Hello Babynus,
I noticed a Ticket#1201 mentioning some improvements against vulenrabilities.
If it helps, I had someone here take a look at what could be improved, and this is what he came up with:
- SQL injection attacks --> treated in ticket#1201
- XSS attacks --> treated in ticket#1201
- CSRF attacks --> maybe also included in ticket#1201 ?
- Restricting execution of uploaded files (e.g. php files)
- Encryption of transmitted logins/passwords
In any case, thanks for the coming improvements! (can't wait to see what V4 looks like, by the way... :cheer: )
Hi,
Security leaks have been fixed corresponding to some identified threats.
If you have some examples of leaks, please send then to support@toolware.fr.
I'll check if they are all fixed in V4.0.
About restricting execution of uploaded files (e.g. php files), this leak can only be solved by configuration, corresponding to recommandations : setup files attachment directories (for attachments, documents) out of php scope.
Encryption of login/passwords : password is already encrypted.
Best way to straighten this is to set application in ssl (https).