changes

_docker/app/php.ini

@@ -20,6 +20,13 @@ opcache.revalidate_freq = 2
 session.gc_maxlifetime = 1440
 session.cookie_lifetime = 0
 
+; ============================================
+; SECURITY: open_basedir restriction
+; Разрешаем доступ только к директории приложения и временным файлам
+; Добавлен /root/.config для работы PsySH (tinker)
+; ============================================
+open_basedir = /var/www:/tmp:/root/.config
+
 ; ============================================
 ; SECURITY: Запрет опасных функций
 ; curl_exec и shell_exec оставлены — используются приложением (VK API, LibreOffice конвертация)

_docker/nginx/local/conf.d/nginx.conf

@@ -25,7 +25,17 @@ server {
         try_files $uri /index.php?$args;  # Обработка запросов
     }
 
+    # ========================================================================
+    # VIKON MODULE SECURITY — Block executable files in module directories
+    # MUST be placed BEFORE location ~ \.php$ to take effect
+    # ========================================================================
 
+    # Block PHP and other server-side scripts in sveden/abitur
+    location ~ ^/(sveden|abitur)/.*\.(php|php3|php4|php5|php7|php8|phps|phtml|pl|py|pyc|cgi|sh|bash|bat|cmd|exe|com|ps1|psm1|rb|asp|aspx|jsp|cfm)$ {
+        deny all;
+        return 403;
+        access_log /var/log/nginx/blocked_module_scripts.log;
+    }
 
     location /sveden/ {
         alias /var/www/public/sveden/;

_docker/nginx/prod/conf.d/nginx.conf

@@ -62,6 +62,17 @@ server {
         try_files $uri /index.php?$args;
     }
 
+    # ========================================================================
+    # VIKON MODULE SECURITY — Block executable files in module directories
+    # MUST be placed BEFORE location ~ \.php$ to take effect
+    # ========================================================================
+
+    location ~ ^/(sveden|abitur)/.*\.(php|php3|php4|php5|php7|php8|phps|phtml|pl|py|pyc|cgi|sh|bash|bat|cmd|exe|com|ps1|psm1|rb|asp|aspx|jsp|cfm)$ {
+        deny all;
+        return 403;
+        access_log /var/log/nginx/blocked_module_scripts.log;
+    }
+
     location /sveden/ {
         alias /var/www/public/sveden/;
         index index.html;

_docker/nginx/test/conf.d/nginx.conf

@@ -24,6 +24,17 @@ server {
         try_files $uri /index.php?$args;  # Обработка запросов
     }
 
+    # ========================================================================
+    # VIKON MODULE SECURITY — Block executable files in module directories
+    # MUST be placed BEFORE location ~ \.php$ to take effect
+    # ========================================================================
+
+    location ~ ^/(sveden|abitur)/.*\.(php|php3|php4|php5|php7|php8|phps|phtml|pl|py|pyc|cgi|sh|bash|bat|cmd|exe|com|ps1|psm1|rb|asp|aspx|jsp|cfm)$ {
+        deny all;
+        return 403;
+        access_log /var/log/nginx/blocked_module_scripts.log;
+    }
+
     location /sveden/ {
         alias /var/www/public/sveden/;
         index index.html;