Security information: Difference between revisions

Security information (view source)

74 bytes added , 1 year ago

m

31,003

edits

@@ Line 75: / Line 75: @@
 *Works with PHP safe_mode on or off (on recommended) <sup>[*3]</sup>.
 *Production mode to disable any technical information leakage like debug, error stacktrace, version informations (See [[Configuration_file|configuration file]]) <sup>[*6]</sup>.
-*Protection against SQL injection. Protected by an Internal WAF, and unit test to check database good practice for escapement. <sup>[*2]</sup>.
+*WAF: Protection against SQL injection. Protected by an Internal WAF, and unit test to check database good practice for escapement. <sup>[*2]</sup>.
-*Protection against XSS injection (Cross Site Scripting). Protected by an internal WAF and web page headers. <sup>[*1]</sup>.
+*WAF: Protection against XSS injection (Cross Site Scripting). Protected by an internal WAF and web page headers. <sup>[*1]</sup>.
 *Protection against SSRF. All access to an URL uses the getURLContent() method into core/lib/geturl.lib.php that bring this protection.
-*Protection against CSRF (Cross Site Request Forgery). Protected by an internal WAF and a token system. <sup>[*5]</sup>.
+*Protection against CSRF (Cross Site Request Forgery). Protected by an internal WAF and a token system (with several level of renewal policies, by session or by page). <sup>[*5]</sup>.
 Note that it is also recommended to protect your web server by disabling the Apache option