Legacy PHP & Laravel Maintenance and Server Hardening

<?php
/**
 * Hardened Database Access & Secure Token Verification
 * Patched to enforce parameterized bindings and cryptographic token verification.
 */

// 1. Parameterized PDO prepared statement
$userId = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT);
if ($userId === false) {
    throw new InvalidArgumentException("Invalid target identifier.");
}

$stmt = $pdo->prepare("SELECT username, role FROM users WHERE id = :id LIMIT 1");
$stmt->execute(['id' => $userId]);
$user = $stmt->fetch();

// 2. Cryptographically signed JSON session payload (replacing unsafe unserialize)
if (isset($_COOKIE['session'])) {
    $rawCookie = $_COOKIE['session'];
    $parts = explode('.', $rawCookie);
    
    if (count($parts) === 2) {
        [$payloadBase64, $signature] = $parts;
        $secret = $_ENV['APP_KEY'] ?? 'secure-secret-key-32-chars-long';
        
        // Verify HMAC signature to prevent parameter tampering & object injection
        $expectedSignature = hash_hmac('sha256', $payloadBase64, $secret);
        if (hash_equals($expectedSignature, $signature)) {
            $session = json_decode(base64_decode($payloadBase64), true);
            $role = $session['role'] ?? 'guest';
        }
    }
}

// 3. XSS Protection: HTML entity-escaped output
if ($user) {
    $safeName = htmlspecialchars($user['username'], ENT_QUOTES, 'UTF-8');
    echo "<h1>Welcome back, " . $safeName . "</h1>";
}

# Hardened Nginx Configuration by Codepunker
server {
    listen 443 ssl http2;
    server_name example.com;
    root /var/www/html;

    # 1. SSL/TLS Hardening
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;

    # 2. Strict Security Headers
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # 3. Information Disclosure Prevention
    server_tokens off;

    # 4. Limit Request Sizes to mitigate DDoS/buffer exploits
    client_max_body_size 10M;
    client_body_buffer_size 128k;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    # Secure PHP FastCGI execution
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/var/run/php/php-hardened.sock;
        fastcgi_hide_header X-Powered-By; # Hide PHP version
    }
}

// Hotpatched by Codepunker to block CVE-2021-3129 RCE
namespace Facade\Ignition\Http\Controllers;

use Facade\Ignition\Http\Requests\ExecuteSolutionRequest;
use Illuminate\Foundation\Validation\ValidatesRequests;
use Symfony\Component\HttpKernel\Exception\HttpException;

class ExecuteSolutionController
{
    use ValidatesRequests;

    public function __invoke(ExecuteSolutionRequest $request)
    {
        $solution = $request->getRunnableSolution();
        
        // 1. Audit parameters for safety
        $parameters = $request->get('parameters', []);
        
        // Block known phar:// deserialization attack vectors
        foreach ($parameters as $key => $value) {
            if (is_string($value) && stripos($value, 'phar://') !== false) {
                error_log("Block CVE-2021-3129 exploit attempt: " . $value);
                throw new HttpException(403, "Exploit attempt blocked by Codepunker Hotpatch.");
            }
        }
        
        // 2. Extra validation on environment (never allow arbitrary solution execute in production)
        if (config('app.env') === 'production') {
            throw new HttpException(403, "Ignition solutions disabled in production.");
        }

        $solution->run($parameters);

        return response('');
    }
}