forks/baikal
1
0
Fork 0
Code Releases Activity

Improve application security

Browse source 
- Make session cookies only available via HTTP (prevent access from JavaScript)
- only log PHP errors instead of displaying them in production.
  Displaying errors may give attackers hints how to exploit the application

Set HTTP headers:

X-Frame-Options: DENY
Prevent Clickjacking attacks, see: http://en.wikipedia.org/wiki/Clickjacking

X-Content-Type-Options: nosniff
Prevent code injection via mime type sniffing
This commit is contained in:
Frederic Hemberger 2014-01-21 16:14:47 +01:00
parent 58c58c0817
commit 4ca925874c
5 changed files with 18 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
Core/Frameworks/Baikal/WWWRoot/cal.php
View file

@ -24,6 +24,10 @@
* This copyright notice MUST APPEAR in all copies of the script!
***************************************************************/
ini_set("session.cookie_httponly", 1);
ini_set("display_errors", 0);
ini_set("log_errors", 1);
define("BAIKAL_CONTEXT", TRUE);
define("PROJECT_CONTEXT_BASEURI", "/");

5
Core/Frameworks/Baikal/WWWRoot/index.php
View file

@ -23,6 +23,11 @@
*
* This copyright notice MUST APPEAR in all copies of the script!
***************************************************************/
ini_set("session.cookie_httponly", 1);
ini_set("display_errors", 0);
ini_set("log_errors", 1);
define("BAIKAL_CONTEXT", TRUE);
define("PROJECT_CONTEXT_BASEURI", "/");

4
Core/Frameworks/BaikalAdmin/WWWRoot/index.php
View file

@ -24,7 +24,9 @@
* This copyright notice MUST APPEAR in all copies of the script!
***************************************************************/
ini_set("display_errors", 1);
ini_set("session.cookie_httponly", 1);
ini_set("display_errors", 0);
ini_set("log_errors", 1);
error_reporting(E_ALL);
define("BAIKAL_CONTEXT", TRUE);

4
Core/Frameworks/BaikalAdmin/WWWRoot/install/index.php
View file

@ -24,7 +24,9 @@
* This copyright notice MUST APPEAR in all copies of the script!
***************************************************************/
ini_set("display_errors", 1);
ini_set("session.cookie_httponly", 1);
ini_set("display_errors", 0);
ini_set("log_errors", 1);
error_reporting(E_ALL);
define("BAIKAL_CONTEXT", TRUE);

3
Core/Frameworks/Flake/Controller/Page.php
View file

@ -73,6 +73,9 @@ class Page extends \Flake\Core\Render\Container {
public function injectHTTPHeaders() {
header("Content-Type: text/html; charset=UTF-8");
header("X-Frame-Options: DENY"); # Prevent Clickjacking attacks
header("X-Content-Type-Options: nosniff"); # Prevent code injection via mime type sniffing
}
public function render() {