Server : Apache/2 System : Linux server-15-235-50-60 5.15.0-164-generic #174-Ubuntu SMP Fri Nov 14 20:25:16 UTC 2025 x86_64 User : gositeme ( 1004) PHP Version : 8.2.29 Disable Function : exec,system,passthru,shell_exec,proc_close,proc_open,dl,popen,show_source,posix_kill,posix_mkfifo,posix_getpwuid,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname Directory :  /home/gositeme/domains/soundstudiopro.com/public_html/

Upload File : current_dir [ Writeable ] document_root [ Writeable ]

<?php
/**
 * SECURITY ENHANCEMENTS FOR SOUNDSTUDIOPRO
 * 
 * This file contains critical security fixes that should be implemented immediately
 * to protect against SQL injection, XSS, CSRF, and other attacks.
 */

// 1. INPUT VALIDATION AND SANITIZATION FUNCTIONS
function validateInteger($value, $min = null, $max = null) {
    $int = filter_var($value, FILTER_VALIDATE_INT);
    if ($int === false) return null;
    if ($min !== null && $int < $min) return null;
    if ($max !== null && $int > $max) return null;
    return $int;
}

function validateEmail($email) {
    return filter_var($email, FILTER_VALIDATE_EMAIL) ? $email : null;
}

function sanitizeString($string, $maxLength = 255) {
    $string = trim($string);
    $string = htmlspecialchars($string, ENT_QUOTES, 'UTF-8');
    return strlen($string) > $maxLength ? substr($string, 0, $maxLength) : $string;
}

function validateAlphanumeric($string, $maxLength = 255) {
    if (!preg_match('/^[a-zA-Z0-9_-]+$/', $string)) return null;
    return strlen($string) > $maxLength ? substr($string, 0, $maxLength) : $string;
}

// 2. CSRF PROTECTION
function generateCSRFToken() {
    if (!isset($_SESSION['csrf_token'])) {
        $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
    }
    return $_SESSION['csrf_token'];
}

function validateCSRFToken($token) {
    return isset($_SESSION['csrf_token']) && hash_equals($_SESSION['csrf_token'], $token);
}

// 3. SESSION SECURITY
function secureSession() {
    // Regenerate session ID on login
    if (!isset($_SESSION['regenerated'])) {
        session_regenerate_id(true);
        $_SESSION['regenerated'] = true;
    }
    
    // Set session timeout (2 hours)
    if (isset($_SESSION['last_activity']) && (time() - $_SESSION['last_activity'] > 7200)) {
        session_unset();
        session_destroy();
        header('Location: /auth/login.php?timeout=1');
        exit;
    }
    $_SESSION['last_activity'] = time();
}

// 4. RATE LIMITING
function checkRateLimit($action, $limit = 10, $window = 60) {
    $ip = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
    $key = "rate_limit_{$action}_{$ip}";
    
    if (!isset($_SESSION[$key])) {
        $_SESSION[$key] = ['count' => 0, 'reset_time' => time() + $window];
    }
    
    if (time() > $_SESSION[$key]['reset_time']) {
        $_SESSION[$key] = ['count' => 0, 'reset_time' => time() + $window];
    }
    
    if ($_SESSION[$key]['count'] >= $limit) {
        return false; // Rate limit exceeded
    }
    
    $_SESSION[$key]['count']++;
    return true;
}

// 5. SECURE HEADERS
function setSecurityHeaders() {
    header('X-Content-Type-Options: nosniff');
    header('X-Frame-Options: DENY');
    header('X-XSS-Protection: 1; mode=block');
    header('Referrer-Policy: strict-origin-when-cross-origin');
    header('Content-Security-Policy: default-src \'self\'; script-src \'self\' \'unsafe-inline\' https://js.stripe.com; style-src \'self\' \'unsafe-inline\'; img-src \'self\' data: https:; font-src \'self\' data:; connect-src \'self\' https://api.stripe.com;');
}

// 6. FILE UPLOAD SECURITY
function validateFileUpload($file, $allowedTypes = ['jpg', 'jpeg', 'png', 'gif'], $maxSize = 5242880) {
    if (!isset($file['tmp_name']) || !is_uploaded_file($file['tmp_name'])) {
        return false;
    }
    
    // Check file size
    if ($file['size'] > $maxSize) {
        return false;
    }
    
    // Check file type
    $finfo = finfo_open(FILEINFO_MIME_TYPE);
    $mimeType = finfo_file($finfo, $file['tmp_name']);
    finfo_close($finfo);
    
    $allowedMimes = [
        'image/jpeg',
        'image/png',
        'image/gif',
        'image/webp'
    ];
    
    if (!in_array($mimeType, $allowedMimes)) {
        return false;
    }
    
    // Additional validation
    $extension = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
    if (!in_array($extension, $allowedTypes)) {
        return false;
    }
    
    return true;
}

// 7. SQL INJECTION PREVENTION ENHANCEMENT
function secureQuery($pdo, $sql, $params = []) {
    try {
        $stmt = $pdo->prepare($sql);
        $stmt->execute($params);
        return $stmt;
    } catch (PDOException $e) {
        error_log("Database query failed: " . $e->getMessage());
        return false;
    }
}

// 8. XSS PREVENTION
function xssPrevent($data) {
    if (is_array($data)) {
        return array_map('xssPrevent', $data);
    }
    return htmlspecialchars($data, ENT_QUOTES, 'UTF-8');
}

// 9. ADMIN ACCESS VALIDATION
function validateAdminAccess() {
    if (!isset($_SESSION['user_id']) || !isset($_SESSION['is_admin']) || !$_SESSION['is_admin']) {
        error_log("Unauthorized admin access attempt from IP: " . ($_SERVER['REMOTE_ADDR'] ?? 'unknown'));
        header('Location: /auth/login.php');
        exit;
    }
}

// 10. API SECURITY
function validateAPIRequest() {
    // Check for valid session
    if (!isset($_SESSION['user_id'])) {
        http_response_code(401);
        echo json_encode(['error' => 'Unauthorized']);
        exit;
    }
    
    // Check rate limiting
    if (!checkRateLimit('api_request', 100, 60)) {
        http_response_code(429);
        echo json_encode(['error' => 'Rate limit exceeded']);
        exit;
    }
}

// 11. ERROR HANDLING
function secureErrorHandler($errno, $errstr, $errfile, $errline) {
    // Log errors but don't display them in production
    error_log("Error [$errno]: $errstr in $errfile on line $errline");
    
    if (defined('DEBUG_MODE') && DEBUG_MODE) {
        return false; // Let PHP handle the error normally in debug mode
    }
    
    return true; // Suppress error display in production
}

// 12. INITIALIZATION
function initializeSecurity() {
    // Set error handler
    set_error_handler('secureErrorHandler');
    
    // Set security headers
    setSecurityHeaders();
    
    // Secure session
    secureSession();
    
    // Start session if not already started
    if (session_status() === PHP_SESSION_NONE) {
        session_start();
    }
}

// 13. USAGE EXAMPLES
/*
// In your login.php:
initializeSecurity();

$email = validateEmail($_POST['email'] ?? '');
$password = $_POST['password'] ?? '';

if (!$email) {
    $error = 'Invalid email format';
}

// In your API endpoints:
validateAPIRequest();

$user_id = validateInteger($_GET['user_id'] ?? null);
if (!$user_id) {
    http_response_code(400);
    echo json_encode(['error' => 'Invalid user ID']);
    exit;
}

// In your forms:
<form method="POST">
    <input type="hidden" name="csrf_token" value="<?= generateCSRFToken() ?>">
    <!-- form fields -->
</form>

// Validate CSRF in form processing:
if (!validateCSRFToken($_POST['csrf_token'] ?? '')) {
    die('CSRF token validation failed');
}
*/

?>