v1.0.2

PHPDB Security Patch Notes

This package contains a hardened phpdb.php with the following changes:

Hardening changes

1. Cipher allow-list: configuration can no longer downgrade OpenSSL ciphers. Only AES-256-CBC is accepted; invalid values fall back safely and are audit-logged.
2. Path policy for imports: by default, imports are restricted to a dedicated folder under base_dir (default imports/). Override with allow_import_outside_base=true if you really need it.
3. Base directory web-access protection: base directory is automatically passed through secureDatabase() to write deny rules (best-effort).
4. Safer canonical path checks: base-dir restriction check is boundary-safe.
5. Strict base64 decoding: legacy v1 key decode is now strict and fails closed.
6. Atomic/locked export writes: export files are written with LOCK_EX.
7. secureDatabase() reliability: will create the target directory when locking so realpath() works.

New optional phpdb.json keys

{
  "import_dir": "imports",
  "allow_import_outside_base": false
}

Note: No functional changes were made to the v2 on-disk format.