Difference between revisions of "Security information"
Jump to navigation
Jump to search
| Line 14: | Line 14: | ||
'''Hacks and cracks''' | '''Hacks and cracks''' | ||
| − | * Works with register_globals on or off ( | + | * Works with register_globals on or off (off highly recommended). |
* Works with and without PHP safe_mode enabled (on recommended). | * Works with and without PHP safe_mode enabled (on recommended). | ||
* Protection against SQL injection. | * Protection against SQL injection. | ||
Revision as of 23:53, 16 August 2009
Alerts
Last update: 2009-08-16
No security bugs known at the moment.
Features
Dolibarr implements several security features. Among them :
Encryption
- User passwords can be encrypted in database.
- Database technical password can be encoded in the Dolibarr configuration file (conf.php).
- Possibility to force HTTPS.
Hacks and cracks
- Works with register_globals on or off (off highly recommended).
- Works with and without PHP safe_mode enabled (on recommended).
- Protection against SQL injection.
- Protection against CSRF (Cross Site Request Forgery).
Pages and files access
- Pages and contents are protected by permissions (granted on groups or users) for each functional module.
- Files saved by Dolibarr are stored in a different root directory than web application (so they can not be downloaded without passing by the Dolibarr wrapper).
- Dolibarr directories content can't be accessed even if Apache option Indexes has be forgotten to on (should not).
Login protection
- Delay anti brute force cracking on login page.
- Graphical code (CAPTCHA) against robots on login page.
- No passwords in logs, even in technical logs.
- Internal logger to save permanently all Dolibarr events about user's administration and successful or failed logins.
Viruses
- Possibility to run an anti-virus on every uploaded file.