forge-joniko/ldc-tregalette
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge branch 'develop' into trunk

Browse source
This commit is contained in:
Noah Lancien 2026-03-24 16:02:43 +01:00
commit cae45aa7c8
9 changed files with 364 additions and 82 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
.env.example
View file

@ -61,6 +61,8 @@ GOOGLE_RECAPTCHA_PUBLIC=
GOOGLE_RECAPTCHA_PRIVATE=
GOOGLE_RECAPTCHA_VERSION=
# ADMIN SECURE
# - API KEY
LDC_WEB_API_KEY=""
# UWIL ADMIN SECURE
# - LIST SEPARATED WITH ',' (Required)
UWIL_ADMIN_SECURE_CIDR_LIST=""
# - LIST SEPARATED WITH ',' (Optional)
UWIL_ADMIN_SECURE_CIDR_PROJECT_ALLOWED_LIST=""

1
app/Http/Kernel.php
View file

@ -67,5 +67,6 @@ class Kernel extends HttpKernel
'htmlsanitize' => \App\Http\Middleware\HtmlSanitizer::class,
'crm_questions' => \App\Http\Middleware\CrmMiddlewareQuestions::class,
'json_only' => \App\Http\Middleware\JsonOnly::class,
'admin-secure' => \App\Http\Middleware\AdminSecureMiddleware::class,
];
}

49
app/Http/Middleware/AdminSecureMiddleware.php Normal file
View file

@ -0,0 +1,49 @@
<?php
namespace App\Http\Middleware;
use App\Lib\AdminSecure;
use Closure;
use Dxw\CIDR\IP;
use Illuminate\Http\Request;
class AdminSecureMiddleware
{
/**
* Handle an incoming request.
*
* @param \Illuminate\Http\Request $request
* @param \Closure $next
* @return mixed
*/
public function handle(Request $request, Closure $next)
{
if (config('app.env') === 'local') {
return $next($request);
}
$client_ip = AdminSecure::fetchClientIp();
$ip_is_allowed = \collect(AdminSecure::getOptions()->getCidrList())
->reduce(function ($initial, $ip_range) use ($client_ip) {
return $initial || IP::contains(
$ip_range,
$client_ip
)->unwrap();
});
$ip_is_allowed_by_config = \collect(AdminSecure::getOptions()->getCidrAllowedList())
->reduce(function ($initial, $ip_range) use ($client_ip) {
return $initial || IP::contains(
$ip_range,
$client_ip
)->unwrap();
});
if ($ip_is_allowed or $ip_is_allowed_by_config or AdminSecure::ipIsPrivate($client_ip)) {
return $next($request);
}
abort(403, \trans('Denied IP'));
}
}

131
app/Lib/AdminSecure.php Normal file
View file

@ -0,0 +1,131 @@
<?php
namespace App\Lib;
use App\Lib\Options;
use Dxw\CIDR\IPAddress;
use Dxw\CIDR\IPv4Address;
use Dxw\CIDR\IPv4Range;
use Dxw\CIDR\IPv6Address;
use Dxw\CIDR\IPv6Range;
abstract class AdminSecure
{
/**
* Private ipV4 CIDR list
*
* @var array
*/
private static $private_ip_v4_cidr_list = [
'10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16'
];
/**
* Private ipV4 CIDR loopback
*
* @var string
*/
private static $private_ip_v4_loopback_cidr = '127.0.0.0/8';
/**
* Private ipV6 CIDR list
*
* @var array
*/
private static $private_ip_v6_cidr_list = [
'fd00::/8'
];
/**
* Private ipV6 CIDR loopback
*
* @var string
*/
private static $private_ip_v6_loopback_cidr = '::1/128';
/**
* Private options
*
* @var \App\Lib\Options|null
*/
private static $options = null;
/**
* Check if ip is private
*
* @param \Dxw\CIDR\IPv4Address|\Dxw\CIDR\IPv6Address $ip_address
* @return boolean
*/
public static function ipIsPrivate($ip_address): bool
{
return \get_class($ip_address) === IPv4Address::class ?
self::ipV4IsPrivate($ip_address) : self::ipV6IsPrivate($ip_address);
}
/**
* Fetch client IP
*
* @return \Dxw\CIDR\IPv4Address|\Dxw\CIDR\IPv6Address
* @throws \Uwil\AdminSecure\Laravel\Exceptions\AdminSecureException If the ip is invalid.
*/
public static function fetchClientIp()
{
// ! REVERSE PROXY HACK.
$ip = request()->server('HTTP_X_FORWARDED_FOR') ?? request()->getClientIp();
$ip = IPAddress::Make($ip);
if ($ip->isErr()) {
throw new \Exception(\trans('Client IP not valid ') . $ip->getErr());
}
return $ip->unwrap();
}
/**
* Check if ipV4 is private
*
* @param \Dxw\CIDR\IPv4Address $ipv4_address
* @return boolean
*/
private static function ipV4IsPrivate(IPv4Address $ipv4_address): bool
{
return \collect(self::$private_ip_v4_cidr_list)
->concat([self::$private_ip_v4_loopback_cidr])
->map(function (string $ipv4_cidr) {
return IPv4Range::Make($ipv4_cidr)->unwrap();
})
->reduce(function ($initial, IPv4Range $ipv4_range) use ($ipv4_address) {
return $initial || $ipv4_range->containsAddress($ipv4_address);
});
}
/**
* Check if ipV6 is private
*
* @param \Dxw\CIDR\IPv6Address $ipv6_address
* @return boolean
*/
private static function ipV6IsPrivate(IPv6Address $ipv6_address): bool
{
return \collect(self::$private_ip_v6_cidr_list)
->concat([self::$private_ip_v6_loopback_cidr])
->map(function (string $ipv6_cidr) {
return IPv6Range::Make($ipv6_cidr)->unwrap();
})
->reduce(function ($initial, IPv6Range $ipv6_range) use ($ipv6_address) {
return $initial || $ipv6_range->containsAddress($ipv6_address);
});
}
/**
* Get Admin secure options
*
* @return \App\Lib\Options
*/
public static function getOptions(): Options
{
if (!self::$options) {
self::$options = new Options(\config('admin-secure'));
}
return self::$options;
}
}

159
app/Lib/Options.php Normal file
View file

@ -0,0 +1,159 @@
<?php
declare(strict_types=1);
namespace App\Lib;
use Dxw\CIDR\IPv4Range;
use Dxw\CIDR\IPv6Range;
use Illuminate\Support\Facades\Cache;
use Symfony\Component\OptionsResolver\OptionsResolver;
/**
* Configuration
*/
final class Options
{
/**
* @var array<string, mixed> The configuration options
*/
private $options;
/**
* @var \Symfony\Component\OptionsResolver\OptionsResolver The options resolver
*/
private $resolver;
/**
* The cache key where to store config cidr list.
*
* @var string
*/
private static $cache_config_key = 'uwil_ip_cidr_config_list';
/**
* Class constructor.
*
* @param array<string, mixed> $options The configuration options.
*/
public function __construct(array $options = [])
{
$this->resolver = new OptionsResolver();
$this->configureOptions($this->resolver);
$this->options = $this->resolver->resolve($options);
}
/**
* Get cidr list
*
* @return array<\Dxw\CIDR\IPv4Range|\Dxw\CIDR\IPv6Range>
*/
public function getCidrList(): array
{
return $this->options['cidrList'];
}
/**
* Get cidr project allowed list
*
* @return array<\Dxw\CIDR\IPv4Range|\Dxw\CIDR\IPv6Range>
*/
public function getCidrAllowedList(): array
{
return $this->options['cidrProjectAllowedList'];
}
/**
* Configures the options of the client.
*
* @param \Symfony\Component\OptionsResolver\OptionsResolver $resolver The resolver for the options.
* @return void
*/
private function configureOptions(OptionsResolver $resolver): void
{
$resolver->setDefaults([
'cidrList' => [],
'cidrProjectAllowedList' => []
]);
$resolver->setNormalizer('cidrList', \Closure::fromCallable([$this, 'normalizeCidrList']));
$resolver->setNormalizer('cidrProjectAllowedList', \Closure::fromCallable([$this, 'normalizeCidrProjectList']));
}
/**
* Normalise Cidr list for cidrList option
*
* @param \Symfony\Component\OptionsResolver\Options $options
* @param string|null $value
* @return array
* @phpcs:disable Generic.CodeAnalysis.UnusedFunctionParameter.FoundBeforeLastUsed
*/
private function normalizeCidrList(
\Symfony\Component\OptionsResolver\Options $options,
?string $value
): array {
// phpcs:enable
return $this->doNormalizeCidrList($value, 'cidrList');
}
/**
* Normalise Cidr list for cidrProjectAllowedList option
*
* @param \Symfony\Component\OptionsResolver\Options $options
* @param string|null $value
* @return array
* @phpcs:disable Generic.CodeAnalysis.UnusedFunctionParameter.FoundBeforeLastUsed
*/
private function normalizeCidrProjectList(
\Symfony\Component\OptionsResolver\Options $options,
?string $value
): array {
// phpcs:enable
return $this->doNormalizeCidrList($value, 'cidrProjectAllowedList');
}
/**
* Normalize CIDR list with specific cache key.
*
* @param string|null $value
* @param string $optionName
* @return array<\Dxw\CIDR\IPv4Range|\Dxw\CIDR\IPv6Range>
*/
private function doNormalizeCidrList(?string $value, string $optionName): array
{
$cacheConfigKey = self::$cache_config_key . '_' . $optionName;
$allowed_cidr_config_list = collect(explode(',', strval($value)))->filter();
$allowed_cidr_config_list_hash = \md5($allowed_cidr_config_list->implode(','));
$allowed_cidr_list = [];
// Flush cache if config hash changed
if ($allowed_cidr_config_list_hash !== \collect(Cache::get($cacheConfigKey))->get('hash')) {
Cache::forget($cacheConfigKey);
/** @var array<\Dxw\CIDR\IPv4Range|\Dxw\CIDR\IPv6Range> $allowed_cidr_list */
$allowed_cidr_list = $allowed_cidr_config_list
->map(function (string $cidr) {
$ip_range = !IPv4Range::Make($cidr)->isErr() ? IPv4Range::Make($cidr) : IPv6Range::Make($cidr);
if ($ip_range->isErr()) {
throw new \Exception(\trans(
'CIDR LIST not valid (ipv4 or ipv6 cidr) :cidr',
[
'cidr' => $cidr
]
));
}
return $ip_range->unwrap();
})->all();
}
/** @var array<\Dxw\CIDR\IPv4Range|\Dxw\CIDR\IPv6Range> $allowed_cidr_list */
return \collect(Cache::rememberForever($cacheConfigKey, function() use ($allowed_cidr_list, $allowed_cidr_config_list_hash) {
return [
'list' => $allowed_cidr_list,
'hash' => $allowed_cidr_config_list_hash
];
}))->get('list');
}
}

2
composer.json
View file

@ -7,6 +7,7 @@
"php": "^8.2",
"axlon/laravel-postal-code-validation": "^3.4",
"diglactic/laravel-breadcrumbs": "^8.0",
"dxw/cidr": "^3.2",
"guzzlehttp/guzzle": "^7.2",
"jenssegers/agent": "^2.6",
"laravel/framework": "^10.0",
@ -14,7 +15,6 @@
"laravel/ui": "^4.2",
"ldc/ldccrmv4client": "^4.0",
"ldc/sitemap-generator": "^2.0",
"ldc/web-admin-secure-laravel": "^2.0",
"mews/purifier": "^3.4",
"propaganistas/laravel-phone": "^5.0",
"sentry/sentry-laravel": "*",

89
composer.lock generated
View file

@ -4,7 +4,7 @@
"Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
"This file is @generated automatically"
],
"content-hash": "a35ca20936b03488df87a0399d659335",
"content-hash": "45214b0580fa4955ba3c2dc5a8c27c5e",
"packages": [
{
"name": "axlon/laravel-postal-code-validation",
@ -2325,73 +2325,6 @@
"Sitemap"
]
},
{
"name": "ldc/web-admin-secure-laravel",
"version": "2.0.3",
"source": {
"type": "git",
"url": "git@lab.s-web.fr:ldc-web/projets/ldc-web-admin-secure-laravel.git",
"reference": "fc648612f0e16ca00c012e5305b28058312d68c0"
},
"dist": {
"type": "zip",
"url": "https://lab.s-web.fr/api/v4/projects/20/packages/composer/archives/ldc/web-admin-secure-laravel.zip?sha=fc648612f0e16ca00c012e5305b28058312d68c0",
"reference": "fc648612f0e16ca00c012e5305b28058312d68c0",
"shasum": ""
},
"require": {
"dxw/cidr": "^3.1",
"illuminate/support": "~10",
"laravel/framework": "~10",
"php": ">=8.2",
"symfony/options-resolver": "^3.4.43|^4.4.30|^5.0.11|^6.0"
},
"require-dev": {
"larastan/larastan": "^2.6",
"orchestra/testbench": "^8",
"phpunit/php-code-coverage": "^9",
"phpunit/phpunit": "^9",
"slevomat/coding-standard": "^7",
"squizlabs/php_codesniffer": "^3"
},
"type": "library",
"extra": {
"laravel": {
"providers": [
"LDC\\WebAdminSecureLaravel\\AdminSecureServiceProvider"
]
}
},
"autoload": {
"psr-4": {
"LDC\\WebAdminSecureLaravel\\": "src/"
}
},
"autoload-dev": {
"psr-4": {
"LDC\\WebAdminSecureLaravel\\Tests\\": "tests"
}
},
"scripts": {
"test": [
"vendor/bin/phpunit"
],
"post-autoload-dump": [
"@php ./vendor/bin/testbench package:discover --ansi"
]
},
"license": [
"MIT"
],
"authors": [
{
"name": "Vincent BRIDIER",
"email": "vincent.bridier@ldc.fr",
"homepage": "https://www.ldc.fr"
}
],
"description": "Restrict access to LDC Network"
},
{
"name": "league/commonmark",
"version": "2.6.1",
@ -3743,16 +3676,16 @@
},
{
"name": "phpseclib/phpseclib",
"version": "2.0.48",
"version": "2.0.52",
"source": {
"type": "git",
"url": "https://github.com/phpseclib/phpseclib.git",
"reference": "eaa7be704b8b93a6913b69eb7f645a59d7731b61"
"reference": "2552c4001631d1cc844332faea6a08a49c964b28"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/phpseclib/phpseclib/zipball/eaa7be704b8b93a6913b69eb7f645a59d7731b61",
"reference": "eaa7be704b8b93a6913b69eb7f645a59d7731b61",
"url": "https://api.github.com/repos/phpseclib/phpseclib/zipball/2552c4001631d1cc844332faea6a08a49c964b28",
"reference": "2552c4001631d1cc844332faea6a08a49c964b28",
"shasum": ""
},
"require": {
@ -3760,7 +3693,7 @@
},
"require-dev": {
"phing/phing": "~2.7",
"phpunit/phpunit": "^4.8.35|^5.7|^6.0|^9.4",
"phpunit/phpunit": "^4.8.35|^5.7|^6.0|^8.5|^9.4",
"squizlabs/php_codesniffer": "~2.0"
},
"suggest": {
@ -3833,7 +3766,7 @@
],
"support": {
"issues": "https://github.com/phpseclib/phpseclib/issues",
"source": "https://github.com/phpseclib/phpseclib/tree/2.0.48"
"source": "https://github.com/phpseclib/phpseclib/tree/2.0.52"
},
"funding": [
{
@ -3849,7 +3782,7 @@
"type": "tidelift"
}
],
"time": "2024-12-14T21:03:54+00:00"
"time": "2026-03-19T02:54:44+00:00"
},
{
"name": "propaganistas/laravel-phone",
@ -11979,12 +11912,12 @@
],
"aliases": [],
"minimum-stability": "stable",
"stability-flags": {},
"stability-flags": [],
"prefer-stable": true,
"prefer-lowest": false,
"platform": {
"php": "^8.2"
},
"platform-dev": {},
"plugin-api-version": "2.6.0"
"platform-dev": [],
"plugin-api-version": "2.3.0"
}

6
config/admin-secure.php Normal file
View file

@ -0,0 +1,6 @@
<?php
return [
'cidrList' => env('UWIL_ADMIN_SECURE_CIDR_LIST'),
'cidrProjectAllowedList' => env('UWIL_ADMIN_SECURE_CIDR_PROJECT_ALLOWED_LIST')
];

1
manifest.yaml
View file

@ -39,6 +39,7 @@ data:
MAIL_CONTACT_PARTNERSHIP: "${APP_MAIL_CONTACT_PARTNERSHIP}"
MAIL_CONTACT_COMMERCIAL: "${APP_MAIL_CONTACT_COMMERCIAL}"
MAIL_CONTACT_VARIOUS: "${APP_MAIL_CONTACT_VARIOUS}"
UWIL_ADMIN_SECURE_CIDR_LIST: "${APP_GLOBAL_UWIL_ADMIN_SECURE_CIDR_LIST}"
---
apiVersion: v1