The compose smoke test needs a Docker daemon, which jobs on the current docker runner do not have. It is kept commented out so it can be re-enabled once such a runner exists.
There are no Windows runners, so the workflow never ran. Builds now follow
the kaniko setup used in CCCHH/oci-images:
- kaniko in a container on the `docker` runner, one matrix job per image
- authenticates as forgejo-actions with the PACKAGES_TOKEN secret
- adds OCI annotations (ref.name, revision, url, source)
Publishing is limited to pushes to refs/heads/main, which push `latest`
and an immutable `sha-<commit>` tag. All other refs build with
KANIKO_NO_PUSH and do not receive the token. Tags are no longer derived
from ref names, so a branch named `latest` or a tag named `main` can no
longer overwrite the production image.
The docker compose smoke test is dropped, as there is no Docker daemon
inside the kaniko container.
There are no Windows runners; build the images with kaniko in a container
on the `docker` runner, as on the link-updates branch, while keeping the
publishing restrictions:
- only pushes to refs/heads/main publish, as `latest` and `sha-<commit>`
- other refs build with --no-push under a ci-<commit> tag
- registry credentials are only passed to the build when publishing
The docker compose smoke test is dropped, as there is no Docker daemon
inside the kaniko container.
create_camera_update_statements.php wrote OSM tag keys and values unescaped
into /migrations/*.sql. Values are now escaped and node ids cast to int.
The sequence number argument must be numeric and is bound as a parameter
instead of being concatenated into SQL and the output path.
Every pushed ref built and pushed images, with the tag derived from the ref
name. A branch named "latest" or a git tag named "main" therefore
overwrote the production image, and ref names were interpolated into shell
scripts unquoted (script injection).
- images are only pushed for pushes to refs/heads/main
- other refs are built and tested with a ci-<sha> tag, never pushed
- registry login happens only when publishing, after the compose test
- main additionally pushes an immutable sha-<sha> tag for pinning
- expression values are passed to scripts via env
The registry credentials still need to be restricted to main on the
Forgejo side, since a pushed branch can modify this workflow.
- document root is owned by root and not writable by www-data
(the base image ships /var/www/html as www-data with mode 1777)
- uses php.ini-production, so errors are not shown to clients
- disables directory listings, expose_php and the detailed server signature
Nominatim results were inserted via innerHTML and loaded as a JSONP script
with an unencoded query. Results are now fetched as JSON, the query is URL
encoded, text is escaped and coordinates must be numeric.
camera.php built its JSON by hand with htmlentities(), which leaves
backslashes intact, and the client parsed it with eval() and inserted tag
values into the popup as HTML. A tag value such as <img ...> therefore
became live markup (stored XSS for anyone able to edit OSM data), and a lone
backslash broke parsing of the whole response.
- camera.php now builds the response with json_encode() and returns raw values
- tags named lat, lon, id, count, multi or poly no longer override the
fields set by the server
- error responses no longer include database error messages
- the client uses JSON.parse() and escapes all keys and values; only
http(s) URLs are rendered as links/images
