# Validasi CDN Vault v0.3.0

Revisi navigasi, isolasi akun dan pengamanan permintaan. Pengujian dijalankan secara lokal pada PHP 8.3 (paket Ubuntu), MariaDB 10.11, serta Apache 2.4. Ini adalah verifikasi fungsi dan kontrol aplikasi, bukan sertifikasi keamanan menyeluruh atau pengujian hosting produksi.

## Hasil

- 169 pemeriksaan integrasi PHP/CGI dan database: lulus.
- 15 pemeriksaan akses berkas melalui Apache HTTP sungguhan: lulus, termasuk .htaccess dan jalur validasi SSL yang tetap tersedia.
- Pemeriksaan sintaks seluruh 56 file PHP dan 2 file JavaScript: lulus.
- Dashboard user, daftar admin, tombol sidebar desktop, serta drawer mobile pada iframe 360 px diperiksa di browser. Lebar konten mobile sama dengan viewport; tidak ada overflow horizontal.
- Template untuk QA visual berasal dari respons PHP sesungguhnya. Halaman visual disajikan sebagai fixture statis; perilaku login, role, CSRF, CAPTCHA dan perubahan akun diperiksa terpisah melalui CGI/database. Kredensial tidak dimasukkan ke browser.

## Cakupan penting

Installer baru, pendaftaran pending, pemalsuan role/status, persetujuan admin, dua user dengan aset/statistik berbeda, penolakan URL admin dan seluruh aksi admin untuk user, penolakan parameter pemilik lain, escaping XSS tersimpan/refleksi, payload SQL injection, metode dan path ambigu, Host/Origin, HTTPS/header proxy palsu, CAPTCHA PNG/sesi/sekali pakai/tujuan, throttle lintas IP dan reservasi paralel, pencabutan sesi, reset/password sementara, pembaruan konfigurasi v0.2, migrasi skema v0.1, instalasi subfolder, pembersihan kedaluwarsa, serta fail closed penyimpanan sesi.

Uji limiter umum menempatkan bucket pada ambang untuk memeriksa HTTP 429 dan pemulihannya. Uji reservasi login paralel memakai proses PHP terpisah dengan satu database nyata. Tidak dilakukan simulasi DDoS volumetrik atau uji beban hosting.

## Batas verifikasi

- Belum dipasang atau diuji pada akun cPanel/domain pengguna. Konfigurasi produksi, kredensial database/mail, sertifikat, DNSSEC, firewall origin, WAF, DDoS upstream dan kebijakan cache hosting belum diubah.
- Pengiriman email ke inbox/SMTP produksi tidak diuji dalam revisi ini; pengujian lupa password memeriksa respons dan token pada aplikasi. SMTP tetap memerlukan konfigurasi mailbox yang sah.
- MySQL 5.7/8 dan versi PHP lain tidak dijalankan dalam uji ini. Runtime produksi harus berupa cabang yang didukung dan sudah menerima patch keamanan PHP 21 Oktober 2026 atau backport vendor yang setara; lihat KEAMANAN.md. Runtime QA tidak dibundel untuk dipasang di hosting.
- Tidak ada CMS/plugin di dalam paket. Patch PHP, server, database dan cPanel tetap tanggung jawab lapisan hosting.
- Upload/galeri, folder, tautan, berbagi publik, API dan pengaktifan 2FA belum diimplementasikan; placeholder menu telah dikeluarkan, bukan diubah menjadi fitur palsu.

## Daftar pemeriksaan otomatis

| No. | Pemeriksaan | Hasil |
| --- | --- | --- |
| 1 | Installer page | Lulus |
| 2 | Setup secret absent from HTML | Lulus |
| 3 | Installer CSRF required | Lulus |
| 4 | Installer verifies host ownership | Lulus |
| 5 | Installer database step | Lulus |
| 6 | Installer administrator step | Lulus |
| 7 | Fresh install completes | Lulus |
| 8 | Production config private permissions | Lulus |
| 9 | Setup secret removed | Lulus |
| 10 | Version and schema correct | Lulus |
| 11 | 15 database tables | Lulus |
| 12 | New item default private | Lulus |
| 13 | Installer locked after install | Lulus |
| 14 | Guest authentication /app | Lulus |
| 15 | Guest authentication /app/unknown | Lulus |
| 16 | Guest authentication /admin | Lulus |
| 17 | Guest authentication /admin/users/1 | Lulus |
| 18 | Guest authentication /admin/unknown | Lulus |
| 19 | Anonymous internal API rejected | Lulus |
| 20 | Admin login and landing | Lulus |
| 21 | Admin menu route /admin | Lulus |
| 22 | Admin menu route /admin/ | Lulus |
| 23 | Admin menu route /admin/users | Lulus |
| 24 | Admin menu route /admin/users/ | Lulus |
| 25 | Admin menu route /admin/users/1 | Lulus |
| 26 | Admin menu route /admin/system | Lulus |
| 27 | Admin menu route /app | Lulus |
| 28 | Admin menu route /app/ | Lulus |
| 29 | Admin menu route /app/change-password | Lulus |
| 30 | Admin menu present for administrator | Lulus |
| 31 | Public registration submitted | Lulus |
| 32 | Registration cannot forge privileges | Lulus |
| 33 | Registration privacy default | Lulus |
| 34 | Pending account refused | Lulus |
| 35 | Admin approves registration | Lulus |
| 36 | Approved user enters own dashboard | Lulus |
| 37 | Login session regenerated | Lulus |
| 38 | Secure session cookies | Lulus |
| 39 | Second approved user login | Lulus |
| 40 | User HTML contains no admin menus or URLs | Lulus |
| 41 | Only functional user menu labels | Lulus |
| 42 | Only own identity in user HTML | Lulus |
| 43 | User statistics reflect own records | Lulus |
| 44 | Second user has different own statistics | Lulus |
| 45 | Owner query cannot change dashboard user_id=3 | Lulus |
| 46 | Owner query cannot change dashboard id=3 | Lulus |
| 47 | Owner query cannot change dashboard owner_id=3 | Lulus |
| 48 | Owner query cannot change dashboard user_id=1%20OR%201=1 | Lulus |
| 49 | Owner query cannot change dashboard user_id[]=1 | Lulus |
| 50 | Other user activity timestamp absent | Lulus |
| 51 | User denied admin URL /admin | Lulus |
| 52 | User denied admin URL /admin/ | Lulus |
| 53 | User denied admin URL /admin/users | Lulus |
| 54 | User denied admin URL /admin/users/3 | Lulus |
| 55 | User denied admin URL /admin/system | Lulus |
| 56 | User denied admin URL /admin/does-not-exist | Lulus |
| 57 | User denied admin mutation approve | Lulus |
| 58 | User denied admin mutation reject | Lulus |
| 59 | User denied admin mutation activate | Lulus |
| 60 | User denied admin mutation deactivate | Lulus |
| 61 | User denied admin mutation update | Lulus |
| 62 | User denied admin mutation password | Lulus |
| 63 | User denied account creation | Lulus |
| 64 | Unauthorized changes left victim intact | Lulus |
| 65 | No user directory endpoint | Lulus |
| 66 | No user enumeration API | Lulus |
| 67 | Visible user navigation https://vault.test/app | Lulus |
| 68 | Visible user navigation https://vault.test/app/change-password | Lulus |
| 69 | Logout CSRF required | Lulus |
| 70 | Logout GET does not mutate session | Lulus |
| 71 | Session survives rejected logout | Lulus |
| 72 | Stored XSS escaped in user dashboard | Lulus |
| 73 | Stored XSS escaped in administrator view | Lulus |
| 74 | Reflected search XSS escaped | Lulus |
| 75 | SQL injection in search does not enumerate | Lulus |
| 76 | SQL injection cannot bypass login | Lulus |
| 77 | Stacked SQL disabled | Lulus |
| 78 | CSP nonce and frame protection | Lulus |
| 79 | Private pages never cached | Lulus |
| 80 | Security response header strict-transport-security | Lulus |
| 81 | Security response header x-content-type-options | Lulus |
| 82 | Security response header x-frame-options | Lulus |
| 83 | Security response header cross-origin-opener-policy | Lulus |
| 84 | Security response header cross-origin-resource-policy | Lulus |
| 85 | Spoofed Host rejected | Lulus |
| 86 | Host suffix confusion rejected | Lulus |
| 87 | Foreign origin rejected despite valid token | Lulus |
| 88 | Cross-site fetch rejected | Lulus |
| 89 | Origin suffix confusion rejected | Lulus |
| 90 | Origin attacks leave session usable | Lulus |
| 91 | HTTP GET redirected to configured HTTPS | Lulus |
| 92 | Untrusted proxy cannot spoof HTTPS | Lulus |
| 93 | Oversized request rejected | Lulus |
| 94 | Unsupported body type rejected | Lulus |
| 95 | Ambiguous path rejected /admin%2fusers | Lulus |
| 96 | Ambiguous path rejected /%61dmin%252fusers | Lulus |
| 97 | Ambiguous path rejected /app/../admin/users | Lulus |
| 98 | Ambiguous path rejected /admin\users | Lulus |
| 99 | Ambiguous path rejected //admin/users | Lulus |
| 100 | Ambiguous path rejected /admin%00/users | Lulus |
| 101 | Ambiguous path rejected /%GG | Lulus |
| 102 | Unsupported HTTP method rejected | Lulus |
| 103 | CAPTCHA renders actual PNG | Lulus |
| 104 | CAPTCHA response never cached | Lulus |
| 105 | Other session cannot view CAPTCHA | Lulus |
| 106 | Wrong credentials fail with valid CAPTCHA | Lulus |
| 107 | CAPTCHA cannot be reused | Lulus |
| 108 | CAPTCHA purpose cannot be swapped | Lulus |
| 109 | CAPTCHA refresh CSRF required | Lulus |
| 110 | Authorized CAPTCHA refresh works | Lulus |
| 111 | Failed login counted 1 | Lulus |
| 112 | Failed login counted 2 | Lulus |
| 113 | Failed login counted 3 | Lulus |
| 114 | Failed login counted 4 | Lulus |
| 115 | Failed login counted 5 | Lulus |
| 116 | Sixth attempt throttled despite spoofed IP header | Lulus |
| 117 | Distributed account limit allows only 20 parallel reservations | Lulus |
| 118 | Rotating IP does not bypass account cap | Lulus |
| 119 | Pair lock allows only 5 parallel failures | Lulus |
| 120 | General request flood returns 429 | Lulus |
| 121 | Request cap recovers after window | Lulus |
| 122 | Default headers never trusted | Lulus |
| 123 | Configured IPv4 proxy may supply visitor IP | Lulus |
| 124 | Outside proxy CIDR cannot spoof headers | Lulus |
| 125 | Configured IPv6 proxy recognized | Lulus |
| 126 | Wildcard proxy trust rejected | Lulus |
| 127 | Admin deactivates account | Lulus |
| 128 | Disabled account loses existing session | Lulus |
| 129 | Disabled account cannot log in | Lulus |
| 130 | Admin reactivation works | Lulus |
| 131 | Admin resets temporary password | Lulus |
| 132 | Password reset revokes old session | Lulus |
| 133 | Temporary password forces change | Lulus |
| 134 | Forced-password account cannot skip change | Lulus |
| 135 | Own password change completes | Lulus |
| 136 | Forged user ID did not change other password | Lulus |
| 137 | Login after own password change | Lulus |
| 138 | Cannot deactivate current administrator | Lulus |
| 139 | Existing v0.2 configuration works without migration | Lulus |
| 140 | Already-current schema updater is informational | Lulus |
| 141 | Subfolder login redirects correctly | Lulus |
| 142 | Subfolder dashboard and trailing slash work | Lulus |
| 143 | Subfolder admin remains protected | Lulus |
| 144 | Scheduled cleanup runs as CLI | Lulus |
| 145 | Expired login records removed | Lulus |
| 146 | Cleanup retains users and audit history | Lulus |
| 147 | Legacy configuration redirects to updater | Lulus |
| 148 | Legacy updater requires CSRF | Lulus |
| 149 | User cannot execute legacy migration | Lulus |
| 150 | Legacy administrator migration succeeds | Lulus |
| 151 | Migration preserves APP_KEY | Lulus |
| 152 | Migration records current code version | Lulus |
| 153 | Migration creates private configuration backup | Lulus |
| 154 | Migration revokes all prior sessions | Lulus |
| 155 | Pre-migration session rejected | Lulus |
| 156 | User login after migration | Lulus |
| 157 | Administrator login after migration | Lulus |
| 158 | Noncanonical Unicode email cannot log in | Lulus |
| 159 | Valid reset link accepted | Lulus |
| 160 | Token-based reset completes | Lulus |
| 161 | Reset token marked single-use | Lulus |
| 162 | Reset revokes account sessions | Lulus |
| 163 | Reset preserves other account session | Lulus |
| 164 | Reset token reuse denied | Lulus |
| 165 | Reset cannot alter submitted other owner ID | Lulus |
| 166 | Forgot password does not enumerate accounts | Lulus |
| 167 | Recovery remains available during login throttling | Lulus |
| 168 | Missing private session storage fails closed | Lulus |
| 169 | User remains usable after security regressions | Lulus |
| 170 | Apache access /assets/css/app.css | Lulus |
| 171 | Apache access /.well-known/pki-validation/token.txt | Lulus |
| 172 | Apache access /cdnvault_app/config/config.php | Lulus |
| 173 | Apache access /cdnvault_app/ | Lulus |
| 174 | Apache access /cdn/private.webp | Lulus |
| 175 | Apache access /backup.zip | Lulus |
| 176 | Apache access /dump.sql | Lulus |
| 177 | Apache access /config.env | Lulus |
| 178 | Apache access /README.md | Lulus |
| 179 | Apache access /app.log | Lulus |
| 180 | Apache access /settings.json | Lulus |
| 181 | Apache access /config.bak | Lulus |
| 182 | Apache access /app-path.php | Lulus |
| 183 | Apache access /.user.ini | Lulus |
| 184 | Apache access /.git/config | Lulus |