From 058979edd050c7220516db0aa4a5400a342ae972 Mon Sep 17 00:00:00 2001 From: Jon Stovell Date: Thu, 6 Nov 2025 21:54:16 -0700 Subject: [PATCH 1/3] Adds a script to secure the vendor directory and subdirectories --- secure-vendor-dir.php | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 secure-vendor-dir.php diff --git a/secure-vendor-dir.php b/secure-vendor-dir.php new file mode 100644 index 0000000..d1e0692 --- /dev/null +++ b/secure-vendor-dir.php @@ -0,0 +1,34 @@ +isDir()) { + $dirs[] = $item->getPathname(); + } +} + +foreach ($dirs as $key => $dir) { + if (!file_exists($dir . '/index.php')) { + copy('./Sources/index.php', $dir . '/index.php'); + } +} From 325dca2070cc339c0c2258ab36c71f7bf87794c0 Mon Sep 17 00:00:00 2001 From: Jon Stovell Date: Thu, 6 Nov 2025 22:25:58 -0700 Subject: [PATCH 2/3] Removes references to non-existent dependency directories --- check-eof.php | 9 +++------ check-smf-license.php | 13 ++----------- runTools.sh | 5 +---- 3 files changed, 6 insertions(+), 21 deletions(-) diff --git a/check-eof.php b/check-eof.php index 466d118..54c3b4c 100755 --- a/check-eof.php +++ b/check-eof.php @@ -5,10 +5,10 @@ * * @package SMF * @author Simple Machines https://www.simplemachines.org - * @copyright 2022 Simple Machines and individual contributors + * @copyright 2025 Simple Machines and individual contributors * @license https://www.simplemachines.org/about/smf/license.php BSD * - * @version 2.1.0 + * @version 3.0 Alpha 4 */ // Stuff we will ignore. @@ -18,9 +18,6 @@ './tests/', './vendor/', './.git', - './Sources/minify/', - './Sources/ReCaptcha/', - './ZxcvbnPhp/', // We will ignore Settings.php if this is a live dev site. './Settings.php', @@ -64,4 +61,4 @@ } catch (Exception $e) { fwrite(STDERR, $e->getMessage() . "\n"); exit(1); -} \ No newline at end of file +} diff --git a/check-smf-license.php b/check-smf-license.php index d444e32..8056792 100755 --- a/check-smf-license.php +++ b/check-smf-license.php @@ -5,10 +5,10 @@ * * @package SMF * @author Simple Machines https://www.simplemachines.org - * @copyright 2024 Simple Machines and individual contributors + * @copyright 2025 Simple Machines and individual contributors * @license https://www.simplemachines.org/about/smf/license.php BSD * - * @version 3.0 Alpha 1 + * @version 3.0 Alpha 4 */ // Stuff we will ignore. @@ -43,15 +43,6 @@ '\./tests/', '\./vendor/', - // Minify Stuff. - '\./Sources/minify/', - - // random_compat(). - '\./Sources/random_compat/', - - // ReCaptcha Stuff. - '\./Sources/ReCaptcha/', - // We will ignore Settings.php if this is a live dev site. '\./Settings\.php', '\./Settings_bak\.php', diff --git a/runTools.sh b/runTools.sh index 37ac350..51b4c47 100644 --- a/runTools.sh +++ b/runTools.sh @@ -1,9 +1,6 @@ #!/bin/bash find . -type f -name "*.php" -print0 \ - -o -path "./Sources/minify" -prune \ - -o -path "./Sources/random_compat" -prune \ - -o -path "./Sources/ReCaptcha" -prune \ | xargs -0 -n1 -P4 php -l \ | (! grep -v "No syntax errors detected" ) @@ -11,4 +8,4 @@ php check-signed-off.php php check-eof.php php check-smf-license.php php check-smf-languages.php -php check-version.php \ No newline at end of file +php check-version.php From f57dbfbbe0fdd78919b456e477a738ec41d6430a Mon Sep 17 00:00:00 2001 From: Jon Stovell Date: Thu, 6 Nov 2025 22:26:22 -0700 Subject: [PATCH 3/3] Consolidates some regular expressions --- check-smf-license.php | 29 +++++++---------------------- 1 file changed, 7 insertions(+), 22 deletions(-) diff --git a/check-smf-license.php b/check-smf-license.php index 8056792..d0ce928 100755 --- a/check-smf-license.php +++ b/check-smf-license.php @@ -13,36 +13,21 @@ // Stuff we will ignore. $ignoreFiles = [ - // Index files. - '\./attachments/index\.php', - '\./avatars/index\.php', - '\./avatars/[A-Za-z0-9]+/index\.php', - '\./cache/index\.php', - '\./custom_avatar/index\.php', - '\./Packages/index\.php', - '\./Packages/backups/index\.php', - '\./Smileys/[A-Za-z0-9]+/index\.php', - '\./Smileys/index\.php', - '\./Sources/index\.php', - '\./Sources/[\w/]+/index\.php', - '\./other/Schema/[\w/]+/*\.php', - '\./Themes/default/index\.php', - '\./Themes/default/[\w/]+/index\.php', - '\./Themes/index\.php', + // Index files in subdirectories. + '\./(?:\w+/)+\bindex\.php', // Language Files are ignored as they don't use the License format. - './Themes/default/languages/[A-Za-z0-9]+\.english\.php', - './Languages/en_US/[A-Za-z0-9]+\.php', - './Themes/default/languages/en_US/[A-Za-z0-9]+\.php', - '\./Languages/index\.php', + './Themes/default/languages/', + '\./Languages/', // Cache and miscellaneous. '\./cache/', - '\./other/db_last_error\.php', - '\./other/update_[A-Za-z0-9_]+\.php', '\./tests/', '\./vendor/', + // Everything in other except install.php, upgrade.php, Settings.php and Settings_bak.php. + '\./other/(?!install|upgrade|Settings)\w+\.php', + // We will ignore Settings.php if this is a live dev site. '\./Settings\.php', '\./Settings_bak\.php',