E.Noorlander
cd498c8c3a
- Reorganize admin into admin/theme/default/ (views + assets) - Rename GuideNav to Navigation plugin (essential, protected) - Plugin assets support (SCSS/CSS) loaded after theme CSS - User roles: Admin, Content Manager, BI Manager, Site Admin - Role-based access control (RBAC) for admin routes and sidebar - Guide restructure: sub-topics in separate folders with sidebar nav - Dynamic breadcrumb for homepage and subdirectories - Fix theme path traversal (../../ -> ../) in admin.php - Fix CodeMirror mode load order (xml -> css -> js -> htmlmixed -> php) - Fix editor-toolbar.js null checks for plugin edit pages - Layout select from theme.json with live frontmatter update - Footer sticky at bottom of viewport (min-height: 100vh) - Breadcrumb color fix (var(--nav-font) -> var(--header-bg)) - Remove language switcher from guide pages - Update README.md and README.en.md - Bump version to 2.5.1
34 lines
561 B
Markdown
34 lines
561 B
Markdown
# Beveiliging
|
|
|
|
## XSS preventie
|
|
|
|
```php
|
|
// Altijd escapen
|
|
echo htmlspecialchars($userInput, ENT_QUOTES, 'UTF-8');
|
|
|
|
// In Twig (automatisch)
|
|
{{ userVariable }}
|
|
```
|
|
|
|
## CSRF tokens
|
|
|
|
```php
|
|
// Genereren
|
|
$csrf = $auth->getCsrfToken();
|
|
|
|
// Verifiëren
|
|
if (!$auth->verifyCsrf($_POST['csrf_token'])) {
|
|
die('Ongeldige CSRF token');
|
|
}
|
|
```
|
|
|
|
## Path traversal preventie
|
|
|
|
```php
|
|
// Gebruik realpath() en check prefix
|
|
$realPath = realpath($filePath);
|
|
$realContentDir = realpath($contentDir);
|
|
if (strpos($realPath, $realContentDir) !== 0) {
|
|
die('Ongeldig pad');
|
|
}
|
|
``` |