Setup Other: Difference between revisions

Setup Other (view source)

542 bytes added , 2 years ago

m

31,003

edits

@@ Line 234: / Line 234: @@
 *'''MAIN_SECURITY_ANTI_SSRF_SERVER_IP''' ► Can set a complete list of IPs of server.
-*'''MAIN_SECURITY_CSRF_WITH_TOKEN''' ► Activate a second anti-CSRF protection on POST (so a POST from another web site can't be done). Note there is also a default protection using test on referrer that is not reliable. This second protection uses TOKEN on forms and is more powerful. ► (v5.0+)
+*'''MAIN_SECURITY_CSRF_WITH_TOKEN''' ► Activate a second anti-CSRF protection on POST (so a POST from another web site can't be done). Note there is also a default protection using test on referrer that is not reliable. This second protection uses TOKEN on forms and is more powerful. Value can be: 0=CSRF protection disabled; 1=CSRF protection is on POST URLs only (default from version Dolibarr 15.0+); 2=CSRF protection is required on POST + some GET URL that contains some white listed parameters like the parameter "action" used to request database change (default from version Dolibarr 16+), 3=CSRF protection is enabled on any POST and GET URLs (a valid CSRF token is expected whatever are the parameters, warning: can be enabled on Dolibarr but some external modules developped by thirdparty may not be ready yet with this option)
 *'''MAIN_MODULES_FOR_EXTERNAL''' ► Limit available modules for external users. By default value is '<code>facture,commande,contact,propal,projet,contrat,societe,ficheinter,expedition,agenda</code>'