Web app switched to non-root SQL account.

passman-dev/db/init/01-create-pwd_mgr-db-withData.sql

@@ -22,6 +22,12 @@ CREATE TABLE IF NOT EXISTS `dummy` (
   `id` int(11) DEFAULT NULL
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 
+-- Create a dedicated DB user for the web application (least privilege).
+-- Grant only the required privileges on the application database.
+CREATE USER IF NOT EXISTS 'passman_app'@'%' IDENTIFIED BY 'passman_app_pw';
+GRANT SELECT, INSERT, UPDATE, DELETE ON pwd_mgr.* TO 'passman_app'@'%';
+FLUSH PRIVILEGES;
+
 CREATE TABLE IF NOT EXISTS `login_users` (
   `id` int(11) NOT NULL AUTO_INCREMENT,
   `username` varchar(20) NOT NULL,
@@ -31,7 +37,7 @@ CREATE TABLE IF NOT EXISTS `login_users` (
 ) ENGINE=InnoDB AUTO_INCREMENT=4 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 
 INSERT INTO `login_users` (`id`, `username`, `password`) VALUES
-	(1, 'u1', 'p1');
+	(1, 'u1', '$2y$10$L18u5/PyVkDgsce/DsUOQu0sKhTzh854Euhog3cVb1W4YAfgRzY8W'); -- php -r 'echo password_hash("p1", PASSWORD_DEFAULT), PHP_EOL;'
 
 CREATE TABLE IF NOT EXISTS `notes` (
   `notesid` int(11) NOT NULL AUTO_INCREMENT,

passman-dev/docker-compose.yml

@@ -8,9 +8,9 @@ services:
       - ./php:/var/www/html
     environment:
       DB_HOST: db
-      DB_USER: root
-      DB_PASS: rootpass
       DB_NAME: pwd_mgr
+      DB_USER: passman_app
+      DB_PASS: passman_app_pw
     depends_on:
       - db
 

passman-dev/php/passman/config.php

@@ -3,8 +3,8 @@
 // NOTE: In Docker, the DB host is the service name (e.g., "db"), not "localhost".
 
 $DB_HOST = getenv('DB_HOST') ?: 'db';
-$DB_USER = getenv('DB_USER') ?: 'root';
+$DB_USER = getenv('DB_USER') ?: 'passman_app';
-$DB_PASS = getenv('DB_PASS') ?: 'rootpass';
+$DB_PASS = getenv('DB_PASS') ?: 'passman_app_pw';
 $DB_NAME = getenv('DB_NAME') ?: 'pwd_mgr';
 
 // Create a DB connection.

passman-dev/php/passman/dashboard.php

@@ -99,16 +99,23 @@ $stmt->close();
 
 
 //echo htmlspecialchars($username);
-echo "<h3>Entries of " . $username . "</h3>";
+$safe_username = htmlspecialchars($username, ENT_QUOTES | ENT_SUBSTITUTE, "UTF-8");
+echo "<h3>Entries of " . $safe_username . "</h3>";
 
 if (!empty($result) && $result->num_rows >= 1) {
 	while ($row = $result -> fetch_assoc()) {
+		// Escape output to prevent stored XSS (DB content must be treated as untrusted).
+		$safe_url  = htmlspecialchars($row["web_url"], ENT_QUOTES | ENT_SUBSTITUTE, "UTF-8");
+		$safe_user = htmlspecialchars($row["web_username"], ENT_QUOTES | ENT_SUBSTITUTE, "UTF-8");
+		$safe_pass = htmlspecialchars($row["web_password"], ENT_QUOTES | ENT_SUBSTITUTE, "UTF-8");
+		$webid_safe = (int)$row["webid"];
+
 		echo "<table border=0>";
-		echo	"<tr style='background-color: #f4f4f4;'><td colspan=2>" . $row["web_url"] . "</td></tr>" . 
+		echo	"<tr style='background-color: #f4f4f4;'><td colspan=2>" . $safe_url . "</td></tr>" . 
-				"<tr><td>Username: " . $row["web_username"] . "</td><td>Password: " . $row["web_password"] . "</td></tr>";
+				"<tr><td>Username: " . $safe_user . "</td><td>Password: " . $safe_pass  . "</td></tr>";
 
 		echo	"<tr><td><form method='POST' style='height: 3px'>" . 
-				"<input type='hidden' name='websiteid' value='" . $row["webid"] . "'>" .
+				"<input type='hidden' name='websiteid' value='" . $webid_safe . "'>" .
 				"<button type='submit' name='delete_website'>Delete</button></form></td></tr>";
 
 		echo	"<tr><td colspan=2 style=height: 20px;></td></tr>";

passman-dev/php/passman/login.php

@@ -26,22 +26,30 @@ if ($_SERVER["REQUEST_METHOD"] === "POST") {
 		// }
 		require_once __DIR__ . "/config.php";
 
+		// Authentication with hashed passwords:
+		// 1) Fetch the stored hash by username
 		// 		SQL injection mitigation: use a prepared statement with bound parameters.
 		// 		User input is treated strictly as data, not as part of the SQL syntax.
-		$stmt = $conn->prepare("SELECT id FROM login_users WHERE username = ? AND password = ?");
+		// 2) Verify the submitted password with password_verify()
-
+		$stmt = $conn->prepare("SELECT id, password FROM login_users WHERE username = ?");
 		if ($stmt === false) {
 			// Fail closed (do not leak details in production).
 			die("Prepare failed.");
 		}
 
-		$stmt->bind_param("ss", $username, $password);
+		$stmt->bind_param("s", $username);
 		$stmt->execute();
-		$stmt->store_result();   // Needed to use $stmt->num_rows
+
+		$result = $stmt->get_result();  // Requires mysqlnd (usually enabled)
 		unset($_POST['username']);
 		unset($_POST['password']);
 
-		if ($stmt->num_rows >= 1) {
+		if ($result && $result->num_rows === 1) {
+			$row = $result->fetch_assoc();
+			$stored_hash = $row["password"];
+
+			// Verify password against the stored hash.
+			if (password_verify($password, $stored_hash)) {
 				// Regenerate session ID to prevent session fixation!
 				//session_regenerate_id(true);
 
@@ -49,21 +57,18 @@ if ($_SERVER["REQUEST_METHOD"] === "POST") {
 				$_SESSION['username'] = $username;
 				$_SESSION['loggedin'] = true;
 
-			//while ($row = $result -> fetch_assoc()) {
-			//	print_r($row);
-			//	$_SESSION['user_id'] = $row['id'];
-			//}
-
-			// Close
 				$stmt->close();
 				$conn->close();
 
-			// Redirect to a dashboard page
 				header("Location: dashboard.php");
 				exit;
 			} else {
 				$login_message = "Invalid username or password";
 			}
+		} else {
+			$login_message = "Invalid username or password";
+		}
+
 		$stmt->close();
 		$conn->close();
 	}

passman-dev/php/passman/register.php

@@ -37,8 +37,17 @@ if ($_SERVER["REQUEST_METHOD"] === "POST") {
 			$login_message = "Database error (prepare failed).";
 			$result = false;
 		} else {
-			$stmt->bind_param("ss", $new_username, $new_password);
+			// Hash the password before storing it.
+			// Never store login passwords in plaintext.
+			$password_hash = password_hash($new_password, PASSWORD_DEFAULT);
+			if ($password_hash === false) {
+				$login_message = "Password hashing failed.";
+				$result = false;
+			} else {
+				// Store the hash (not the plaintext password).
+				$stmt->bind_param("ss", $new_username, $password_hash);
 				$result = $stmt->execute();
+			}
 			$stmt->close();
 		}