Add class for enforcing explicit security instructions in any publicly accessible script #3

New Issue

jrenslin · 2020-11-11T11:28:42+01:00

jrenslin commented

2020-11-11 11:28:42 +01:00

PHP can be locked down dynamically far beyond what we can do on a server / vhost level. In some scripts, this has been done already.
A class, of which one instance is initialized in the bootstrap file and which throws erros in case no security and resource allocation instructions have been specified would improve the general security of the code.

Dynamic enforcing of security-related PHP settings is mainly focused on resource allocation and e.g. file uploads.
See: https://www.php.net/manual/en/function.ini-set.php

PHP can be locked down dynamically far beyond what we can do on a server / vhost level. In some scripts, this has been done already. A class, of which one instance is initialized in the bootstrap file and which throws erros in case no security and resource allocation instructions have been specified would improve the general security of the code. Dynamic enforcing of security-related PHP settings is mainly focused on resource allocation and e.g. file uploads. See: https://www.php.net/manual/en/function.ini-set.php

jrenslin added the

kind/feature

kind/security

priority/medium

labels 2020-11-11 11:28:42 +01:00

jrenslin referenced this issue from a commit

2020-11-12 00:15:11 +01:00

Add static function to propose security settings Close #3, see #4

jrenslin closed this issue

2020-11-12 00:15:11 +01:00

Sign in to join this conversation.