Merge pull request #532 from turbo124/master

Disable access to php scripts in /storage

.github/workflows/build-image-v5.yaml

@@ -54,4 +54,4 @@ jobs:
       - name: Move cache
         run: |
           rm -rf /tmp/.buildx-cache
-          mv /tmp/.buildx-cache-new /tmp/.buildx-cache
+          mv /tmp/.buildx-cache-new /tmp/.buildx-cache

alpine/5/Dockerfile

@@ -1,4 +1,4 @@
-ARG PHP_VERSION=8.1
+ARG PHP_VERSION=8.2
 ARG BAK_STORAGE_PATH=/var/www/app/docker-backup-storage/
 ARG BAK_PUBLIC_PATH=/var/www/app/docker-backup-public/
 
@@ -14,15 +14,16 @@ RUN set -eux; apk add curl unzip
 # Extract Invoice Ninja
 RUN mkdir -p /var/www/app \
     && tar --strip-components=1 -xf /tmp/ninja.tar.gz -C /var/www/app/ \
-    && mkdir -p /var/www/app/public/logo /var/www/app/storage \
+    && mkdir -p /var/www/app/public/logo /var/www/app/storage
-    && mv /var/www/app/.env.example /var/www/app/.env \
+    
-    && rm -rf /var/www/app/docs /var/www/app/tests
-
 # Download and extract the latest react application
 RUN curl -LGO $(curl https://api.github.com/repos/invoiceninja/ui/releases/latest | grep "browser_download_url" | awk '{ print $2 }' | sed 's/,$//' | sed 's/"//g');
 RUN cp invoiceninja-react.zip /tmp/invoiceninja-react.zip
 RUN unzip /tmp/invoiceninja-react.zip 
 RUN cp -r dist/react/* /var/www/app/public/react/
+RUN mkdir -p /var/www/app/public/tinymce_6.4.2/tinymce/js/
+RUN cp -r dist/tinymce_6.4.2/* /var/www/app/public/tinymce_6.4.2/
+
 # Download and extract the latest react application
 # 
 WORKDIR /var/www/app/
@@ -37,7 +38,7 @@ RUN --mount=target=/var/www/app/node_modules,type=cache \
     && mv /var/www/app/public $BAK_PUBLIC_PATH  
 
 # Prepare php image
-FROM php:${PHP_VERSION}-fpm-alpine3.15 as prod
+FROM php:${PHP_VERSION}-fpm-alpine as prod
 
 LABEL maintainer="David Bomba <turbo124@gmail.com>"
 
@@ -51,6 +52,16 @@ RUN mv /usr/local/etc/php/php.ini-production /usr/local/etc/php/php.ini
 # https://hub.docker.com/r/mlocati/php-extension-installer/tags
 COPY --from=mlocati/php-extension-installer /usr/bin/install-php-extensions /usr/local/bin/
 
+# Install chromium
+RUN set -eux; \
+    apk add --no-cache \
+    font-isas-misc \
+    supervisor \
+    mysql-client \
+    git \
+    chromium \
+    ttf-freefont
+
 RUN install-php-extensions \
     bcmath \
     exif \
@@ -63,16 +74,6 @@ RUN install-php-extensions \
     @composer \
     && rm /usr/local/bin/install-php-extensions
 
-# Install chromium
-RUN set -eux; \
-    apk add --no-cache \
-    font-isas-misc \
-    supervisor \
-    mysql-client \
-    git \
-    chromium \
-    ttf-freefont
-
 # Copy files
 COPY rootfs /
 
@@ -102,7 +103,8 @@ WORKDIR /var/www/app
 
 # Do not remove this ENV
 ENV IS_DOCKER true
-RUN /usr/local/bin/composer install --no-dev --quiet
+RUN /usr/local/bin/composer install --no-dev --no-scripts --no-interaction 
+RUN /usr/local/bin/composer dump-autoload --optimize --no-dev --classmap-authoritative --no-scripts --no-interaction 
 
 # Override the environment settings from projects .env file
 ENV APP_ENV production

alpine/5/cache_buster

@@ -1 +1 @@
-Fri Jul  2 7:33:22 +00 2021
+Fri Jul  4 7:33:22 +00 2023

alpine/5/rootfs/usr/local/bin/invoiceninja-init.sh

@@ -27,6 +27,7 @@ docker_process_init_files() {
 
 php artisan config:cache
 php artisan optimize
+php artisan package:discover
 php artisan ninja:react
 
 # Check if DB works, if not crash the app.

charts/invoiceninja/Chart.yaml

@@ -13,11 +13,11 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.10.1
+version: 0.10.2
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-appVersion: 5.5.49
+appVersion: 5.6.24
 keywords:
   - invoiceninja
 home: https://invoiceninja.github.io/dockerfiles

charts/invoiceninja/values.yaml

@@ -18,7 +18,7 @@
 image:
   registry: docker.io
   repository: invoiceninja/invoiceninja
-  tag: 5.5.49
+  tag: 5.6.24
   ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
   ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
   ##

config/nginx/in-vhost.conf

@@ -16,6 +16,11 @@ server {
     location = /favicon.ico { access_log off; log_not_found off; }
     location = /robots.txt  { access_log off; log_not_found off; }
 
+
+    location ~* /storage/.*\.php$ {
+        return 503;
+    }
+
     location ~ \.php$ {
         fastcgi_split_path_info ^(.+\.php)(/.+)$;
         fastcgi_pass app:9000;

config/php/php-cli.ini

@@ -0,0 +1,18 @@
+session.auto_start = Off
+short_open_tag = Off
+
+error_reporting = E_ALL & ~E_NOTICE & ~E_WARNING & ~E_STRICT & ~E_DEPRECATED
+
+; opcache.enable_cli=1
+; opcache.fast_shutdown=1
+; opcache.memory_consumption=256
+; opcache.interned_strings_buffer=8
+; opcache.max_accelerated_files=4000
+; opcache.revalidate_freq=60
+; # http://symfony.com/doc/current/performance.html
+; realpath_cache_size = 4096K
+; realpath_cache_ttl = 600
+
+memory_limit = 2G
+post_max_size = 60M
+upload_max_filesize = 50M

config/php/php.ini

@@ -0,0 +1,21 @@
+session.auto_start = Off
+short_open_tag = Off
+
+error_reporting = E_ALL & ~E_NOTICE & ~E_WARNING & ~E_STRICT & ~E_DEPRECATED
+
+; opcache.enable=1
+; opcache.preload=/srv/www/invoiceninja/current/preload.php
+; opcache.preload_user=www-data
+
+; ; The OPcache shared memory storage size.
+; opcache.max_accelerated_files=300000
+; opcache.validate_timestamps=1
+; opcache.revalidate_freq=30
+; opcache.jit_buffer_size=256M
+; opcache.jit=1205
+; opcache.memory_consumption=1024M
+
+
+post_max_size = 60M
+upload_max_filesize = 50M
+memory_limit=512M

docker-compose.yml

@@ -30,6 +30,9 @@ services:
       - ./config/hosts:/etc/hosts:ro
       - ./docker/app/public:/var/www/app/public:rw,delegated
       - ./docker/app/storage:/var/www/app/storage:rw,delegated
+      - ./config/php/php.ini:/usr/local/etc/php/php.ini
+      - ./config/php/php-cli.ini:/usr/local/etc/php/php-cli.ini
+
     depends_on:
       - db
     networks: