<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Me and Lukas have created a page with common security
recommendations
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
<a
href="http://doc.owncloud.org/server/5.0/developer_manual/general/security.html">http://doc.owncloud.org/server/5.0/developer_manual/general/security.html</a><br>
<br>
Feel free to contribute/fix mistakes and please audit your apps!<br>
<br>
Most annoying problem with most apps is that security checks are
deliberately not included if they are not absolutely required. This
makes it incredibly hard to audit and review your apps for security
and poses a potential risk for future code changes. <br>
<br>
In general: Enforce every *possible* security measure which does not
break the app (always check for logged in and CSRF ->
callRegistered(), always escape JS even when its output from t() ).
<br>
<br>
If its not possible to do CSRF checks or other checks, check twice.
Maybe you dont split public/private functionality code properly.<br>
<br>
cheers<br>
<br>
Bernhard Posselt<br>
<br>
<br>
</body>
</html>