Skip to content

Commit 3e4e021

Browse files
author
elightsys
committed
Add GitHub community files: SECURITY.md, issue/PR templates, PHP lint workflow, FUNDING.yml
1 parent 4cd2a5c commit 3e4e021

File tree

6 files changed

+294
-0
lines changed

6 files changed

+294
-0
lines changed

‎.github/FUNDING.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# These are supported funding model platforms
2+
3+
github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
4+
patreon: # Replace with a single Patreon username
5+
open_collective: # Replace with a single Open Collective username
6+
ko_fi: # Replace with a single Ko-fi username
7+
tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
8+
community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
9+
liberapay: # Replace with a single Liberapay username
10+
issuehunt: # Replace with a single IssueHunt username
11+
otechie: # Replace with a single Otechie username
12+
lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
13+
custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
name: Bug report
3+
about: Create a report to help us improve
4+
title: '[BUG] '
5+
labels: bug
6+
assignees: ''
7+
8+
---
9+
10+
**Describe the bug**
11+
A clear and concise description of what the bug is.
12+
13+
**To Reproduce**
14+
Steps to reproduce the behavior:
15+
1. Go to '...'
16+
2. Click on '....'
17+
3. Scroll down to '....'
18+
4. See error
19+
20+
**Expected behavior**
21+
A clear and concise description of what you expected to happen.
22+
23+
**Screenshots**
24+
If applicable, add screenshots to help explain your problem.
25+
26+
**Environment (please complete the following information):**
27+
- OS: [e.g. Ubuntu 20.04]
28+
- PHP Version: [e.g. 8.2.0]
29+
- MySQL/MariaDB Version: [e.g. MySQL 8.0]
30+
- Web Server: [e.g. Apache 2.4, Nginx 1.18]
31+
- Browser: [e.g. chrome, safari]
32+
33+
**Error Logs**
34+
Please include any relevant error logs from:
35+
- PHP error log
36+
- Apache/Nginx error log
37+
- Browser console
38+
39+
**Additional context**
40+
Add any other context about the problem here.

‎.github/ISSUE_TEMPLATE/feature_request.md‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
name: Feature request
3+
about: Suggest an idea for this project
4+
title: '[FEATURE] '
5+
labels: enhancement
6+
assignees: ''
7+
8+
---
9+
10+
**Is your feature request related to a problem? Please describe.**
11+
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
12+
13+
**Describe the solution you'd like**
14+
A clear and concise description of what you want to happen.
15+
16+
**Describe alternatives you've considered**
17+
A clear and concise description of any alternative solutions or features you've considered.
18+
19+
**Additional context**
20+
Add any other context or screenshots about the feature request here.
21+
22+
**Would you like to implement this feature?**
23+
- [ ] Yes, I'd like to submit a PR
24+
- [ ] No, but I can help with testing
25+
- [ ] No, just suggesting

‎.github/pull_request_template.md‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
## Description
2+
Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context.
3+
4+
Fixes # (issue)
5+
6+
## Type of change
7+
8+
Please delete options that are not relevant.
9+
10+
- [ ] Bug fix (non-breaking change which fixes an issue)
11+
- [ ] New feature (non-breaking change which adds functionality)
12+
- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
13+
- [ ] Documentation update
14+
- [ ] Code refactoring
15+
- [ ] Performance improvement
16+
17+
## How Has This Been Tested?
18+
19+
Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce.
20+
21+
- [ ] Test A
22+
- [ ] Test B
23+
24+
**Test Configuration**:
25+
* PHP version:
26+
* MySQL version:
27+
* Web Server:
28+
29+
## Checklist:
30+
31+
- [ ] My code follows the style guidelines of this project (PSR-12)
32+
- [ ] I have performed a self-review of my own code
33+
- [ ] I have commented my code, particularly in hard-to-understand areas
34+
- [ ] I have made corresponding changes to the documentation
35+
- [ ] My changes generate no new warnings
36+
- [ ] I have added tests that prove my fix is effective or that my feature works
37+
- [ ] New and existing unit tests pass locally with my changes
38+
- [ ] Any dependent changes have been merged and published
39+
40+
## Screenshots (if applicable):
41+
42+
## Additional Notes:

‎.github/workflows/php-lint.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
name: PHP Linting
2+
3+
on:
4+
push:
5+
branches: [ main, develop ]
6+
pull_request:
7+
branches: [ main, develop ]
8+
9+
jobs:
10+
php-lint:
11+
runs-on: ubuntu-latest
12+
13+
strategy:
14+
matrix:
15+
php-versions: ['7.4', '8.0', '8.1', '8.2']
16+
17+
name: PHP ${{ matrix.php-versions }} Syntax Check
18+
19+
steps:
20+
- uses: actions/checkout@v3
21+
22+
- name: Setup PHP
23+
uses: shivammathur/setup-php@v2
24+
with:
25+
php-version: ${{ matrix.php-versions }}
26+
extensions: mbstring, pdo, pdo_mysql
27+
coverage: none
28+
29+
- name: Validate composer.json (if exists)
30+
run: |
31+
if [ -f composer.json ]; then
32+
composer validate --strict
33+
fi
34+
35+
- name: Check PHP syntax errors
36+
run: |
37+
find . -type f -name '*.php' ! -path './vendor/*' -exec php -l {} \; | (! grep -v "No syntax errors detected" )
38+
39+
- name: Display PHP version
40+
run: php -v

‎SECURITY.md‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
# Security Policy
2+
3+
## Supported Versions
4+
5+
We release patches for security vulnerabilities. Which versions are eligible for receiving such patches depends on the CVSS v3.0 Rating:
6+
7+
| Version | Supported |
8+
| ------- | ------------------ |
9+
| 1.0.x | :white_check_mark: |
10+
| < 1.0 | :x: |
11+
12+
## Reporting a Vulnerability
13+
14+
We take the security of PHP MVC Framework seriously. If you believe you have found a security vulnerability, please report it to us as described below.
15+
16+
### Please do the following:
17+
18+
**DO NOT** create a public GitHub issue for security vulnerabilities.
19+
20+
Instead, please report security vulnerabilities by emailing:
21+
22+
📧 **elightsysl@gmail.com**
23+
24+
### What to include in your report:
25+
26+
- Type of issue (e.g. SQL injection, XSS, authentication bypass, etc.)
27+
- Full paths of source file(s) related to the manifestation of the issue
28+
- The location of the affected source code (tag/branch/commit or direct URL)
29+
- Any special configuration required to reproduce the issue
30+
- Step-by-step instructions to reproduce the issue
31+
- Proof-of-concept or exploit code (if possible)
32+
- Impact of the issue, including how an attacker might exploit it
33+
34+
### What to expect:
35+
36+
- **Acknowledgment**: We will acknowledge receipt of your vulnerability report within 48 hours.
37+
- **Communication**: We will send you regular updates about our progress.
38+
- **Disclosure**: Once the vulnerability is fixed, we will publicly disclose it (giving you credit if desired).
39+
40+
## Security Best Practices for Users
41+
42+
When deploying this application in production:
43+
44+
1. **Configuration Security**
45+
- Never commit `app/config/config.php` with real credentials
46+
- Use strong, unique database passwords
47+
- Generate a new `__UNIQID__` value using `md5(uniqid(rand(), true))`
48+
49+
2. **File Permissions**
50+
- Set proper file permissions (755 for directories, 644 for files)
51+
- Restrict write access to sensitive directories
52+
- Keep `storage/logs/` and `storage/cache/` writable but not web-accessible
53+
54+
3. **Database Security**
55+
- Use separate database users with minimal privileges
56+
- Enable MySQL's `strict mode`
57+
- Regularly backup your database
58+
59+
4. **Web Server Configuration**
60+
- Use HTTPS (SSL/TLS) in production
61+
- Configure proper security headers
62+
- Disable directory listing
63+
- Keep PHP and MySQL up to date
64+
65+
5. **Application Security**
66+
- Change default admin credentials immediately
67+
- Regularly update dependencies
68+
- Monitor error logs for suspicious activity
69+
- Implement rate limiting for login attempts
70+
71+
6. **Session Security**
72+
- Use secure session cookies (`session.cookie_secure = 1`)
73+
- Enable HttpOnly cookies (`session.cookie_httponly = 1`)
74+
- Set appropriate session timeout values
75+
76+
## Known Security Considerations
77+
78+
### Current Implementation
79+
80+
- **Password Hashing**: Uses PHP's `password_hash()` with bcrypt
81+
- **SQL Injection Prevention**: Uses PDO prepared statements
82+
- **CSRF Protection**: Token-based validation in forms
83+
- **XSS Prevention**: Output escaping in views
84+
- **Session Management**: Secure session handling with regeneration
85+
86+
### Areas for Enhancement (Production)
87+
88+
- Implement rate limiting for authentication
89+
- Add two-factor authentication (2FA)
90+
- Implement security headers (CSP, HSTS, etc.)
91+
- Add input validation library
92+
- Implement comprehensive logging and monitoring
93+
- Add brute force protection
94+
95+
## Security Updates
96+
97+
We will notify users of security updates through:
98+
99+
- GitHub Security Advisories
100+
- Release notes
101+
- Email (for critical vulnerabilities)
102+
103+
## Third-Party Dependencies
104+
105+
This project uses several third-party libraries:
106+
107+
- jQuery 3.5.1
108+
- Bootstrap 4.5.2
109+
- DataTables 1.10.24
110+
111+
Please ensure you keep these dependencies updated to their latest secure versions.
112+
113+
## Scope
114+
115+
This security policy applies to:
116+
117+
- The core MVC framework
118+
- Bundled controllers, models, and views
119+
- Database abstraction layer
120+
- Authentication system
121+
122+
It does not apply to:
123+
124+
- Custom modifications or extensions
125+
- Third-party plugins not included in this repository
126+
- Server configuration (Apache/Nginx/PHP)
127+
128+
## Comments on This Policy
129+
130+
If you have suggestions on how this process could be improved, please submit a pull request or open an issue.
131+
132+
---
133+
134+
**Thank you for helping keep PHP MVC Framework and its users safe!** 🔒

0 commit comments

Comments
 (0)