31,003
edits
Security information: Difference between revisions
m
→File:art.png Security Features
Tag: 2017 source edit |
Tag: 2017 source edit |
||
| Line 75: | Line 75: | ||
*Works with PHP safe_mode on or off (on recommended) <sup>[*3]</sup>. | *Works with PHP safe_mode on or off (on recommended) <sup>[*3]</sup>. | ||
*Production mode to disable any technical information leakage like debug, error stacktrace, version informations (See [[Configuration_file|configuration file]]) <sup>[*6]</sup>. | *Production mode to disable any technical information leakage like debug, error stacktrace, version informations (See [[Configuration_file|configuration file]]) <sup>[*6]</sup>. | ||
*Protection against SQL injection. Protected by an Internal WAF, and unit test to check database good practice for escapement. <sup>[*2]</sup>. | *WAF: Protection against SQL injection. Protected by an Internal WAF, and unit test to check database good practice for escapement. <sup>[*2]</sup>. | ||
*Protection against XSS injection (Cross Site Scripting). Protected by an internal WAF and web page headers. <sup>[*1]</sup>. | *WAF: Protection against XSS injection (Cross Site Scripting). Protected by an internal WAF and web page headers. <sup>[*1]</sup>. | ||
*Protection against SSRF. All access to an URL uses the getURLContent() method into core/lib/geturl.lib.php that bring this protection. | *Protection against SSRF. All access to an URL uses the getURLContent() method into core/lib/geturl.lib.php that bring this protection. | ||
*Protection against CSRF (Cross Site Request Forgery). Protected by an internal WAF and a token system. <sup>[*5]</sup>. | *Protection against CSRF (Cross Site Request Forgery). Protected by an internal WAF and a token system (with several level of renewal policies, by session or by page). <sup>[*5]</sup>. | ||
Note that it is also recommended to protect your web server by disabling the Apache option | Note that it is also recommended to protect your web server by disabling the Apache option | ||