underpost 3.1.3 → 3.2.2

package/src/runtime/lampp/Dockerfile

@@ -20,8 +20,8 @@ RUN dnf -y update && \
     perl && \
     dnf clean all
 
-# --- Download and install XAMPP
-RUN curl -L -o /tmp/xampp-linux-installer.run "https://sourceforge.net/projects/xampp/files/XAMPP%20Linux/7.4.33/xampp-linux-x64-7.4.33-0-installer.run" && \
+# --- Download and install XAMPP (PHP 8.2)
+RUN curl -L -o /tmp/xampp-linux-installer.run "https://sourceforge.net/projects/xampp/files/XAMPP%20Linux/8.2.12/xampp-linux-x64-8.2.12-0-installer.run" && \
     chmod +x /tmp/xampp-linux-installer.run && \
     bash -c "/tmp/xampp-linux-installer.run --mode unattended" && \
     ln -sf /opt/lampp/lampp /usr/bin/lampp
@@ -31,6 +31,13 @@ RUN mkdir -p /opt/lampp/htdocs && \
     chown -R root:root /opt/lampp/htdocs && \
     chmod -R a+rX /opt/lampp/htdocs
 
+# Add XAMPP binaries and /usr/local/bin to PATH for all shells
+ENV PATH="/opt/lampp/bin:/usr/local/bin:${PATH}"
+RUN echo 'export PATH="/opt/lampp/bin:/usr/local/bin:${PATH}"' > /etc/profile.d/lampp.sh
+
+# Provide a no-op sendmail so PHP plugins don't error on mail calls
+RUN printf '#!/bin/sh\ncat > /dev/null\n' > /usr/sbin/sendmail && chmod +x /usr/sbin/sendmail
+
 # Install Node.js
 RUN curl -fsSL https://rpm.nodesource.com/setup_24.x | bash -
 RUN dnf install nodejs -y
@@ -40,6 +47,10 @@ RUN dnf clean all
 RUN node --version
 RUN npm --version
 
+# Create non-root user for secure container execution (cron jobs, init containers)
+# Deployment containers override to root via securityContext when npm install -g is needed
+RUN useradd -m -u 1000 -s /bin/bash dd
+
 # Set working directory
 WORKDIR /home/dd
 

package/src/runtime/lampp/Lampp.js

@@ -169,9 +169,9 @@ class LamppService {
       shellCd(`./engine-private/setup`);
 
       if (!process.argv.includes(`server`)) {
-        // Download and run the XAMPP installer
+        // Download and run the XAMPP installer (PHP 8.2)
         shellExec(
-          `curl -Lo xampp-linux-installer.run https://sourceforge.net/projects/xampp/files/XAMPP%20Linux/7.4.30/xampp-linux-x64-7.4.30-1-installer.run?from_af=true`,
+          `curl -Lo xampp-linux-installer.run https://sourceforge.net/projects/xampp/files/XAMPP%20Linux/8.2.12/xampp-linux-x64-8.2.12-0-installer.run`,
         );
         shellExec(`sudo chmod +x xampp-linux-installer.run`);
         shellExec(
@@ -237,14 +237,37 @@ Listen ${port}
 
 <VirtualHost *:${port}>
   DocumentRoot "${documentRoot}"
-  ServerName ${host}:${port}
+  ServerName ${host}
+  UseCanonicalName Off
+  ServerSignature Off
 
   <Directory "${documentRoot}">
-    Options Indexes FollowSymLinks MultiViews
+    Options FollowSymLinks MultiViews
     AllowOverride All
     Require all granted
   </Directory>
 
+  # Block access to .git directories and files
+  RedirectMatch 404 /\\.git
+
+  # Block access to hidden dotfiles (.env, .htpasswd, etc.)
+  <FilesMatch "^\\.(env|htpasswd|htaccess\\.bak|DS_Store)">
+    Require all denied
+  </FilesMatch>
+
+  # Block access to sensitive engine files
+  <FilesMatch "(wp-config\\.php\\.bak|wp-config-sample\\.php|\\.sql|\\.sql\\.gz)$">
+    Require all denied
+  </FilesMatch>
+
+  # Security headers
+  <IfModule mod_headers.c>
+    Header always set X-Content-Type-Options "nosniff"
+    Header always set X-Frame-Options "SAMEORIGIN"
+    Header always set Referrer-Policy "strict-origin-when-cross-origin"
+    Header always unset X-Powered-By
+  </IfModule>
+
   ${
     redirect
       ? `

package/src/runtime/wp/Dockerfile

@@ -0,0 +1,68 @@
+FROM rockylinux:9
+
+# Update and install required packages
+RUN dnf -y update && \
+    dnf -y install epel-release && \
+    dnf -y install --allowerasing \
+    bzip2 \
+    sudo \
+    curl \
+    unzip \
+    net-tools \
+    openssh-server \
+    nano \
+    vim-enhanced \
+    less \
+    openssl-devel \
+    wget \
+    git \
+    gnupg2 \
+    libnsl \
+    perl && \
+    dnf clean all
+
+# --- Download and install XAMPP (PHP 8.2)
+RUN curl -L -o /tmp/xampp-linux-installer.run "https://sourceforge.net/projects/xampp/files/XAMPP%20Linux/8.2.12/xampp-linux-x64-8.2.12-0-installer.run" && \
+    chmod +x /tmp/xampp-linux-installer.run && \
+    bash -c "/tmp/xampp-linux-installer.run --mode unattended" && \
+    ln -sf /opt/lampp/lampp /usr/bin/lampp
+
+# --- Create /xampp/htdocs (static root) and set permissions
+RUN mkdir -p /opt/lampp/htdocs && \
+    chown -R root:root /opt/lampp/htdocs && \
+    chmod -R a+rX /opt/lampp/htdocs
+
+# Add XAMPP binaries and /usr/local/bin to PATH for all shells
+ENV PATH="/opt/lampp/bin:/usr/local/bin:${PATH}"
+RUN echo 'export PATH="/opt/lampp/bin:/usr/local/bin:${PATH}"' > /etc/profile.d/lampp.sh
+
+# Provide a no-op sendmail so WP plugins don't error on mail calls
+RUN printf '#!/bin/sh\ncat > /dev/null\n' > /usr/sbin/sendmail && chmod +x /usr/sbin/sendmail
+
+# Install WP-CLI
+RUN curl -sL https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar -o /usr/local/bin/wp && \
+    chmod +x /usr/local/bin/wp && \
+    wp --info --allow-root
+
+# Install Node.js
+RUN curl -fsSL https://rpm.nodesource.com/setup_24.x | bash -
+RUN dnf install nodejs -y
+RUN dnf clean all
+
+# Verify Node.js and npm versions
+RUN node --version
+RUN npm --version
+
+# Create non-root user for secure container execution (cron jobs, init containers)
+# Deployment containers override to root via securityContext when npm install -g is needed
+RUN useradd -m -u 1000 -s /bin/bash dd
+
+# Set working directory
+WORKDIR /home/dd
+
+EXPOSE 22
+EXPOSE 80
+EXPOSE 443
+EXPOSE 3000-3100
+EXPOSE 4000-4100
+