capdrupal 3.0.2 → 3.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 84051b7cfc562b0ada6947c8d24c38449319a7577fa4f569d91cb02a5bc3a511
-  data.tar.gz: 7a544994a5c5af01dd6099e0dc9af8cd7454d3f8bc34a2a511d2743a398998a9
+  metadata.gz: 7266984d5cca0bd4f27392796b71cca44f6a5be8017743ec8075c030e87d3c99
+  data.tar.gz: 719349f1a190ef5aca2833f9e37a682d3a111d1ec6498c6bf8a4d0a9c945d7cc
 SHA512:
-  metadata.gz: 3512b71d331a6d6c885c715c103bd2f70c6641698cedb137ad101931ee5d7928ec620c2cd97d6c768d1f278d2b5ab55908ac4b7e206a6398de234453205679a4
-  data.tar.gz: 9ad4303413fdd2a278718b1a373f1b704c0cafb7856f77b237eddd6c7647018bd58426dd05db755d5fac69f7254a49c67ae8fa0fce491a7d9bae4ddd731bf3f7
+  metadata.gz: 2b75fbaa093cc8e3d858f652bba34604ff32534ff8a21e46614c89feae8a77d21115638164cf15a09a65154a87da653da932c623615a3ebec7a3397f168ada72
+  data.tar.gz: d4ef047b57d2f1385d50db3305ce5b990e6ef955e62e333ada3bd097a04cc23138a8434c05b5a62e4263072357ce9507aad16d69e4bb7a980bbc96ea6665c1bd

data/CHANGELOG.md

@@ -1,6 +1,13 @@
 # Capdrupal Changelog
 
-## NEXT RELEASE
+## NEXT RELEASE
+
+## 3.0.4 (2023-04-25)
+ - add command `drupal:security:obscurity:files` to obfuscate Drupal sensitive files by deletion
+ - add command `drupal:security:obscurity:htaccess` to obfuscate Drupal sensitive files by htaccess
+
+## 3.0.3 (2023-03-14)
+ - Only files directory must have permissions fixed to be writable, not all shared files.
 
 ## 3.0.2 (2022-12-22)
  - Allow Site directory to be configured

data/README.md

@@ -12,6 +12,7 @@ Capdrupal Gem Version | Branch | Capistrano Version | Drupal Version
 0.11.0                | d7     | 2                  | 7.x
 3.x                   | main   | 3.x                | 8.x
 3.x                   | main   | 3.x                | 9.x
+3.x                   | main   | 3.x                | 10.x
 
 ## Prerequisites
 
@@ -152,6 +153,10 @@ namespace :deploy do
 
   # Clear your Drupal 8 cache.
   after :updated, "drupal:cache:clear"
+  
+  # Obfuscate Drupal sensitive files by removing or by denying access to them.
+  # after :updated, "drupal:security:obscurity:files"
+  # after :updated, "drupal:security:obscurity:htaccess"
 
   # Disable the maintence on the Drupal project.
   after :updated, "drupal:maintenance:off"

data/capdrupal.gemspec

@@ -3,7 +3,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
 Gem::Specification.new do |spec|
   spec.name          = 'capdrupal'
-  spec.version       = '3.0.2'
+  spec.version       = '3.0.4'
   spec.authors       = ['Kevin Wenger', 'Yann Lugrin', 'Gilles Doge', 'Toni Fisler', 'Simon Perdrisat', 'Robert Wohleb', 'Kim Pepper']
   spec.email         = ['hello@antistatique.net']
 

data/lib/capdrupal.rb

@@ -7,6 +7,27 @@ namespace :load do
     set :keep_backups, 5
     set :enable_modules, []
     set :disable_modules, []
+    set :security, {
+      # Path of files to be removed from the release path.
+      obscurity: [
+       "#{fetch(:app_path)}/core/install.php",
+       "#{fetch(:app_path)}/install.php",
+       "#{fetch(:app_path)}/update.php",
+       "#{fetch(:app_path)}/core/COPYRIGHT.txt",
+       "#{fetch(:app_path)}/core/CHANGELOG.txt",
+       "#{fetch(:app_path)}/core/INSTALL.mysql.txt",
+       "#{fetch(:app_path)}/core/INSTALL.pgsql.txt",
+       "#{fetch(:app_path)}/core/INSTALL.sqlite.txt",
+       "#{fetch(:app_path)}/core/MAINTAINERS.txt",
+       "#{fetch(:app_path)}/core/LICENSE.txt",
+       "#{fetch(:app_path)}/core/INSTALL.txt",
+       "#{fetch(:app_path)}/core/UPDATE.txt",
+       "#{fetch(:app_path)}/core/USAGE.txt",
+       "#{fetch(:app_path)}/CHANGELOG.txt",
+       "#{fetch(:app_path)}/INSTALL.txt",
+       "#{fetch(:app_path)}/example.gitignore",
+     ]
+    }
   end
 end
 
@@ -249,8 +270,42 @@ namespace :drupal do
         within shared_path do
           # Remove execution for files, keep execution on folder.
           # "web/sites/defaults/files" is a shared dir and should be writable.
-          execute :find, './', '-type f ! -perm 664 -exec chmod 664 {} \;'
-          execute :find, './', '-type d ! -perm 2775 -exec chmod 2775 {} \;'
+          execute :find, "#{fetch(:app_path)}/sites/#{fetch(:site_path)}/files", '-type f ! -perm 664 -exec chmod 664 {} \;'
+          execute :find, "#{fetch(:app_path)}/sites/#{fetch(:site_path)}/files", '-type d ! -perm 2775 -exec chmod 2775 {} \;'
+        end
+      end
+    end
+  end
+
+  namespace :security do
+
+    desc 'Security by Obscurity'
+    namespace :obscurity do
+
+      desc 'Obfuscate Drupal sensitive files by deletion'
+      task :files do
+        on roles(:app) do
+          within release_path do
+            fetch(:security)[:obscurity].each do |file|
+              execute :rm, file, '-f'
+            end
+          end
+        end
+      end
+
+      desc 'Obfuscate Drupal sensitive files by htaccess'
+      task :htaccess do
+        on roles(:app) do
+          htaccessFile = release_path.join(fetch(:app_path)).join('.htaccess')
+
+          [
+            '## added during deploy',
+            '## Obfuscate Drupal sensitive files by denying access',
+            '<FilesMatch "(^API|CHANGELOG|COPYRIGHT|INSTALL|LICENSE|PATCHES|MAINTAINERS|README|TODO|UPGRADE|UPDATE|CHANGES|install|update|authorize).*\.(md|txt|php)$">',
+            '  Order deny,allow',
+            '  Deny from all',
+            '</FilesMatch>'
+          ].each { |line| execute "echo '#{line}' >> #{htaccessFile}" }
         end
       end
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: capdrupal
 version: !ruby/object:Gem::Version
-  version: 3.0.2
+  version: 3.0.4
 platform: ruby
 authors:
 - Kevin Wenger
@@ -11,10 +11,10 @@ authors:
 - Simon Perdrisat
 - Robert Wohleb
 - Kim Pepper
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-12-22 00:00:00.000000000 Z
+date: 2023-04-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: capistrano
@@ -95,7 +95,7 @@ homepage: http://github.com/antistatique/capdrupal/
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -110,8 +110,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.6
-signing_key: 
+rubygems_version: 3.1.2
+signing_key:
 specification_version: 4
 summary: A set of tasks for deploying and managing Drupal projects with Capistrano
 test_files: []