Олег Давидович: 1 версия импортирована

2024-10-21T08:53:11Z

1 версия импортирована

← Предыдущая версия	Версия от 08:53, 21 октября 2024
(нет различий)

1>TimHunt: New page: This page forms part of the Moodle security guidelines. ==What is the danger?== This is more a symptom or other vulnerabilities, than a vulnerability in its own ...

2009-11-06T15:42:14Z

New page: This page forms part of the Moodle security guidelines. ==What is the danger?== This is more a symptom or other vulnerabilities, than a vulnerability in its own ...

Новая страница

This page forms part of the [[Development:Security|Moodle security guidelines]].

==What is the danger?==

This is more a symptom or other vulnerabilities, than a vulnerability in its own right.

For example, Evil Hacker can use cross-site request forgery or SQL injection to maliciously destroy lots of your data. Or the fact that someone has permission to destroy a lot of data may indicate that the code is not performing sufficient authorisation checks.

However, it is also possible for users to accidentally destroy lots of data if the user-interface is badly designed and confusing.

==How Moodle avoids this problem==

We write secure code so that data cannot be destroyed maliciously.

We try to design clear interfaces, so that users understand the effects of their actions.

==What you need to do in your code==

* Actions that destroy a significant amount of data should have a confirmation step.
** Capabilities that let people destroy a lot of information should have RISK_DATALOSS.
* Follow the guidelines for avoiding
** [[Development:Security:Unauthorised access|Unauthorised access]]
** [[Development:Security:Cross-site_request_forgery|Cross-site request forgery]] (XSRF)
** [[Development:Security:SQL injection|SQL injection]]
** [[Development:Security:Command-line injection|Command-line injection]]
** and so on.

==What you need to do as an administrator==

* Be careful!

==See also==

* [[Development:Security]]
* [[Development:Coding]]

{{CategoryDeveloper}}
[[Category:Security]]

Development:Security:Data-loss - История изменений

Олег Давидович: 1 версия импортирована

1>TimHunt: New page: This page forms part of the Moodle security guidelines. ==What is the danger?== This is more a symptom or other vulnerabilities, than a vulnerability in its own ...