Secure Development Policy

Secure development policy

Chamilo LMS is arguably one of the most secure LMSes on Earth. This will not be something that can be demonstrated until it reaches the same level of use as, say, Moodle or Blackboard, but you can easily compare the security tracks of all these on sites like http://www.securitytracker.com/ or http://cve.mitre.org/. Not all security reports are assigned a CVE, which means many more issues might have been reported than the ones shown.

A security issues page is available for Chamilo LMS here: Security issues

As a result of increased attacks on the Internet at large, Chamilo LMS has defined a secure development policy that has to be respected by all contributors to Chamilo LMS.

What is filtering?

Filtering means ensuring that no unexpected data enters in any part of the system. Filtering is usually defined as one of the following two methods: validating and sanitizing.

Validation is only making sure the value you get or generate is within a specific scope. For example, making sure it is an integer value, or a boolean value.

Sanitizing goes a step further and tries to transform the value to match certain criterias (for example, if an integer value has to be between 0 and 100 but is 104, sanitizing could mean reducing 104 to 100 so it matches the expected range).

In general terms, validating is absolutely necessary, while sanitizing is not mandatory in most contexts (but can be). Sanitizing usually applies more to a permissions-of-access level, while validation prevents most direct attacks. Given many validation steps occur in Chamilo LMS before accessing data itself, sanitization is generally not necessary, but you have the responsibility to ensure that it isn't before submitting new code or changing existing code, skipping sanitization.

Filtering input

Every content that enters the system (be it database, filesystem or memory) has to be checked for sanity. This is done by applying filters that depend on the expected type of data to be received. Check main/inc/lib/security.lib.php for details on the available filters. If the type of data you are expecting is not filtered by anything in security.lib.php, that doesn't prevent you from your obligation to filter it. Please check http://php.net/filter for more filters.

Filtering output

Every output printed on screen, to a file or to a web service has to be filtered in the corresponding manner. Please use output filters provided by security.lib.php or use http://php.net/filter for more filters.

OWASP

OWASP is an open initiative to improve security on the web. Although the official developers of Chamilo LMS will make sure that all applicable rules are respected by your contributions, you are kindly asked to review the controls of OWASP that apply to your code. See https://www.owasp.org/index.php/Category:Control In particular, we recommend reviewing the following controls that apply directly to the PHP and JS code you will be writing or have already written:

• Authentication
• Authorization
• Audit
• Data Security
• Integrity