Forum : ImpressCMS

Fork me on GitHub


Subject:*
Name/Email:*
Message Icon:*
Message:*	SAMPLE [quote] Vaughan wrote: I don't know exactly if this is required or not, but would it be an idea if we could get a full audit of the core? by this I mean find a professional or someone with enough knowledge to go through the core and audit the code for security issues etc. would it be worthwhile? it could be expensive i know, but the cost could be justified providing it isn't going to break the bank as to speak. just an idle thought on my part, but thought it worthy of discussion.[/quote] [more...]
Options:*	Enable html tags Enable Smiley Enable BB Code

Re: Auditing Code (security wise)

by skenow on 2008/9/6 7:24:36

PHP 5.2+ has filters for sanitizing and validating many types of input - we should be taking a close look at these, since we have gone php5 with 1.1.

Here's a slideshow from the PHP web site about input filters

General security talks are here - http://talks.php.net/index.php/Security

Another good one is by Rasmus Lerdorf - http://talks.php.net/show/ygatech3/0

Re: Auditing Code (security wise)

by skenow on 2008/5/28 4:42:05

A very nice summary, Zaphod!

Quote:

- Check the data type is as expected. Functions include:

+ Is_string()

+ Is_numeric() // will also return true if data is a string containing a number

+ Is_float() // remember data passed in by form is typed as string

+ Is_array()

+ Is_object()

+ Ctype functions permit more specific screening of input (see PHP manual).

Properly casting the variables is important for many reasons, just be aware of your options and the impact on performance.

Similarly, I feel if the data and variables are handled properly, the numeric values in sql strings don't need quotes, which also improves performance of the database. By proper handling I mean -
* The variable has been declared and initialized
* The input has been sanitized
* The input has been encoded, if appropriate
* The input has been validated, and
* The input has been cast as the expected type (int, float, string, array)

In fact, using string values in the query when the field type is numeric can lead to different results - http://dev.mysql.com/doc/refman/5.1/en/type-conversion.html

Re: Auditing Code (security wise)

by davidl2 on 2008/5/28 4:23:22

Good thinking Giba - and if anyone has any additional advice to add to this, please do so!

Re: Auditing Code (security wise)

by GibaPhp on 2008/5/28 4:00:48

Exelent Zaphod

Added in Wiki:Auditing Code

Re: Auditing Code (security wise)

by davidl2 on 2008/5/28 3:43:22

I'd also add that if you're using a system like ours - perhaps making usage of other security methods, purifyier, trustpath etc is a must...

ImpressCMS is a multi-language content management system for the web. It is community-built, an open source project and based on the common web technologies of PHP and MySQL.

Useful Links

More information

Find us on Social Media