Fix critical security vulnerability: Move SQLite database outside webroot (#738)

* Initial plan

* Fix critical security vulnerability: Move SQLite database outside webroot

Co-authored-by: sstidl <12804296+sstidl@users.noreply.github.com>

* Update documentation to explain secure SQLite database path

Co-authored-by: sstidl <12804296+sstidl@users.noreply.github.com>

* Clarify SQLite database security requirements for different installation scenarios

Co-authored-by: sstidl <12804296+sstidl@users.noreply.github.com>

* Improve security documentation with web server configuration guidance

Co-authored-by: sstidl <12804296+sstidl@users.noreply.github.com>

* Fix incomplete file path in documentation example

Co-authored-by: sstidl <12804296+sstidl@users.noreply.github.com>

* Clarify that database file is created after first test in verification step

Co-authored-by: sstidl <12804296+sstidl@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: sstidl <12804296+sstidl@users.noreply.github.com>

doc.md

@@ -83,7 +83,23 @@ Log into your database using phpMyAdmin or a similar software and create a new d
 
 Open `results/telemetry_settings.php` in a text editor. Set `$db_type` to either `mysql`,`postgresql`, `mssql` or `sqlite`.
 
-If you chose to use SQLite, you might want to change `$Sqlite_db_file` to another path where you want the database to be stored. Just make sure that the file cannot be downloaded by users. Sqlite doesn't require any additional configuration, you can skip the rest of this section.
+If you chose to use SQLite, the default configuration stores the database at `__DIR__ . '/../../speedtest_telemetry.db'`, which places it two directories up from the `results/` folder. This is designed to keep the database **outside your web-accessible directory** for security.
+
+**Critical Security Requirements**:
+1. **Web Server Configuration**: Configure your web server's document root to point to the application directory, NOT its parent. For example:
+   - Install application files to: `/var/www/speedtest/`
+   - Set Apache/nginx document root to: `/var/www/speedtest/` (NOT `/var/www/`)
+   - Database will be at: `/var/www/speedtest_telemetry.db` (outside document root, not web-accessible)
+
+2. **Alternative: Use Absolute Path**: For maximum security, especially if you cannot control the document root configuration, modify `$Sqlite_db_file` in `results/telemetry_settings.php` to use an absolute path completely outside your web directories:
+   ```php
+   $Sqlite_db_file = '/var/lib/speedtest/speedtest_telemetry.db';  // or /opt/speedtest_data/speedtest_telemetry.db
+   ```
+   Ensure the web server has write permissions to this directory.
+
+3. **Verification**: After running at least one speed test or accessing `sanitycheck.php` (which creates the database), try accessing `http://yourserver/speedtest_telemetry.db` in a browser - you should get a 404 error. If the file downloads, your configuration is insecure. Note: The database file won't exist until the first test is recorded, so you'll get a 404 initially even with correct configuration.
+
+SQLite doesn't require any additional configuration beyond setting a secure path and ensuring proper permissions.
 
 If you chose to use MySQL, you must set your database credentials:
 

docker/entrypoint.sh

@@ -73,6 +73,8 @@ if [[ "$TELEMETRY" == "true" && ("$MODE" == "frontend" || "$MODE" == "standalone
     sed -i s/\$db_type\ =\ \'.*\'/\$db_type\ =\ \'sqlite\'\/g /var/www/html/results/telemetry_settings.php
   fi
 
+  # Override SQLite database path for Docker environment
+  # In Docker, we use /database/db.sql which is outside the web-accessible directory
   sed -i s/\$Sqlite_db_file\ =\ \'.*\'/\$Sqlite_db_file=\'\\\/database\\\/db.sql\'/g /var/www/html/results/telemetry_settings.php
   sed -i s/\$stats_password\ =\ \'.*\'/\$stats_password\ =\ \'$PASSWORD\'/g /var/www/html/results/telemetry_settings.php
 

results/telemetry_settings.php

@@ -10,7 +10,7 @@ $enable_id_obfuscation = false;
 $redact_ip_addresses = false;
 
 // Sqlite3 settings
-$Sqlite_db_file = __DIR__ . '/speedtest_telemetry.db';
+$Sqlite_db_file = __DIR__ . '/../../speedtest_telemetry.db';
 
 // mssql settings
 $MsSql_server = 'DB_HOSTNAME';