oleg/maria_uslugi
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V10.1 stable avec correction securité,bug sur csrf dans index

Browse Source
This commit is contained in:
Oleg Barykin committed 2026-05-27 13:54:59 +02:00
1 parent e9d0010451
commit 21f34c64c9
11 files changed
+1136 -445
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.htaccess
+248 -22
View File
@@ -1,4 +1,227 @@
# --- Sécurité : en-têtes globaux ---
# BEGIN Security - Shared rules for all sites
# Last updated: 2026-05-22
# Block known attacker ranges (VPS/hosting providers used for brute force)
<IfModule mod_rewrite.c>
RewriteEngine On
# FranTech / PonyNET / BuyVM
RewriteCond %{REMOTE_ADDR} ^107\.189\.
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^209\.141\.
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^104\.244\.73\.
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^198\.98\.
RewriteRule .* - [F,L]
# WatchComm / FNI
RewriteCond %{REMOTE_ADDR} ^205\.185\.
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^45\.61\.18[4-8]\.
RewriteRule .* - [F,L]
# AltunHOST / hosting providers
RewriteCond %{REMOTE_ADDR} ^5\.83\.135\.
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^192\.109\.200\.
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^103\.60\.12\.
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^185\.198\.240\.
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^173\.239\.240\.
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^104\.234\.53\.
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^104\.238\.222\.
RewriteRule .* - [F,L]
# TECHOFF SRV LIMITED (scraper)
RewriteCond %{REMOTE_ADDR} ^195\.178\.110\.
RewriteRule .* - [F,L]
# Brute force attackers (May 11)
RewriteCond %{REMOTE_ADDR} ^103\.59\.161\.
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^185\.153\.151\.
RewriteRule .* - [F,L]
# F.N.S. HOLDINGS LIMITED
RewriteCond %{REMOTE_ADDR} ^216\.73\.160\.
RewriteRule .* - [F,L]
# DigitalOcean brute force
RewriteCond %{REMOTE_ADDR} ^143\.198\.
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^146\.190\.
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^142\.93\.
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^170\.64\.
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^134\.209\.
RewriteRule .* - [F,L]
# Cipher Operations (Serbia)
RewriteCond %{REMOTE_ADDR} ^62\.60\.130\.
RewriteRule .* - [F,L]
# UK Dedicated Servers
RewriteCond %{REMOTE_ADDR} ^185\.192\.7[0-1]\.
RewriteRule .* - [F,L]
# GSL Networks
RewriteCond %{REMOTE_ADDR} ^85\.203\.2[1-3]\.
RewriteRule .* - [F,L]
# Argon Data Communication
RewriteCond %{REMOTE_ADDR} ^157\.66\.56\.
RewriteRule .* - [F,L]
# Pfcloud UG
RewriteCond %{REMOTE_ADDR} ^217\.60\.241\.
RewriteRule .* - [F,L]
# Omegatech LTD
RewriteCond %{REMOTE_ADDR} ^158\.94\.210\.
RewriteRule .* - [F,L]
# Individual attackers
RewriteCond %{REMOTE_ADDR} ^94\.26\.106\.111$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^176\.65\.132\.166$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^37\.120\.217\.182$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^8\.210\.170\.233$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^120\.24\.67\.156$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^140\.245\.111\.5$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^20\.9\.82\.33$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^45\.156\.87\.222$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^31\.57\.184\.107$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^92\.205\.109\.21$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^72\.167\.150\.128$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^165\.154\.38\.157$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^50\.6\.207\.27$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^141\.98\.11\.117$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^136\.243\.176\.166$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^123\.30\.233\.1[2-3]$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^91\.227\.37\.60$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^78\.142\.18\.172$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^66\.116\.235\.214$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^149\.88\.110\.49$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^35\.227\.109\.86$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^103\.253\.27\.44$
RewriteRule .* - [F,L]
# Contabo (individual IP)
RewriteCond %{REMOTE_ADDR} ^85\.239\.235\.108$
RewriteRule .* - [F,L]
# xmlrpc + brute force attackers (May 22)
RewriteCond %{REMOTE_ADDR} ^105\.184\.79\.191$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^45\.94\.31\.119$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^138\.2\.98\.238$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^20\.89\.64\.143$
RewriteRule .* - [F,L]
# Vulnerability scanners (May 22-23)
RewriteCond %{REMOTE_ADDR} ^143\.92\.32\.30$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^194\.26\.192\.219$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^38\.99\.81\.38$
RewriteRule .* - [F,L]
# Massive brute force (May 23)
RewriteCond %{REMOTE_ADDR} ^193\.26\.115\.
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^51\.79\.177\.162$
RewriteRule .* - [F,L]
# ALFA shell scanners / 2ipcore crawler
RewriteCond %{REMOTE_ADDR} ^185\.213\.154\.185$
RewriteRule .* - [F,L]
# Vulnerability scanners (May 23 evening)
# Microsoft Azure — shell/backdoor scanner
RewriteCond %{REMOTE_ADDR} ^20\.151\.117\.104$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^4\.228\.100\.214$
RewriteRule .* - [F,L]
# 2ipcore ALFA shell scanners (expand to /24)
RewriteCond %{REMOTE_ADDR} ^2\.58\.56\.
RewriteRule .* - [F,L]
# DigitalOcean scanners
RewriteCond %{REMOTE_ADDR} ^157\.230\.
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^139\.59\.
RewriteRule .* - [F,L]
# Directory enumeration scanner
RewriteCond %{REMOTE_ADDR} ^91\.199\.118\.57$
RewriteRule .* - [F,L]
# ALFA shell scanners (expand to /24)
RewriteCond %{REMOTE_ADDR} ^45\.92\.1\.
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^45\.154\.98\.
RewriteRule .* - [F,L]
# Google Cloud spammer
RewriteCond %{REMOTE_ADDR} ^34\.42\.34\.237$
RewriteRule .* - [F,L]
# Azure vulnerability scanners (May 24)
RewriteCond %{REMOTE_ADDR} ^20\.48\.233\.234$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^20\.63\.100\.211$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^20\.226\.23\.23$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^20\.9\.81\.163$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^20\.63\.46\.176$
RewriteRule .* - [F,L]
# Persistent brute force (Hetzner)
RewriteCond %{REMOTE_ADDR} ^168\.119\.26\.89$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^173\.249\.4\.57$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^216\.251\.35\.201$
RewriteRule .* - [F,L]
# File enumeration scanner (May 25)
RewriteCond %{REMOTE_ADDR} ^158\.158\.44\.35$
RewriteRule .* - [F,L]
# Reconnaissance bots / Tor (May 25)
RewriteCond %{REMOTE_ADDR} ^149\.102\.230\.133$
RewriteRule .* - [F,L]
RewriteCond %{REMOTE_ADDR} ^82\.102\.18\.116$
RewriteRule .* - [F,L]
# Directory scanner (May 25)
RewriteCond %{REMOTE_ADDR} ^195\.3\.220\.7$
RewriteRule .* - [F,L]
# Azure shell scanner (May 25)
RewriteCond %{REMOTE_ADDR} ^20\.226\.59\.228$
RewriteRule .* - [F,L]
# WP installer scanner (May 26)
RewriteCond %{REMOTE_ADDR} ^194\.26\.192\.75$
RewriteRule .* - [F,L]
# Azure webshell scanner (May 26)
RewriteCond %{REMOTE_ADDR} ^104\.43\.242\.179$
RewriteRule .* - [F,L]
# Block non-existent plugin/theme probes (saves PHP workers)
RewriteRule ^ALFA_DATA/ - [F,L]
RewriteRule ^alfacgiapi/ - [F,L]
</IfModule>
# Block xmlrpc.php
<Files xmlrpc.php>
<IfModule mod_authz_core.c>
Require all denied
</IfModule>
</Files>
# END Security
# --- Security headers ---
<IfModule mod_headers.c>
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "DENY"
@@ -6,60 +229,65 @@
Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
Header always set Cross-Origin-Opener-Policy "same-origin"
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
# CSP en observation (ne bloque rien pour l’instant)
# CSP en observation (ne bloque rien pour l'instant)
# --- CSP (global) : autorise Matomo + CDNs ---
Header always set Content-Security-Policy-Report-Only "default-src 'self'; img-src 'self' data: https: https://staging.uslugi.fr/matomo/; script-src 'self' 'unsafe-inline' https://staging.uslugi.fr/matomo/ https://cdn.jsdelivr.net https://www.googletagmanager.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https:; frame-ancestors 'none'"
</IfModule>
# Réduire surface d’attaque
# Reduce attack surface
Options -Indexes -MultiViews
# --- Réécriture & HTTPS ---
# --- Rewrite & HTTPS ---
RewriteEngine On
# Forcer HTTPS (OK derrière proxy/Varnish)
# Force HTTPS (behind proxy/Varnish)
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
# Laisser passer Let's Encrypt
# Let's Encrypt
RewriteRule ^\.well-known/acme-challenge/ - [L]
# --- Protection chemins & fichiers sensibles ---
# Bloquer VCS
# --- Sensitive paths & files ---
# Block VCS
RewriteRule ^(\.git|\.svn|\.hg)(/|$) - [F]
# Bloquer dotfiles (sauf .well-known)
# Block dotfiles (except .well-known)
RewriteRule ^\.(?!well-known/) - [F]
# Bloquer extensions sensibles
# Block sensitive extensions
RewriteRule \.(env|ini|log|bak|old|sql|zip|tar|gz|7z)$ - [F]
# Bloquer fichiers sauvegardes *~
# Block backup files *~
RewriteRule ^(.*/)?[^/]+~$ - [F]
# Bloquer certains noms explicites
# Block specific filenames
<FilesMatch "^(config\.php|config\.sample\.php|composer\.json|composer\.lock|package\.json|yarn\.lock)$">
Require all denied
</FilesMatch>
# Ceinture+bretelles : jamais de scripts dans /uploads
# No scripts in /uploads
RewriteRule ^(?:public/)?uploads/.*\.(php|phtml|phar|phps|cgi|pl|py|sh|rb)$ - [F,NC]
# --- Routage applicatif ---
# 0) Servir les fichiers/dirs existants
# --- Application routing ---
# 0) Serve existing files/dirs
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]
# 1) (optionnel) Normaliser la barre finale (sauf /)
# 1) Normalize trailing slash (except /)
RewriteCond %{REQUEST_URI} !^/$
RewriteCond %{REQUEST_URI} (.+)/$
RewriteRule ^ %1 [R=301,L]
# 2) URL "propres" sans extension -> router.php
# 2) Clean URLs -> router.php
RewriteRule ^([^.]+)$ router.php?slug=$1 [L,QSA]
# 3) Fallback général
# 2bis) Unknown PHP files => 404
RewriteCond %{REQUEST_URI} \.php$ [NC]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ - [R=404,L]
# 3) General fallback
RewriteRule ^ index.php [L,QSA]
# --- PWA / Types & cache SW ---
# --- PWA / Types & SW cache ---
AddType application/manifest+json .webmanifest
<Files "sw.js">
@@ -68,7 +296,7 @@ AddType application/manifest+json .webmanifest
Header set Expires "0"
</Files>
# Activer des en-têtes différents uniquement pour /visio/join.php
# Visio-specific headers for /visio/join.php
SetEnvIf Request_URI "^/visio/join\.php$" IS_VISIO=1
<IfModule mod_headers.c>
@@ -81,5 +309,3 @@ SetEnvIf Request_URI "^/visio/join\.php$" IS_VISIO=1
</IfModule>
DirectoryIndex index.php index.html