crashmedia/Arctic-Wolves-Production
1
0
Fork 0
Code Issues Pull requests 5 Projects Releases Packages Wiki Activity Actions

Security: Remove Demo Data, Fix Vulnerabilities, Add Performance Indexes #20

Open
crashmedia wants to merge 32 commits from security-cleanup-and-optimization into main
pull from: security-cleanup-and-optimization
merge into: crashmedia:main
Conversation 0 Commits 32 Files changed 32 +208 -5729
crashmedia commented 2026-07-15 20:33:40 +00:00
Owner
Copy link

Summary

Comprehensive security cleanup, demo data removal, and performance optimization for Arctic Wolves Production.

Security Fixes (Phase A)

New Files

  • deployment/nginx_security.conf — Nginx security configuration with:

    • 6 security headers (X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy, HSTS)
    • server_tokens off to hide server version
    • Location blocks blocking access to: .env, .sql, .ht*, /deployment/, /config/, /logs/, /backups/, /receipts/, .git
    • Static asset caching with 1-year expiry

  • deployment/php_security.ini — PHP security settings:

    • expose_php = Off to hide PHP version
    • Session security flags (httponly, samesite, strict_mode)
    • Dangerous functions disabled (exec, passthru, shell_exec, system, proc_open, popen, parse_ini_file, show_source)
    • Error handling (display_errors Off, log_errors On)

Modified Files

  • db_config.php — Added direct-access guard preventing HTTP access
  • config/session.php — Added direct-access guard preventing HTTP access
  • views/pwa/messages.php — Fixed innerHTML XSS vulnerability (3 locations: renderThreadMessages, send button, chat polling)
  • lib/cdn_resources.php — Added defer attribute to non-critical CDN scripts (chart-js, sortable-js, qrcode, html2canvas, jsqr)

Demo Data & Dead File Cleanup (Phase B)

Deleted Files (25 files)

File Reason
process_testing.php Test framework (272 lines, writes to non-existent table)
views/testing.php Test UI (181 lines)
views/pwa/testing.php PWA test UI (79 lines)
css/pwa-tablet-aurora.css Unreferenced CSS (63KB)
deployment/schema.sql Deprecated schema (2018 lines)
deployment/goals_tables.sql Deprecated schema (80 lines)
deployment/sql/remove_nextcloud_settings.sql One-off migration
rink_images_migration.sql Redundant migration
migrations/001_add_video_export_url.sql Redundant migration
lbracket_test_preview.html Test artifact
ihs_rink_preview.png Test image
test_rink_preview.png Test image
docs/lbracket_test.png Test image
12x .gitkeep files Directories already contain files

Modified Files — Demo Data Removed

File What Was Removed
views/sessions_upcoming.php 46-line demo sessions array with fake coaches
views/pwa/sessions.php 53-line demo sessions array with fake data
views/drills_library.php 40-line demo drills array
views/sessions_booking.php Demo booking flags and notice
views/video_drill_review.php Demo data flag and notice
views/coach_calendar.php Demo data flag
database_schema.sql Demo teams INSERT (4 teams), testing_results table, is_demo columns (3 tables)
dashboard.php Removed testing route
pwa.php Removed testing route
pwa_tablet.php Removed testing route

Performance Quick Wins (Phase C)

Database Indexes Added (database_schema.sql)

7 composite indexes for high-traffic query patterns:

Table Index Columns
bookings idx_session_status (session_id, status)
performance_stats idx_athlete_stat_type (athlete_id, stat_type)
evaluation_scores idx_athlete_date (athlete_id, evaluation_date)
messages idx_to_read (to_user_id, is_read)
user_packages idx_user_expiry_credits (user_id, expiry_date, credits_remaining)
goal_steps idx_goal_completed (goal_id, is_completed)
session_attendance idx_session_status (session_id, attendance_status)

Other Performance Fixes

  • db_config.php — Enabled gzip output buffering (ob_start("ob_gzhandler"))
  • views/gameplan/gp_whiteboard.php — Commented out missing js/ice_canvas.js reference (was causing 404)
  • lib/cdn_resources.php — Added SRI hash for dash.js CDN resource

Impact Summary

Metric Count
Files deleted 25
Files modified 14
Files created 2
Lines removed ~5,700
Lines added ~200
Net reduction ~5,500 lines

Testing

  • All changes have been verified locally
  • No breaking changes to existing functionality
  • Demo data removal shows proper empty states
  • Security headers can be enabled by including nginx_security.conf in server block
  • Performance indexes will be applied on next schema migration

Next Steps (Future PRs)

  • Phase D: Security Hardening — Rate limiting, RLS scoping, CSP nonce migration
  • Phase E: Chat E2E Encryption — Major architectural feature (40-80 hours)
  • Phase F: Architecture — Extract DB queries from views, consolidate PWA/desktop logic
## Summary Comprehensive security cleanup, demo data removal, and performance optimization for Arctic Wolves Production. --- ## Security Fixes (Phase A) ### New Files - **`deployment/nginx_security.conf`** — Nginx security configuration with: - 6 security headers (X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy, HSTS) - `server_tokens off` to hide server version - Location blocks blocking access to: `.env`, `.sql`, `.ht*`, `/deployment/`, `/config/`, `/logs/`, `/backups/`, `/receipts/`, `.git` - Static asset caching with 1-year expiry - **`deployment/php_security.ini`** — PHP security settings: - `expose_php = Off` to hide PHP version - Session security flags (httponly, samesite, strict_mode) - Dangerous functions disabled (exec, passthru, shell_exec, system, proc_open, popen, parse_ini_file, show_source) - Error handling (display_errors Off, log_errors On) ### Modified Files - **`db_config.php`** — Added direct-access guard preventing HTTP access - **`config/session.php`** — Added direct-access guard preventing HTTP access - **`views/pwa/messages.php`** — Fixed innerHTML XSS vulnerability (3 locations: renderThreadMessages, send button, chat polling) - **`lib/cdn_resources.php`** — Added `defer` attribute to non-critical CDN scripts (chart-js, sortable-js, qrcode, html2canvas, jsqr) --- ## Demo Data & Dead File Cleanup (Phase B) ### Deleted Files (25 files) | File | Reason | |------|--------| | `process_testing.php` | Test framework (272 lines, writes to non-existent table) | | `views/testing.php` | Test UI (181 lines) | | `views/pwa/testing.php` | PWA test UI (79 lines) | | `css/pwa-tablet-aurora.css` | Unreferenced CSS (63KB) | | `deployment/schema.sql` | Deprecated schema (2018 lines) | | `deployment/goals_tables.sql` | Deprecated schema (80 lines) | | `deployment/sql/remove_nextcloud_settings.sql` | One-off migration | | `rink_images_migration.sql` | Redundant migration | | `migrations/001_add_video_export_url.sql` | Redundant migration | | `lbracket_test_preview.html` | Test artifact | | `ihs_rink_preview.png` | Test image | | `test_rink_preview.png` | Test image | | `docs/lbracket_test.png` | Test image | | 12x `.gitkeep` files | Directories already contain files | ### Modified Files — Demo Data Removed | File | What Was Removed | |------|------------------| | `views/sessions_upcoming.php` | 46-line demo sessions array with fake coaches | | `views/pwa/sessions.php` | 53-line demo sessions array with fake data | | `views/drills_library.php` | 40-line demo drills array | | `views/sessions_booking.php` | Demo booking flags and notice | | `views/video_drill_review.php` | Demo data flag and notice | | `views/coach_calendar.php` | Demo data flag | | `database_schema.sql` | Demo teams INSERT (4 teams), testing_results table, is_demo columns (3 tables) | | `dashboard.php` | Removed testing route | | `pwa.php` | Removed testing route | | `pwa_tablet.php` | Removed testing route | --- ## Performance Quick Wins (Phase C) ### Database Indexes Added (`database_schema.sql`) 7 composite indexes for high-traffic query patterns: | Table | Index | Columns | |-------|-------|---------| | `bookings` | `idx_session_status` | `(session_id, status)` | | `performance_stats` | `idx_athlete_stat_type` | `(athlete_id, stat_type)` | | `evaluation_scores` | `idx_athlete_date` | `(athlete_id, evaluation_date)` | | `messages` | `idx_to_read` | `(to_user_id, is_read)` | | `user_packages` | `idx_user_expiry_credits` | `(user_id, expiry_date, credits_remaining)` | | `goal_steps` | `idx_goal_completed` | `(goal_id, is_completed)` | | `session_attendance` | `idx_session_status` | `(session_id, attendance_status)` | ### Other Performance Fixes - **`db_config.php`** — Enabled gzip output buffering (`ob_start("ob_gzhandler")`) - **`views/gameplan/gp_whiteboard.php`** — Commented out missing `js/ice_canvas.js` reference (was causing 404) - **`lib/cdn_resources.php`** — Added SRI hash for dash.js CDN resource --- ## Impact Summary | Metric | Count | |--------|-------| | Files deleted | 25 | | Files modified | 14 | | Files created | 2 | | Lines removed | ~5,700 | | Lines added | ~200 | | Net reduction | ~5,500 lines | ## Testing - All changes have been verified locally - No breaking changes to existing functionality - Demo data removal shows proper empty states - Security headers can be enabled by including `nginx_security.conf` in server block - Performance indexes will be applied on next schema migration ## Next Steps (Future PRs) - **Phase D: Security Hardening** — Rate limiting, RLS scoping, CSP nonce migration - **Phase E: Chat E2E Encryption** — Major architectural feature (40-80 hours) - **Phase F: Architecture** — Extract DB queries from views, consolidate PWA/desktop logic
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin security-cleanup-and-optimization:security-cleanup-and-optimization
git switch security-cleanup-and-optimization

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff security-cleanup-and-optimization
git switch security-cleanup-and-optimization
git rebase main
git switch main
git merge --ff-only security-cleanup-and-optimization
git switch security-cleanup-and-optimization
git rebase main
git switch main
git merge --no-ff security-cleanup-and-optimization
git switch main
git merge --squash security-cleanup-and-optimization
git switch main
git merge --ff-only security-cleanup-and-optimization
git switch main
git merge security-cleanup-and-optimization
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
crashmedia/Arctic-Wolves-Production!20
No description provided.