khanh.pndc/nextcloud-docs
1
0
Fork 0
mirror of https://github.com/nextcloud/documentation.git synced 2026-01-04 02:36:49 +07:00
Code Issues Packages Projects Releases Wiki Activity

fix some dev docs

Browse Source
This commit is contained in:
Bernhard Posselt
2014-05-22 19:34:59 +02:00
parent 7866306e3c
commit 0ad6088262
1 changed files with 4 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
developer_manual/general/security.rst
View File

@@ -67,8 +67,6 @@ To prevent XSS in your app, **never use echo, print() or <\%=** - use **p()** in
.. note:: Should you ever require to print something unescaped, double check if it is really needed. If there is no other way (e.g. when including of subtemplates) use `print_unescaped` with care.
If you use the App Framework with Twig templates everything is already escaped by default.
JavaScript
~~~~~~~~~~
@@ -107,7 +105,7 @@ Clickjacking
To prevent such attacks ownCloud sends the `X-Frame-Options` header to all template responses. Don't remove this header if you don't really need it!
This is already built into ownCloud if :php:class:`OC_Template` or Twig Templatse are used.
This is already built into ownCloud if :php:class:`OC_Template`.
Code executions / File inclusions
---------------------------------
@@ -198,9 +196,9 @@ Auth bypass/privilege escalations happens when a user is able to perform not aut
ownCloud offers three simple checks:
* **OCP\JSON::checkLoggedIn()**: Checks if the logged in user is logged in
* **OCP\JSON::checkAdminUser()**: Checks if the logged in user has admin privileges
* **OCP\JSON::checkSubAdminUser()**: Checks if the logged in user has group admin privileges
* **OCP\\JSON::checkLoggedIn()**: Checks if the logged in user is logged in
* **OCP\\JSON::checkAdminUser()**: Checks if the logged in user has admin privileges
* **OCP\\JSON::checkSubAdminUser()**: Checks if the logged in user has group admin privileges
Using the App Framework, these checks are already automatically performed for each request and have to be explicitely turned off by using annotations above your controller method, see :doc:`../app/controllers`.