diff --git a/security/application.md b/security/application.md index c0761bc..aecc0f4 100755 --- a/security/application.md +++ b/security/application.md @@ -31,3 +31,21 @@ Updates are very important not only to implement the newest features but also to ## Modules, Extensions, Themes etc. Only download software components from the official website never trust any third party services. All software components on the official website get tested and reviewed internally in order to ensure no malicious behavior. + +## Which security features does the application implement? + +* We use Cross-Site Request Forgery tokens (`CSRF`) for API calls to prevent malicious executions through hidden third-party calls +* We use a strict Content Security Policy (`CSP`) and `nonces` to prevent malicious code infiltration such as Cross-Site Scripting (`XSS`) +* We use BCRYPT/Blowfish hashing with a randomly generated salt for user passwords +* Some selected sensitive data is encrypted in the database and on the file system using the encryption library `libsodium` +* We use backend validation on top of frontend validation +* We almost never sanitize data, data is either valid or gets dismissed +* We extensively test our source code +* We escape user generated text data +* Audit logs tracking changes in the database are first class citizens and are part of every installation by default +* In addition to database audit logs we also generate error logs +* Database query parameters are either simple datatypes (int, bool, float), use quotation for strings or use prepared statements +* File paths are guarded to be within the application path +* We mostly use soft deletes making it possible to restore most of the database data unless overwritten +* We provide extensive user and group permission handling +* Our default server configuration prevents the direct execution of any scripts aside from the main application \ No newline at end of file diff --git a/security/mentality.md b/security/mentality.md index e10675e..17388cf 100755 --- a/security/mentality.md +++ b/security/mentality.md @@ -1,6 +1,6 @@ # Security Mentality -Security layers and guidelines are usually seen by the every-day-user as necessary evil. However without a good mindset no amount of guidelines or even technical security measurements will protect the integrity of the server and data. The thought process often goes along these lines: +Security layers and guidelines are usually seen by the every-day-user as necessary evil. However, without a good mindset no amount of guidelines or even technical security measurements will protect the integrity of the server and data. The thought process often goes along these lines: 1. I will not get attacked! 2. I don't have any data that need protection! diff --git a/setup/install.md b/setup/install.md index 5bfa92e..91af1b4 100755 --- a/setup/install.md +++ b/setup/install.md @@ -41,11 +41,13 @@ sudo apt-get install software-properties-common apache2 mariadb-server mariadb-c sudo a2enmod rewrite sudo a2enmod headers + +sudo service apache2 restart ``` ## Php -The minimum php version requirement in the following installation guide is version 8.0. +The minimum php version requirement in the following installation guide is version 8.2. ### Windows @@ -57,6 +59,8 @@ The following extensions are recommended and sometimes even mandatory: ```sh sudo apt-get install php8.2 php8.2-dev php8.2-cli php8.2-common php8.2-mysql php8.2-pgsql php8.2-xdebug php8.2-opcache php8.2-pdo php8.2-sqlite php8.2-mbstring php8.2-curl php8.2-imap php8.2-bcmath php8.2-zip php8.2-dom php8.2-xml php8.2-phar php8.2-gd php-pear sqlite3 + +sudo service apache2 restart ``` ## Software @@ -169,7 +173,7 @@ extension=mbstring.dll // Example in case you are installing on Windows extension=mbstring.so // Example in case you are installing on Linux ``` -> The `php.ini` file can be **often** found at C:/xampp/php/php.ini on Windows and /etc/php/8.0/apache2/php.ini on Linux. +> The `php.ini` file can be **often** found at C:/xampp/php/php.ini on Windows and /etc/php/X.X/apache2/php.ini on Linux. > > Sometimes the ending .dll and .so must be omitted depending on the version and configuration of your php installation. @@ -224,7 +228,7 @@ Here you must define the admin login name, the admin password and email. ##### Top Level domain -The top level domain is the domain name where you installed the application. If you only installed it locally, it is 127.0.0.1. If you installed it on your web server, then you input the domain name e.g. `karaka.app` +The top level domain is the domain name where you installed the application. If you only installed it locally, it is 127.0.0.1. If you installed it on your web server, then you input the domain name e.g. `jingga.app` ##### Web Subdirectory