Changes

_docker/nginx/prod/conf.d/nginx.conf

@@ -50,14 +50,15 @@ server {
     root /var/www/public;
 
     # Security headers
-    add_header X-Frame-Options "SAMEORIGIN";
-    add_header X-Content-Type-Options "nosniff";
-    add_header X-XSS-Protection "1; mode=block";
-    add_header Referrer-Policy "strict-origin-when-cross-origin";
-    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https:; frame-ancestors 'self';" always;
 
     location / {
-        add_header Access-Control-Allow-Origin *;
+        add_header Access-Control-Allow-Origin "https://www.ntspi.ru" always;
         try_files $uri /index.php?$args;
     }
 
@@ -85,7 +86,44 @@ server {
         return 301 /abitur/;
     }
 
+    # ============================================
+    # SECURITY: Запрет доступа к чувствительным файлам
+    # ============================================
+
+    # Запрет доступа к .env, .git и всем скрытым файлам
+    location ~ /\. {
+        deny all;
+        return 404;
+    }
+
+    # Запрет доступа к composer, package, lock, readme файлам
+    location ~* (composer\.(json|lock)|package\.(json|lock)|\.md|\.txt|\.log)$ {
+        deny all;
+        return 404;
+    }
+
+    # Запрет доступа к vendor
+    location ~ ^/vendor/ {
+        deny all;
+        return 404;
+    }
+
+    # Запрет прямого доступа к storage (вне symlink public/storage)
+    location ~ ^/storage/ {
+        deny all;
+        return 404;
+    }
+
+    # ============================================
+    # PHP-FPM: ТОЛЬКО /index.php как entry point
+    # ============================================
     location ~ \.php$ {
+        # КРИТИЧНО: Разрешаем ТОЛЬКО /index.php
+        # Любой другой .php файл (например, shell.php в uploads) — 403
+        if ($uri !~ ^/index\.php$) {
+            return 403;
+        }
+
         try_files $uri =404;
         fastcgi_split_path_info ^(.+\.php)(/.+)$;
         fastcgi_pass app:9000;