cw2007/POSA_LEAKSMS
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
POSA_LEAKSMS/php
History
유창욱 749b284941 fix(security): resolve review findings — TOTP example fail-closed, disable legacy sig, body cap 
다중 에이전트 보안 리뷰 후속 수정:
- (HIGH) config.local.example.php ADMIN_TOTP_SECRET '' 로 교체: 기존 플레이스홀더가
  Base32 디코드되어 실제 TOTP 코드를 생성(공개 시드로 MFA 활성화)하던 회귀를 차단.
  fail-closed(미설정 시 로그인 차단) + 회귀 테스트 추가.
- (MEDIUM) 레거시 키-접두 sha256 서명 경로를 ALLOW_LEGACY_BODY_SIGNATURE(기본 false)로
  게이트: X-Signature(HMAC) 없으면 거부.
- (LOW) 인증 전 본문 크기 상한 INGEST_MAX_BODY_BYTES(8KB) → 413.
- (LOW) heartbeat throttle 를 flock 기반 원자 판정으로 교체(중복 스캔 방지).
- (LOW) CRON_SECRET: md5 → hash_hmac('sha256','cron',API_KEY).
2026-06-20 10:00:52 +09:00
..
api fix(security): resolve review findings — TOTP example fail-closed, disable legacy sig, body cap 2026-06-20 10:00:52 +09:00
var chore: import codebase with security hardening 2026-06-20 09:37:40 +09:00
.htaccess chore: import codebase with security hardening 2026-06-20 09:37:40 +09:00
admin_security.php chore: import codebase with security hardening 2026-06-20 09:37:40 +09:00
blocked.php chore: import codebase with security hardening 2026-06-20 09:37:40 +09:00
config.local.example.php fix(security): resolve review findings — TOTP example fail-closed, disable legacy sig, body cap 2026-06-20 10:00:52 +09:00
config.php fix(security): resolve review findings — TOTP example fail-closed, disable legacy sig, body cap 2026-06-20 10:00:52 +09:00
cron_heartbeat.php fix(security): resolve review findings — TOTP example fail-closed, disable legacy sig, body cap 2026-06-20 10:00:52 +09:00
dashboard.php chore: import codebase with security hardening 2026-06-20 09:37:40 +09:00
login.php chore: import codebase with security hardening 2026-06-20 09:37:40 +09:00
monthly_report.php chore: import codebase with security hardening 2026-06-20 09:37:40 +09:00
ops_checks.php chore: import codebase with security hardening 2026-06-20 09:37:40 +09:00
retention_cleanup.php chore: import codebase with security hardening 2026-06-20 09:37:40 +09:00
security_evidence.php chore: import codebase with security hardening 2026-06-20 09:37:40 +09:00
setup_hash.php chore: import codebase with security hardening 2026-06-20 09:37:40 +09:00
setup_mfa.php chore: import codebase with security hardening 2026-06-20 09:37:40 +09:00
setup_wizard.php chore: import codebase with security hardening 2026-06-20 09:37:40 +09:00
sms_send.php chore: import codebase with security hardening 2026-06-20 09:37:40 +09:00
test_mobile.php chore: import codebase with security hardening 2026-06-20 09:37:40 +09:00