Open adam-buckley opened 11 years ago
We will want to check through cmfive and make sure we use $_REQUEST in the right area, as http://stackoverflow.com/questions/2142497/whats-wrong-with-using-request explains, REQUEST also includes COOKIE which should not be included with form data
Hi Adam,
please follow this up more. We want cmfive to be as secure as we can.
Here's a semi-shortened list from the first link that apply to us (IMO):
PHP Specific Issues (Im putting this at the top :) )
SSL
Misc
File Inclusion
File Upload
SQL
XSS
XML & API
Input
CSRF
ClickJacking/Everything in general
Data Transfer
Session
Truncation/Trimming Attacks
Passwords
Comparison
Here is also a PHP security cheat sheet from OWASP: https://www.owasp.org/index.php/PHP_Security_Cheat_Sheet Which also tells us how to fix most of the problems
Have now added per user salting as per the security requirements (commit: 3ca6065) There is a DB Update, also you will need to reset your password using the forgot feature
Firebug was kind enough to let me know that logging into cmfive is very unsecure, we should really look at introducing a SSL feature, like give users an option to add a proper certificate or have the server self sign one:
This is platform depended. Whoever installs a cmfive app is responsible to secure it behind SSL.
On Wednesday, January 15, 2014, adam-buckley wrote:
Firebug was kind enough to let me know that logging into cmfive is very unsecure, we should really look at introducing a SSL feature, like give users an option to add a proper certificate or have the server self sign one: [image: screen shot 2014-01-15 at 10 33 05 am]https://f.cloud.github.com/assets/1585392/1916225/5c79ef2c-7d74-11e3-812f-1bb4293801ec.png
— Reply to this email directly or view it on GitHubhttps://github.com/careck/cmfive/issues/15#issuecomment-32320050 .
Kind regards,
Carsten Eckelmann tripleAcs expert cloud solutions
Mobile 0458 79 55 44 carsten@tripleacs.com www.tripleacs.com
many of those security checklist items are concerning the server setup and configuration of the PHP environment ... not strictly the problem of the framework.
Some sources with good PHP security tips, cmfive will need to be checked over with these as security is paramount with a business orientated webapp:
http://en.wikibooks.org/wiki/Web_Application_Security_Guide/Checklist http://bitly.com/bundles/enygmadae/3 http://websec.io