Commit 367611b7 authored by Carsten  Rose's avatar Carsten Rose
Browse files

Manual.rst, NewVersion.md: small updates

parent 0c53603f
Neuer Build
===========
* release: Wird ein *Tag* vergeben (egal welcher Branch) der mit 'v' beginnt, erzeugt das automatisch ein Build in 'snapshot' (https://w3.math.uzh.ch/qfq)
* snpashot: Jeder Commit (egal welcher Branch) erzeugt einen Snapshot.
* nightly: Nach einem Commit auf Branch 'master' tagsueber, wird um 23:55 ein 'nightly' Build erstellt (https://w3.math.uzh.ch/qfq).
* release: Wird ein *Tag* vergeben (egal welcher Branch) der mit 'v' beginnt, erzeugt das automatisch einen Build - https://w3.math.uzh.ch/qfq/release.
* snapshot: Jeder Commit (egal welcher Branch) erzeugt einen Snapshot - https://w3.math.uzh.ch/qfq/snapshot.
* nightly: Nach einem Commit auf Branch 'master' tagsueber, wird um 23:55 ein 'nightly' Build erstellt - https://w3.math.uzh.ch/qfq/nightly.
* CR commmittet immer in den Master Branch.
Neue Versionsnummer
......@@ -27,7 +27,7 @@ Neue Versionsnummer
3) Im Projektverzeichnis:
make t3sphinx (dadurch fallen Fehler in RESTdoc Syntax auf)
make t3sphinx (dadurch fallen Fehler in der RESTdoc Syntax auf)
4) Neuen Tag vergeben:
......
......@@ -642,7 +642,7 @@ Violation
On any violation, QFQ will sleep SECURITY_ATTACK_DELAY seconds (`config.qfq.ini`_) and than exit the running PHP process.
A detected attack leads to a complete white (=empty) page.
If SECURITY_SHOW_MESSAGE = true (`config.qfq.ini`_), at least a message is displayed.
If SECURITY_SHOW_MESSAGE = true (`config.qfq.ini`_), at least a message is displayed after the delay.
Client Parameter via SIP
------------------------
......@@ -654,6 +654,8 @@ Two users might have the same value of parameter 's', but the content is complet
Variables needed by Typo3 remains on the link and are not 'sip-encoded'.
.. _`SecureDirectFileAccess`:
Secure direct fileaccess
------------------------
......@@ -667,12 +669,19 @@ E.g. for Apache set a htaccess rule: ::
To offer download of those files, use the reserved columnname '_download':`download`_ or variants.
To protect the installation against executing of uploaded malicious script code, deny access for such files: ::
To protect the installation against executing of uploaded malicious script code, disable PHP for the final upload
directory. E.g. `fileadmin`: ::
<Directory "/var/www/html/prod/fileadmin>
<Directory "/var/www/html/fileadmin>
php_admin_flag engine Off
</Directory>
File upload
-----------
By default the mime type of every uploaded file is checked against a whitelist of allowed mime types. The mime type of
a file can be faked by an attacker. This check is good for regular user to upload only allowed file types. To prevent
attacks against malicous code, the execution of files should be denied by the webserver config (`SecureDirectFileAccess`_).
Store
=====
......@@ -2297,6 +2306,10 @@ and will be processed after saving the primary record and before any action Form
* Using the current record id in the `fileDestination`: Using {{r}} is problematic for a 'new' primary record: that
one is still '0' at the time of saving. Use `{{id:R0}}` instead.
* Uploading of malicious code (e.g. PHP files) is hard to detect. The default mime type check can be easily faked
by an attacker. Therefore it's recommended to use a `fileDestination`-directory, which is secured against script
execution (even if the file has been uploaded, the webserver won't execute it) - see `SecureDirectFileAccess`_.
* *slaveId*, *sqlBefore*, *sqlInsert*, *sqlUpdate*, *sqlDelete*, *sqlUpdate*, *sqlAfter*: Only used in :ref:`Upload advanced mode`.
* *fileReplace=always*: If `fileDestination` exist - replace it by the new one.
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment