Files
HeuJung 71abdeaf60 fix(security): KVE-2026-1914/1915/1919 remediation 전건
위임 관리자(부관리자)가 권한·역할·표현식·비밀 콘텐츠 경계를 우회하던
결함군을 계층 대칭성 원칙으로 전건 차단한다. 약한 경로가 정상 응답을
내보내는 것이 유일한 증상이라, 게이트를 생산 지점 한 곳(SSoT)에 두고
같은 데이터를 내보내는 소비 경로 전부가 그 게이트를 경유하도록 맞췄다.

- 등급 상한(rank ceiling): 슈퍼관리자 보호·역할/사용자 역할 배정(추가·제거
 대칭)·일괄 상태변경·순서변경을 상세 경로와 동일 강도로 재적용. 가드는
 DB 쓰기에 선행하여 거부 시 상태 불변.
- 레이아웃 표현식: new Function/with 실행을 AST 화이트리스트 평가기로 교체.
 비-문자열 computed 키 정규화(normalizeKey)·Object facade(리플렉션 static
 제거)·legacy 접근자 차단. 저장측 검증·정적 검사와 3계층 동형.
- secret 게이트: 비밀글의 댓글·첨부·문의 독립 경로 재적용, hash 파일서빙
 소유권·비밀·발행 상태 검사 통일.
- 신뢰 스크립트 호스트: 확장 선언 기반 + same-origin 브라우저 정규화를
 런타임·저장측·정적검사 3층 동형화.
- 회귀 감지: 단위·Feature·E2E·시나리오 매니페스트 전축 + audit 룰 4종 신설.
2026-08-17 01:45:09 +09:00

94 lines
6.1 KiB
PHP

<?php
return [
// User related exceptions
'cannot_delete_super_admin' => 'Super admin cannot be deleted.',
'cannot_modify_super_admin' => 'You do not have permission to modify a super admin account or role.',
'cannot_grant_unheld_permission' => 'You cannot grant permissions you do not hold or a broader scope than your own.',
'cannot_modify_protected_role' => 'You do not have permission to modify a system or extension-owned role.',
'circular_reference' => 'Layout circular reference detected: :trace',
'max_depth_exceeded' => 'Layout nesting depth exceeds maximum allowed depth (:max).',
'template_file_copy_failed' => 'Template file copy failed: :source → :destination',
'template_build_directory_creation_failed' => 'Template build directory creation failed: :path',
'template_dist_directory_not_found' => 'Template dist directory not found: :path',
'template_not_found' => 'Template not found: :identifier',
'template_not_active' => 'Template is not active: :identifier (status: :status)',
// Optimistic lock — concurrent save conflict
'concurrent_modification' => 'Another user has saved first. (resource: :resource, current version: :current, your version: :expected)',
// Layout related exceptions
'layout' => [
'duplicate_data_source_id' => 'Duplicate data_sources ID: :id',
'duplicate_data_source_id_in_file' => 'Duplicate data_sources ID in layout file: :ids (file: :file)',
'duplicate_data_source_id_extends' => 'Duplicate data_sources ID in extends inheritance: :ids (child: :child, parent: :parent)',
'not_found' => 'Layout not found: :name',
'parent_not_found' => 'Parent layout not found: :parent (requested layout: :child)',
// Include related exceptions
'include_file_not_found' => 'Include file not found: :path (resolved: :resolved)',
'invalid_include_json' => 'Invalid JSON in include file: :path (error: :error)',
'circular_include' => 'Circular include detected: :trace',
'max_include_depth_exceeded' => 'Maximum include depth exceeded (max: :max)',
'include_outside_directory' => 'Include path outside allowed directory: :path (allowed: :allowed_dir)',
],
// Layout version related exceptions
'layout_version' => [
'save_failed_after_retries' => 'Failed to save layout version after :attempts attempts.',
'save_failed_unexpected' => 'Unexpected error occurred while saving layout version.',
],
// Settings related exceptions
'settings' => [
'backup_creation_failed' => 'Failed to create settings backup file.',
'restore_failed' => 'Failed to restore settings.',
'category_not_found' => 'Settings category not found: :category',
'save_failed' => 'Failed to save settings: :category',
'json_parse_failed' => 'Failed to parse JSON file: :path (:error)',
'add_category_module_only' => 'addCategory is only available for modules.',
],
// Core update related exceptions
'core_update' => [
'handoff' => 'Upgrade handoff: completed up to :after_version — :reason (resume with: :resume_command)',
],
// Vendor bundle / installation related exceptions
'vendor' => [
'composer_not_available' => 'Composer cannot be executed in this environment. Use bundled mode instead.',
'composer_not_available_for_build' => 'Building vendor-bundle requires Composer execution. Install/configure Composer in the development environment and retry.',
'bundle_build_composer_failed' => 'composer install failed while building vendor-bundle (exit :exit): :message',
'bundle_build_promote_failed' => 'failed to move vendor-bundle build result to its final path (:from → :to)',
'composer_execution_failed' => 'Composer execution failed: :message',
'bundle_zip_missing' => 'vendor-bundle.zip not found: :path',
'bundle_manifest_missing' => 'vendor-bundle.json not found: :path',
'bundle_manifest_invalid' => 'vendor-bundle.json could not be read: :error',
'bundle_integrity_failed' => 'Bundle integrity check failed: :details',
'bundle_schema_unsupported' => 'Unsupported vendor-bundle.json schema version: :version',
'zip_archive_not_available' => 'PHP ZipArchive extension is not installed.',
'zip_hash_mismatch' => 'vendor-bundle.zip hash mismatch (expected: :expected, actual: :actual).',
'composer_json_sha_mismatch' => 'composer.json has changed since the bundle was built. Rebuild with vendor-bundle:build.',
'composer_lock_sha_mismatch' => 'composer.lock has changed since the bundle was built. Rebuild with vendor-bundle:build.',
'bundle_contains_unsafe_path' => 'Bundle zip contains unsafe file path: :path',
'extraction_failed' => 'Failed to extract bundle zip: :message',
'no_vendor_strategy_available' => 'Cannot determine vendor install strategy. Neither Composer nor bundle zip is available.',
'source_dir_not_found' => 'Installation source directory not found: :path',
'target_not_writable' => 'Target directory is not writable: :path',
'target_not_writable_owner_hint' => "Current user (:current_user) differs from directory owner (:owner). Run 'chown -R :current_user_name :path' and retry, or SSH in as the owner (:owner_name) before running this command.",
'composer_json_not_found' => 'composer.json not found: :path',
'no_composer_lock' => 'composer.lock is required. Run composer install first: :path',
'vendor_dir_not_found' => 'vendor/ directory does not exist. Run composer install first: :path',
'composer_binary_not_found' => 'Composer binary not found. Set the COMPOSER_BINARY environment variable or add composer to your PATH.',
],
// SEO / Sitemap 관련 예외
'seo' => [
'sitemap_write_failed' => 'Failed to write sitemap file: :path',
'sitemap_gzip_failed' => 'Failed to compress sitemap child file: :file',
'sitemap_temp_file_unreadable' => 'Cannot read sitemap temporary file: :file',
'sitemap_stat_group_column_unsupported' => 'Unsupported group-by column: :column',
],
];