Update PHP to 8.5.12+ and harden the image

build/entrypoint.sh

@@ -1,33 +1,39 @@
 #!/bin/bash
 
-#File to edit
+set -eu
+
+template='/usr/local/share/rwsols-config.php'
 file='/var/www/html/config.php'
 
-#Searches $1 and replaces with $2 in $file
-function search_and_replace {
-  sed -i 's|'$1'|'$2'|g' "$file"
+cp "$template" "$file"
+
+search_and_replace() {
+  local search="$1"
+  local replace="$2"
+  local escaped
+
+  escaped=$(printf '%s' "$replace" | sed -e 's/[&|\\]/\\&/g')
+  sed -i "s|$search|$escaped|g" "$file"
 }
 
-#RWSOLS
-#Does everything for ENV-vars with RWSOLS_*
-compgen -A variable RWSOLS_ | while read v; do
-  #Checks if REPLACE_envvar is in $file
+for v in $(compgen -A variable RWSOLS_); do
   if grep -q "REPLACE_$v" "$file"; then
     echo "search_and_replace REPLACE_$v with ${!v}"
-    search_and_replace REPLACE_$v ${!v}
+    search_and_replace "REPLACE_$v" "${!v}"
   fi
 done
 
-#Settings RWSOLS_HASH for keyphrase
-RWSOLS_HASH=$(echo -n $PASSPHRASE | sha256sum | cut -d " " -f 1)
-search_and_replace RWSOLS_HASH $RWSOLS_HASH
+RWSOLS_HASH=$(php -r '$p = getenv("PASSPHRASE"); echo password_hash($p === false ? "" : $p, PASSWORD_DEFAULT);')
+search_and_replace "REPLACE_APPROVED_HASH" "$RWSOLS_HASH"
 
+case "${APACHE2_PORT:-}" in
+  ''|*[!0-9]*)
+    echo "APACHE2_PORT must be a numeric port" >&2
+    exit 1
+    ;;
+esac
 
-#APACHE2 port mapping
-echo "search_and_replace port 8080 with $APACHE2_PORT"
-sed -i 's|'8080'|'$APACHE2_PORT'|g' '/etc/apache2/ports.conf'
+echo "Starting Apache2 on port $APACHE2_PORT"
+sed -i "s|8080|$APACHE2_PORT|g" /etc/apache2/ports.conf /etc/apache2/sites-available/000-default.conf
 
-
-#Starting apache2
-echo "Starting Apache2: /usr/sbin/apache2ctl -D FOREGROUND"
-/usr/sbin/apache2ctl -D FOREGROUND
+exec apache2-foreground