Joomla! Documentation - User contributions [en]

Pizza Bugs and Fun 2

2008-06-19T19:10:15Z

Kdevine: /* North America */

[[Image:pbf.png|right]]
{{RightTOC}}
We eagerly announce the second Joomla! Pizza Bug and Fun event scheduled for the weekends of '''June 21 and 22''' and '''June 28 and 29'''. It's hard to believe that six months have passed since the first Joomla! Pizza Bug and Fun event. The first PBF helped finalize Joomla! 1.5 and, if all goes as planned, this second event will help prepare Joomla! 1.5.4 for release early in July.

This wiki will be used as the central resource for coordinating efforts and accumulating results from this event.

== Goals ==

* '''Bugs''' : For our first PBF event, we targeted priority 1 and 2 bugs and tested the entire application. Since it's release, Joomla! 1.5 has been very stable and there are no serious bugs to fix. But, there are a number of medium priority items that require patches and testing. If we are able to empty the tracker during the weekend, it would be an important accomplishment for the community.

* '''Documentation''' : since the last [[Doc Camp 1|Doc Camp]] a lot of documentation has been written, but we need more of it. If you want to help out writing documentation, you're also more than welcome.

* '''Unit testing''' : we have started writing unit tests for Joomla! This is documented in the wiki, see [[Unit Testing]] for details. This is a very important part to improve the overall quality of Joomla! and increase development speed. If you have experience in this area, we challenge you to come help us.

== FAQ ==
Below you will find as much as possible information we can share on how this events is organized. If you don't find what you are looking for, you can check out the [[PBF FAQ]].

== Organization, logistics and communications ==

Managing this event will be a challenge. The team of [[Pizza couriers]] is working on the organization of this event, taking care of all logistics, infrastructure and communications.

more information will be posted as soon as possible to provide guidance to those who are eager to help

== Locations ==

If you want to get people together and have a venue to share, please add it below. Share as much as possible details like exact location, url for more information about the venue, ways to register, date and time the venue is available etc. If you have any questions regarding this, feel free to contact Wilco Jansen (wilco.jansen@joomla.org).

=== Europe ===
Hotel La Meridiana
Viale Italia 198 - Marina Romea 48010 Ravenna (Ra) Italy
28 June 2008
Additional information [http://www.joomladay.it/ www.joomladay.it]
To register post [http://forum.joomla.it/index.php/topic,44604.0.html here]
[http://www.joomladay.it/component/option,com_contact/task,view/contact_id,1/Itemid,2 Contacts]
------

If you want to add another venue, please enter your location in Europe
here, provide us with:
location and name of the venue, date(s)/time (don't forget the timezone),
url for more info, how to register, contact option

=== North America ===

Webimagery, LLC
843 Carondelet St. Suite 6
New Orleans, LA 70130
USA
[http://jpbf2nola1.eventbrite.com June 21 Registration]
[http://jpbf2nola2.eventbrite.com June 22 Registration]

PICnet, Inc. (DC)
1341 G St, NW, Suite 1100
Washington DC, 20005
[http://www.joomladayusa.org/index.php?option=com_events&type=event&task=details&id=6&Itemid=11 Registration Page]

New York City JUG
Address to be verified shortly
[http://www.joomlanyc.org Joomla NYC Website]
------

If you want to add another venue, please enter your location in North America
here, provide us with:
location and name of the venue, date(s)/time (don't forget the timezone),
url for more info, how to register, contact option

=== South America ===
Please enter your location in South America here, provide us with:
location and name of the venue, date(s)/time (don't forget the timezone),
url for more info, how to register, contact option

=== Asia/Pacific ===

Spike Systems Pty Ltd
Level 6, 99 York Street
Sydney.
Map here: http://tinyurl.com/4gwatl
URL with additional information will follow soon (including registration option).

------
Please enter your location in Asia here, provide us with:
location and name of the venue, date(s)/time (don't forget the timezone),
url for more info, how to register, contact option

=== Africa ===
Please enter your location in Africa here, provide us with:
location and name of the venue, date(s)/time (don't forget the timezone),
url for more info, how to register, contact option

===Cyberspace===
====Internet Relay Chat (IRC)====
Freenode channel [irc://irc.freenode.net/joomlapbf #joomlapbf] from 21 to 22 June 2008, all times, all timezones.

This channel is available now and throughout the event. We might set up additional channels, if we do they will be listed above.

== Registration ==
=== For write access to this wiki ===
To get write access to this wiki you will need to [[Special:Userlogin|register here first]]. Please be aware that the registration process requires a valid email address. If you are traveling to one of the physical locations you are advised to ensure that you have registered on this wiki and have a valid login before you travel. You don't need access to your email account after registration.

=== At a physical location ===
If you wish to be present at one of the physical locations listed above then you must register in advance because space most likely is limited. Registrations are the responsibility of the individual location organizers and you should click on the appropriate link above for more information.

=== Taking bugs, tasks and pizza ===
Pizza can be ordered at a shop near by :-)

Please check the [http://docs.joomla.org/Pizza_Bugs_and_Fun_2#Organization.2C_logistics_and_communications Organization, logistics and communications section] for detail on how to get involved in working on tasks.

==Requirements==
* All code must be made available under the [http://www.gnu.org/licenses/gpl-2.0.html General Public Licence version 2].
* All documentation contributions must be made available under the [[JEDL|Joomla! Electronic Documentation License]]. Further information on the JEDL is available in the [[JEDL/FAQ|JEDL Frequently Asked Questions]]
* No advertising or self-promotion will be allowed. This includes back links to your website or anyone else's. The one exception is that if you have made a contribution then feel free to add your name and an optional link to your website to the [[PBF Contributors List]]
* All contributions must be in English. Note that the official language of the Joomla! project is British/Australian English.
{{:PBF_Contributors_List}}
[[Category: Development]]

Pizza Bugs and Fun 2

2008-06-04T03:12:57Z

Kdevine: /* North America */

[[Image:pbf.png|right]]
{{RightTOC}}
We eagerly announce the second Joomla! Pizza Bug and Fun event scheduled for the weekend of '''June 21 and 22'''. It's hard to believe that six months have passed since the first Joomla! Pizza Bug and Fun event. The first PBF helped finalize Joomla! 1.5 and, if all goes as planned, this second event will help prepare Joomla! 1.5.4 for release early in July.

This wiki will be used as the central resource for coordinating efforts and accumulating results from this event.

== Goals ==

* '''Bugs''' : For our first PBF event, we targeted priority 1 and 2 bugs and tested the entire application. Since it's release, Joomla! 1.5 has been very stable and there are no serious bugs to fix. But, there are a number of medium priority items that require patches and testing. If we are able to empty the tracker during the weekend, it would be an important accomplishment for the community.

* '''Documentation''' : since the last [[Doc Camp 1|Doc Camp]] a lot of documentation has been written, but we need more of it. If you want to help out writing documentation, you're also more than welcome.

* '''Unit testing''' : we have started writing unit tests for Joomla! This is documented in the wiki, see [[Unit Testing]] for details. This is a very important part to improve the overall quality of Joomla! and increase development speed. If you have experience in this area, we challenge you to come help us.

== FAQ ==
Below you will find as much as possible information we can share on how this events is organized. If you don't find what you are looking for, you can check out the [[PBF FAQ]].

== Organization, logistics and communications ==

Managing this event will be a challenge. The team of [[Pizza couriers]] is working on the organization of this event, taking care of all logistics, infrastructure and communications.

more information will be posted as soon as possible to provide guidance to those who are eager to help

== Locations ==

If you want to get people together and have a venue to share, please add it below. Share as much as possible details like exact location, url for more information about the venue, ways to register, date and time the venue is available etc. If you have any questions regarding this, feel free to contact Wilco Jansen (wilco.jansen@joomla.org).

=== Europe ===
Please enter your location in Europe here, provide us with:
location and name of the venue, date(s)/time (don't forget the timezone),
url for more info, how to register, contact option

=== North America ===

Webimagery, LLC
843 Carondelet St. Suite 6
New Orleans, LA 70130
USA
URL with additional information will follow soon (including registration option)

PICnet, Inc. (DC)
1341 G St, NW, Suite 1100
Washington DC, 20005
URL with additional information will follow soon (including registration option)

------

If you want to add another venue, please enter your location in North America
here, provide us with:
location and name of the venue, date(s)/time (don't forget the timezone),
url for more info, how to register, contact option

=== South America ===
Please enter your location in South America here, provide us with:
location and name of the venue, date(s)/time (don't forget the timezone),
url for more info, how to register, contact option

=== Asia ===
Please enter your location in Asia here, provide us with:
location and name of the venue, date(s)/time (don't forget the timezone),
url for more info, how to register, contact option

=== Africa ===
Please enter your location in Africa here, provide us with:
location and name of the venue, date(s)/time (don't forget the timezone),
url for more info, how to register, contact option

===Cyberspace===
====Internet Relay Chat (IRC)====
Freenode channel [irc://irc.freenode.net/joomlapbf #joomlapbf] from 21 to 22 June 2008, all times, all timezones.

This channel is available now and throughout the event. We might set up additional channels, if we do they will be listed above.

== Registration ==
=== For write access to this wiki ===
To get write access to this wiki you will need to [[Special:Userlogin|register here first]]. Please be aware that the registration process requires a valid email address. If you are traveling to one of the physical locations you are advised to ensure that you have registered on this wiki and have a valid login before you travel. You don't need access to your email account after registration.

=== At a physical location ===
If you wish to be present at one of the physical locations listed above then you must register in advance because space most likely is limited. Registrations are the responsibility of the individual location organizers and you should click on the appropriate link above for more information.

=== Taking bugs, tasks and pizza ===
Pizza can be ordered at a shop near by :-)

Please check the [[http://docs.joomla.org/Pizza_Bugs_and_Fun_2#Organization.2C_logistics_and_communications Organization, logistics and communications section]] for detail on how to get involved in working on tasks.

==Requirements==
* All code must be made available under the [[http://www.gnu.org/licenses/gpl-2.0.html General Public Licence version 2]].
* All documentation contributions must be made available under the [[JEDL|Joomla! Electronic Documentation License]]. Further information on the JEDL is available in the [[JEDL/FAQ|JEDL Frequently Asked Questions]]
* No advertising or self-promotion will be allowed. This includes back links to your website or anyone else's. The one exception is that if you have made a contribution then feel free to add your name and an optional link to your website to the [[PBF Contributors List]]
* All contributions must be in English. Note that the official language of the Joomla! project is British/Australian English.
{{:PBF_Contributors_List}}
[[Category: Development]]

How to add CSRF anti-spoofing to forms

2008-01-25T14:52:34Z

Kdevine:

== What is a CSRF Attack? ==

A Cross Site Request Forgery ([[Wikipedia:Cross-site_request_forgery WikiPedia|CSRF]]) attack relies on the trust a website has for a user to execute unauthorized requests and or transactions. For example, say a user is logged into their Joomla! websites' administrator interface in one tab and is browsing a compromised site in another tab. A simple CSRF attack can be launched simply by tampering with IMG elements in some browsers so that they point to something like
<nowiki>http://some/joomla/site/administrator/index2.php?option=com_users&task=delete...</nowiki>
When the user browses the compromised site, that image will be requested and because the user is currently logged in to the administrator interface of her Joomla! site, the forged request will be positively authenticated and executed. To prevent simple CSRF attacks like the one above, request tokens have been added to all forms in the front-end and back-end Joomla! interfaces. The tokens are randomized strings that are used to authenticate that the request being made is coming from a valid form and a valid session. This simple measure is very effective at preventing a large percentage of potential CSRF attacks, however, due to the nature of CSRF they are extremely difficult, if not impossible, to secure against completely.

== Protecting Against CSRF Attakcs ==

Joomla! attempts to protect againt CSRF by inserting a random string called a token into each POST form and each GET query string that is able to modify something in the Joomla! system. This random string provides protection because not only does the compromised site need to know the URL of the target site and a valid request format for the target site, it also must know the random string which changes for each session and each user.

The {{jf}} makes it easy for you to include such protection in your components as well. This is simple to implement in both POST and GET requests.

=== POST Request ===

POST requests are submitted in HTML using forms. In order to add the token to your form, add the following line inside your form:
<?php echo JHTML::_( 'form.token' ); ?>

This will output something like the following:
<input type="hidden" name="1234567890abcdef1234567890abcdef" value="1" />

=== GET Request ===

GET requests are submitted in HTML using query strings. In order to add the token to your query string, use a URL like:
<?php
echo JRoute::_( 'index.php?option=com_example&controller=object1&task=save&'. JUtility::getToken() .'=1' );
?>

This will generate a URL with the token in the query string.

=== Checking the Token ===

Once you have included the token in your form or in your query string, you must check the token '''before your script carries out the request'''. This is done with the following line:
JRequest::checkToken() or die( 'Invalid Token' );

If the request is coming from the query string, you must specify this. The code then becomes:
JRequest::checkToken( 'get' ) or die( 'Invalid Token' );

== Recommended Security Procedures ==

While these methods help to prevent against these types of attacks, it is important to realize that as a system administrator, there are good security practices to follow which will prevent a site from being compromised.

# Don't browse other sites in the same browser while you are logged into your site.
# Log out from your site after you are done.
# Don't stay logged into your site while you are not doing anything.
# Ensure that the address in the browser bar matches the address of your site.

By practicing these safe surfing habits you will eliminate most threats to your web site.

[[Category:Security]]