PHP security - Revision history

Paul: /* File uploads */

2021-03-23T15:41:11Z

File uploads

← Older revision		Revision as of 15:41, 23 March 2021
Line 41:		Line 41:
	* Denial of service - upload bandwidth, CPU utilisation, disk space utilisation		* Denial of service - upload bandwidth, CPU utilisation, disk space utilisation
	* File types - be careful as some file data can be disguised as other file types (e.g. zip disguised as PNG)		* File types - be careful as some file data can be disguised as other file types (e.g. zip disguised as PNG)
			* Set sensible maximum per-file sizes and per-request sizes - do not rely on MAX_FILE_SIZE

	== Unsafe functions ==		== Unsafe functions ==

Paul at 15:08, 23 March 2021

2021-03-23T15:08:23Z

← Older revision		Revision as of 15:08, 23 March 2021
Line 17:		Line 17:

	* Create a simple method that can be called on each page behind authentication, or use middleware		* Create a simple method that can be called on each page behind authentication, or use middleware
			* Two factor authentication should be optional for all users, mandatory for those with elevated privileges

	== Authorisation ==		== Authorisation ==

Paul at 15:07, 23 March 2021

2021-03-23T15:07:39Z

← Older revision		Revision as of 15:07, 23 March 2021
Line 13:		Line 13:
	* Do not enforce regular password resets - people will use PasswordJanuary, PasswordFebruary etc.		* Do not enforce regular password resets - people will use PasswordJanuary, PasswordFebruary etc.
	* Exclude common passwords		* Exclude common passwords

			== Authentication ==

			* Create a simple method that can be called on each page behind authentication, or use middleware

			== Authorisation ==

			* Every page behind authentication potentially needs an authorisation check

	== Cookies ==		== Cookies ==

Paul: /* SQL injection */

2021-03-23T14:57:12Z

SQL injection

← Older revision		Revision as of 14:57, 23 March 2021
Line 1:		Line 1:
	== SQL injection ==		== SQL injection ==

			* Use bound parameters - not mysqli_real_escape_string

	== Passwords and credentials ==		== Passwords and credentials ==

Paul: /* Data from URLs */

2021-03-23T14:56:33Z

Data from URLs

← Older revision		Revision as of 14:56, 23 March 2021
Line 42:		Line 42:
	* Service provider may be malicious		* Service provider may be malicious
	* DNS poisoning may transfer you to the wrong site/IP		* DNS poisoning may transfer you to the wrong site/IP
			* Check that data returned is valid - exactly as you would from a form submission

	== Document root ==		== Document root ==

Paul: /* Passwords and credentials */

2021-03-23T14:35:45Z

Passwords and credentials

← Older revision		Revision as of 14:35, 23 March 2021
Line 8:		Line 8:
	* Refreshing		* Refreshing
	* Brute force attempts		* Brute force attempts
			* Check against common passwords
			* Do not enforce regular password resets - people will use PasswordJanuary, PasswordFebruary etc.
			* Exclude common passwords

	== Cookies ==		== Cookies ==

Paul: /* Password storage */

2021-03-23T14:34:54Z

Password storage

← Older revision		Revision as of 14:34, 23 March 2021
Line 1:		Line 1:
	== SQL injection ==		== SQL injection ==

	== ~~Password storage~~ ==		== Passwords and credentials ==

	* Hashing		* Hashing
Line 7:		Line 7:
	* Algorithms		* Algorithms
	* Refreshing		* Refreshing
			* Brute force attempts

	== Cookies ==		== Cookies ==

Paul: Created page with "== SQL injection == == Password storage == * Hashing * Timing attacks * Algorithms * Refreshing == Cookies == * Secure flag * HTTP flag == Cross site scripting (XSS) ==..."

2021-03-23T14:34:31Z

Created page with "== SQL injection == == Password storage == * Hashing * Timing attacks * Algorithms * Refreshing == Cookies == * Secure flag * HTTP flag == Cross site scripting (XSS) ==..."

New page

== SQL injection ==

== Password storage ==

* Hashing
* Timing attacks
* Algorithms
* Refreshing

== Cookies ==

* Secure flag
* HTTP flag

== Cross site scripting (XSS) ==

== Cross site request forgery (CSRF) ==

== Shared hosting ==

* Access to /tmp - session data
* Access to read/write files as www-data user

== File uploads ==

* Denial of service - upload bandwidth, CPU utilisation, disk space utilisation
* File types - be careful as some file data can be disguised as other file types (e.g. zip disguised as PNG)

== Unsafe functions ==

* exec
* shell
* eval

== Data from URLs ==

* No control over these (unless you also run the service)
* Service provider may be malicious
* DNS poisoning may transfer you to the wrong site/IP

== Document root ==

* Only files which are shown to users
* Everything else keep outside document root
* Pay particular care with non-PHP extensions, e.g. .inc