179a0703f8
- Create Billet entity: name, position, priceHT, quantity (nullable=unlimited), isGeneratedBillet, hasDefinedExit, notBuyable, type (billet/reservation_brocante/vote), stripeProductId, description, picture (VichUploader), category (ManyToOne CASCADE) - Create BilletDesign entity (OneToOne Event): accentColor, invitationTitle, invitationColor - Billet CRUD: add/edit/delete with access control, Stripe product sync on connected account - Billet reorder: drag & drop with position field, refactored sortable.js for both categories and billets - Ticket designer tab (custom offer only): accent color, invitation title/color, live iframe preview - A4 ticket preview: 4 zones (HG infos+billet, HD affiche, BG association, BD sortie+invitation), fake QR code SVG - Commission calculator JS: live breakdown of E-Ticket fee, Stripe fee (1.5%+0.25EUR), net amount - Sales recap on categories tab: qty sold, total HT, total commissions, total net - DisableProfilerSubscriber: disable web profiler toolbar on preview iframe - CSP: allow self in frame-src and frame-ancestors for preview iframe - Flysystem: dedicated billets.storage for billet images - Upload accept restricted to png/jpeg/webp/gif (no HEIC) - Makefile: add force_sql_dev command - CLAUDE.md: add rule to never modify existing migrations - Consolidate all migrations into single Version20260321111125 - Tests: BilletTest (20), BilletDesignTest (6), DisableProfilerSubscriberTest (5), billet-designer.test.js (7), commission-calculator.test.js (7), AccountControllerTest billet CRUD tests (11) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
95 lines
2.9 KiB
YAML
95 lines
2.9 KiB
YAML
nelmio_security:
|
|
|
|
clickjacking:
|
|
paths:
|
|
'^/.*': DENY
|
|
|
|
content_type:
|
|
nosniff: true
|
|
|
|
referrer_policy:
|
|
enabled: true
|
|
policies:
|
|
- 'no-referrer'
|
|
- 'strict-origin-when-cross-origin'
|
|
|
|
csp:
|
|
enforce:
|
|
level1_fallback: false
|
|
browser_adaptive:
|
|
enabled: false
|
|
report-uri: '%router.request_context.base_url%/my-csp-report'
|
|
frame-ancestors:
|
|
- 'self'
|
|
frame-src:
|
|
- 'self'
|
|
- 'https://stripe.com'
|
|
- 'https://*.stripe.com'
|
|
- 'https://js.stripe.com'
|
|
- 'https://cloudflare.com'
|
|
- 'https://*.cloudflareinsights.com'
|
|
- 'https://challenges.cloudflare.com'
|
|
script-src:
|
|
- 'self'
|
|
- 'https://static.cloudflareinsights.com'
|
|
- 'https://challenges.cloudflare.com'
|
|
- 'https://cdn.jsdelivr.net'
|
|
- 'unsafe-inline'
|
|
style-src:
|
|
- 'self'
|
|
- 'https://fonts.googleapis.com'
|
|
- 'https://cdnjs.cloudflare.com'
|
|
- 'https://cdn.jsdelivr.net'
|
|
- 'unsafe-inline'
|
|
img-src:
|
|
- 'self'
|
|
- 'data:'
|
|
- 'https://*.tile.openstreetmap.org'
|
|
- 'https://*.basemaps.cartocdn.com'
|
|
- 'https://cdn.jsdelivr.net'
|
|
worker-src:
|
|
- 'self'
|
|
- 'blob:'
|
|
connect-src:
|
|
- 'self'
|
|
- 'https://cloudflareinsights.com'
|
|
- 'https://static.cloudflareinsights.com'
|
|
- 'https://tools-security.esy-web.dev'
|
|
- 'https://challenges.cloudflare.com'
|
|
- 'https://nominatim.openstreetmap.org'
|
|
- 'https://cdn.jsdelivr.net'
|
|
font-src:
|
|
- 'self'
|
|
- 'https://cdnjs.cloudflare.com'
|
|
- 'https://fonts.googleapis.com'
|
|
- 'https://fonts.gstatic.com'
|
|
object-src:
|
|
- 'none'
|
|
form-action:
|
|
- 'self'
|
|
- 'https://auth.esy-web.dev'
|
|
block-all-mixed-content: true
|
|
|
|
permissions_policy:
|
|
enabled: true
|
|
policies:
|
|
payment: ['self']
|
|
camera: ['self']
|
|
microphone: []
|
|
geolocation: ['self']
|
|
|
|
external_redirects:
|
|
override: /external-redirect
|
|
forward_as: redirUrl
|
|
log: true
|
|
allow_list:
|
|
- cloudflareinsights.com
|
|
- static.cloudflareinsights.com
|
|
- stripe.com
|
|
- connect.stripe.com
|
|
- checkout.stripe.com
|
|
- hooks.stripe.com
|
|
- dashboard.stripe.com
|
|
- auth.esy-web.dev
|
|
- challenges.cloudflare.com
|