Feature/drupal 10

.docker/vhost.conf

@@ -35,8 +35,7 @@ server {
  }
 
  # Block access to "hidden" files and directories whose names begin with a
- # period. This includes directories used by version control systems such
- # as Subversion or Git to store control files.
+ # period.
  location ~ (^|/)\. {
  return 403;
  }
@@ -46,7 +45,7 @@ server {
  }
 
  location @rewrite {
- rewrite ^/(.*)$ /index.php?q=$1;
+ rewrite ^ /index.php;
  }
 
  # Don't allow direct access to PHP files in the vendor directory.
@@ -55,13 +54,23 @@ server {
  return 404;
  }
 
+ # Protect files and directories from prying eyes.
+ location ~* \.(engine|inc|install|make|module|profile|po|sh|.*sql|.tar|.gz|.bz2|theme|twig|tpl(\.php)?|xtmpl|yml)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template|composer\.(json|lock)|web\.config)$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig|\.save)$ {
+ deny all;
+ return 404;
+ }
+
  location ~ '\.php$|^/update.php' {
+ include fastcgi_params;
+
  fastcgi_buffers 16 32k;
  fastcgi_buffer_size 64k;
  fastcgi_busy_buffers_size 64k;
 
  fastcgi_split_path_info ^(.+?\.php)(|/.*)$;
- include fastcgi_params;
+
+ # Ensure the php file exists. Mitigates CVE-2019-11043
+ try_files $fastcgi_script_name =404;
 
  fastcgi_param HTTP_PROXY "";
  fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
@@ -72,30 +81,12 @@ server {
  fastcgi_pass phpfpm:9000;
  }
 
- location ~ ^/sites/.*/files/styles/ {
- try_files $uri @rewrite;
- }
-
- # Handle private files through Drupal. Private file's path can come
- # with a language prefix.
- location ~ ^(/[a-z\-]+)?/system/files/ {
- try_files $uri /index.php?$query_string;
- }
-
- location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
- try_files $uri @rewrite;
- expires max;
- log_not_found off;
- }
-
  # Enforce clean URLs
- # Removes index.php from urls like:
- # www.example.com/index.php/my-page --> www.example.com/my-page
  #
+ # Removes index.php from urls like www.example.com/index.php/my-page --> www.example.com/my-page
  # Could be done with 301 for permanent or other redirect codes.
- absolute_redirect off;
  if ($request_uri ~* "^(.*/)index\.php/(.*)") {
- return 301 /$2;
+ return 307 $1$2;
  }
 
  error_log /dev/stderr;

composer.json

@@ -79,13 +79,32 @@
  "reference": "3.0.3"
  }
  }
+ },
+ "deskpro/deskpro-api-client-php": {
+ "type": "package",
+ "package": {
+ "name": "deskpro/deskpro-api-client-php",
+ "version": "4.1.0",
+ "type": "library",
+ "source": {
+ "url": "https://github.com/itk-dev/deskpro-api-client-php.git",
+ "type": "git",
+ "reference": "hotfix/change-psr-log-dependency"
+ },
+ "autoload": {
+ "psr-0": {
+ "Deskpro\\": "src/"
+ }
+ }
+ }
  }
  },
  "require": {
  "php": "^8.1.0",
  "bower-asset/jquery-simple-color": "^1.2",
  "bower-asset/jqueryui-touch-punch": "dev-gh-pages",
  "bower-asset/spectrum": "^1.8",
+ "chx/drupal-issue-fork": "dev-main",
  "composer/installers": "^1.7",
  "cure53/dompurify": "^3.0",
  "cweagans/composer-patches": "^1.7",
@@ -96,10 +115,11 @@
  "drupal/color_field": "^3.0",
  "drupal/config_ignore": "^2.2",
  "drupal/config_import_locale": "^2.0",
- "drupal/core-composer-scaffold": "^9.3",
- "drupal/core-project-message": "^9.3",
- "drupal/core-recommended": "^9.3",
- "drupal/csv_serialization": "^2.0 || ^3.0",
+ "drupal/core": "^10.0",
+ "drupal/core-composer-scaffold": "^10.0",
+ "drupal/core-project-message": "^10.0",
+ "drupal/core-recommended": "^10.0",
+ "drupal/csv_serialization": "^4.0",
  "drupal/ds": "^3.1",
  "drupal/editor_advanced_link": "^2.2",
  "drupal/email_registration": "^1.0@RC",
@@ -108,8 +128,8 @@
  "drupal/entityqueue": "^1.0@alpha",
  "drupal/field_group": "^3.0",
  "drupal/flag": "^4.0@alpha",
- "drupal/hoeringsportal_citizen_proposal": "1.0-dev",
- "drupal/hoeringsportal_citizen_proposal_archiving": "1.0-dev",
+ "drupal/hoeringsportal_citizen_proposal": "^1.0",
+ "drupal/hoeringsportal_citizen_proposal_archiving": "^1.0",
  "drupal/hoeringsportal_data": "^1.0",
  "drupal/hoeringsportal_deskpro": "^1.0",
  "drupal/hoeringsportal_openid_connect": "^1.0",
@@ -124,21 +144,19 @@
  "drupal/quick_node_clone": "^1.12",
  "drupal/redirect": "^1.6",
  "drupal/search_autocomplete": "^3.0",
- "drupal/system_status": "^2.8",
  "drupal/toolbar_visibility": "^2.1",
  "drupal/twig_tweak": "^3.2",
  "drupal/view_custom_table": "^2.0",
  "drupal/views_data_export": "^1.3",
  "drupal/viewsreference": "^2.0@beta",
  "drupal/webform": "^6.2@beta",
- "drupal/webprofiler": "^9.0",
  "drupal/xls_serialization": "^1.2",
  "drush/drush": "^11",
  "itk-dev/composer-virtualenv": "^1.0",
  "itk-dev/itk_azure_video": "^2.0",
  "itk-dev/itk_pretix": "^1.0",
  "itk-dev/itk_siteimprove": "^1.2",
- "itk-dev/serviceplatformen": "^1.4",
+ "itk-dev/serviceplatformen": "^1.5",
  "itk-dev/web_accessibility_statement": "^1.0",
  "onelogin/php-saml": "^4.0",
  "oomphinc/composer-installers-extender": "^2.0",
@@ -147,13 +165,12 @@
  "webmozart/path-util": "^2.3"
  },
  "require-dev": {
- "drupal/content_fixtures": "^3.1",
- "drupal/core-dev": "^9.3",
- "drupal/masquerade": "^2.0",
- "drupal/upgrade_status": "^3.13",
- "mglaman/phpstan-drupal": "^1.1",
- "phpstan/extension-installer": "^1.2",
- "phpstan/phpstan-deprecation-rules": "^1.1"
+ "drupal/content_fixtures": "^3.1",
+ "drupal/core-dev": "^10.0",
+ "drupal/masquerade": "^2.0",
+ "mglaman/phpstan-drupal": "^1.1",
+ "phpstan/extension-installer": "^1.2",
+ "phpstan/phpstan-deprecation-rules": "^1.1"
  },
  "conflict": {
  "drupal/drupal": "*"
@@ -170,7 +187,8 @@
  "drupal/core-project-message": true,
  "dealerdirect/phpcodesniffer-composer-installer": true,
  "oomphinc/composer-installers-extender": true,
- "phpstan/extension-installer": true
+ "phpstan/extension-installer": true,
+ "chx/drupal-issue-fork": true
  }
  },
  "scripts": {
@@ -240,9 +258,6 @@
  "composer-exit-on-patch-failure": true,
  "enable-patching": true,
  "patches": {
- "deskpro/deskpro-api-client-php": {
- "Add typehinting to APIResponse to avoid drupal warnings in log": "patches/deskpro/deskpro-api-client-php/addTypeHinting.patch"
- },
  "drupal/better_exposed_filters": {
  "Add option to hide exposed filter field labels (https://www.drupal.org/project/better_exposed_filters/issues/3282228)": "https://www.drupal.org/files/issues/2022-09-08/bef-visually_hidden.3282228.8.patch",
  "Add option to hide exposed sort field labels (based on “Add option to hide exposed filter field labels”)": "patches/drupal/better_exposed_filters/visually-hidden-label-on-sort.patch"