
depends_on: depends_on:
nginx/conf.d/default.conf
+2 -1
View File
@@ -15,6 +15,7 @@ server {
add_header X-Content-Type-Options nosniff; add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options DENY; add_header X-Frame-Options DENY;
add_header X-XSS-Protection "1; mode=block"; add_header X-XSS-Protection "1; mode=block";
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'none';" always;
# Rate limiting (per IP) # Rate limiting (per IP)
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=20r/m; limit_req_zone $binary_remote_addr zone=api_limit:10m rate=20r/m;
@@ -80,7 +81,7 @@ server {
# Allow DAV methods # Allow DAV methods
if ($request_method = 'OPTIONS') { if ($request_method = 'OPTIONS') {
add_header 'Access-Control-Allow-Origin' '*'; add_header 'Access-Control-Allow-Origin' '$http_origin';
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, DELETE, PROPFIND, PROPPATCH, REPORT, MKCOL, MOVE, COPY'; add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, DELETE, PROPFIND, PROPPATCH, REPORT, MKCOL, MOVE, COPY';
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-None-Match,If-Modified-Since,Cache-Control,Content-Type,Range,Depth,Authorization,If-Match,Destination,Overwrite,Lock-Token,Timeout'; add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-None-Match,If-Modified-Since,Cache-Control,Content-Type,Range,Depth,Authorization,If-Match,Destination,Overwrite,Lock-Token,Timeout';
add_header 'Access-Control-Max-Age' 1728000; add_header 'Access-Control-Max-Age' 1728000;
sabredav/server.php
+3 -3
View File
@@ -144,11 +144,11 @@ if ($stmt->fetchColumn() == 0) {
"); ");
} }
// Create default user if not exists (username: admin, password: admin) // Create default user if not exists (username: admin, password from DAV_ADMIN_PASSWORD env)
$davPassword = getenv('DAV_ADMIN_PASSWORD') ?: 'admin';
$stmt = $pdo->query("SELECT COUNT(*) FROM dav_users"); $stmt = $pdo->query("SELECT COUNT(*) FROM dav_users");
if ($stmt->fetchColumn() == 0) { if ($stmt->fetchColumn() == 0) {
// MD5 hash of "admin:SabreDAV:admin" $digest = md5('admin:SabreDAV:' . $davPassword);
$digest = md5('admin:SabreDAV:admin');
$pdo->exec(" $pdo->exec("
INSERT INTO dav_users (username, digesta1) INSERT INTO dav_users (username, digesta1)
VALUES ('admin', '$digest') VALUES ('admin', '$digest')