Featured Sites: A-Z Index

H

Composr CMS: Your Data, Your Privacy, Your Control - Composr CMS: Your Data, Your Privacy, Your ControlComposr CMS: Your Data, Your…

Composr CMS: Your Data, Your Privacy, Your Control - Composr CMS: Your Data, Your Privacy, Your Control

Earth & Sky

Earth & Sky

Legends of Nor'Ova

Legends of Nor'Ova

PDStig, LLC

PDStig, LLC

Super Tilted

Super Tilted

Saving Wallden

Saving Wallden

Newest 10 Entries

Question What steps should I take if my website has been hacked?
Answer If you suspect a security breach, take immediate action:
  • Identify the Cause: Analyze access logs for suspicious activity and pinpoint the vulnerability.
  • Clean and Restore: Restore your website from a clean backup and thoroughly remove any malicious code.
  • Address Vulnerabilities: Patch security holes, update software, and strengthen security configurations.
  • Seek Expert Help: If needed, consult security professionals for assistance with cleanup and prevention.

View

Question What additional security measures can I implement for my Composr website?
Answer
  • SSL: Enable HTTPS for encrypted communication and improved user trust.
  • Secure Zones: Configure sensitive zones to require confirmed sessions.
  • Restrict Logins: Enforce IP address confirmation for enhanced account security.
  • Maintenance Scripts: Restrict access to maintenance scripts like upgrader.php via IP restrictions.
  • Server Hardening: Disable unnecessary services, change default ports, enable automatic updates, and more.
  • Robots.txt: Use the robots.txt file to prevent search engine indexing of sensitive areas.

View

Question How does Content Security Policy (CSP) contribute to Composr security?
Answer CSP adds a layer of protection by controlling the resources the browser is allowed to load. It helps prevent:
  • XSS Attacks: By restricting inline scripts and limiting script sources.
  • Data Injection Attacks: By controlling the allowed origins for data requests.
  • Clickjacking: By specifying allowed framing sources.

Composr's CSP implementation utilizes "Trusted partner sites" and nonces for fine-grained control.

View

Question What is the purpose of "confirmed" and "non-confirmed" sessions?
Answer Composr distinguishes between confirmed and non-confirmed sessions for added security:
  • Confirmed: When you actively log in with your credentials.
  • Non-confirmed: When you return to the site and are automatically logged in via cookies.

You can configure zones to require confirmed sessions, preventing access from cookie-based logins alone. The Admin Zone uses this by default.

View

Question How can I enhance the security of my Composr installation on shared hosting?
Answer Shared hosting environments can be inherently less secure. Here are some tips:
  • Choose a Secure Host: Opt for hosts that offer suEXEC and open_basedir for better account isolation.
  • Test Security: Verify the host's security measures with the provided filesystem_browser.php script.
  • Restrict _config.php: Remove world-writable permissions from _config.php after installation.

View

Question How does Composr protect against Cross-Site Scripting (XSS) attacks?
Answer Composr utilizes multiple layers of defense against XSS attacks:
  • HTML Filtering: Configurable levels of filtering prevent malicious script injection.
  • Content Security Policy (CSP): Restricts the sources from which scripts and other resources can be loaded.
  • Input Sanitization: Data is sanitized before being processed to prevent malicious code execution.
  • Output Encoding: Data displayed to users is properly encoded to prevent interpretation as active code.

View

Question What are the different types of security alerts in Composr?
Answer Composr has a variety of hack-attack codenames that trigger security alerts and logging. Some common examples include:
  • DODGY_GET_HACK: Suspicious URLs with potentially harmful characters.
  • EVIL_POSTED_FORM_HACK: Possible CSRF attempts via malicious form submissions.
  • SCRIPT_UPLOAD_HACK: Attempts to upload PHP scripts, potentially malicious.
  • DOWNLOAD_PRIVATE_URL_HACK/TRY_TO_DOWNLOAD_SCRIPT: Attempts to download sensitive files.
  • BRUTEFORCE_LOGIN_HACK: Repeated failed login attempts.
  • SQL_INJECTION_HACK: Attempts to exploit SQL queries for data extraction.

You can customize alert handling for each type in data_custom/xml_config/advanced_banning.xml (Admin Zone > Security > Configure advanced banning).

View

Question What are some tips for secure website maintenance?
Answer
  • Avoid FTP: Use secure alternatives like SFTP or SSH for file transfer.
  • Secure Email: Enable SSL for IMAP and POP3 email protocols.
  • Strong Passwords: Use unique and complex passwords for different services.
  • Secure Computers: Keep your own devices patched and secure.
  • Maintenance Password: Remove the maintenance password from _config.php when not in use.

View

Question What are the main security features of Composr?
Answer Composr has a robust set of security features to protect your website, including:

Passwords:
  • Visual representation of password quality and enforcement of complexity rules.
  • Password expiry and prevention of re-use.
  • Secure password hashing, even if the database is compromised.
  • Temporary passwords for staff setup.

Login Restrictions:
  • Two-factor authentication via IP address approval.
  • IP address banning, including wildcard banning.
  • Session locking to IP addresses.
  • Configurable session expiry times.
  • Ability to prevent privileged actions from auto-logged in sessions.
  • Optional member approval process.

Auditing Systems:
  • Comprehensive audit logging of administrative actions.
  • Logging of user actions and IP address history.
  • Tools to analyze audit logs.
  • Failed login logging.
  • Hack attack detection, logging, and banning.
  • Email notifications for changes to user credentials.

Framework Security:
  • Protection against CSRF attacks.
  • Click-jacking prevention via CSP implementation.
  • Secure coding standards and scanning techniques.
  • Configurable HTML filtering to prevent XSS attacks.
  • Secure code modularization standards.

Other features:
  • Granular privileges and access permissions.
  • Content submission validation process.
  • Rootkit detection system.
  • Spam prevention systems.
  • Web application firewall rules.
  • Moderation systems.

View

Question Why are my searches slow, and how can I improve search speed?
Answer Slow searches can occur when dealing with large amounts of content. Here are some workarounds and solutions:
  • MySQL timeout setting: For MySQL 5.7+, set a query timeout to prevent searches from locking up your database. Composr automatically sets this, but you can configure it manually if needed.
  • Use InnoDB tables: Switching to InnoDB tables in MySQL can prevent slow queries from affecting other users on your website. Note that InnoDB is not officially supported by Composr yet.
  • Enable the fast custom index: As mentioned earlier, the fast custom index is optimized for handling large datasets and filtered searches, potentially leading to significant speed improvements.

View

Top 10 Entries

Question How do I set up Composr Mobile SDK in my iOS and Android projects?
Answer iOS (Xcode):
  • Create a new project or open an existing one.
  • Add a Prefix Header file (.pch) if you don't have one, following the provided instructions.
  • Add required frameworks to your project's Build Phases.
  • Add the CMS SDK to your project, then remove references to unwanted files.
  • Set the header search path to the CMS SDK folder in build settings.
  • Add a compiler option for the JsonKit library.
  • Import CMS_SDK.h in your .pch file.

Android (Eclipse):
  • Create a new project or open an existing one.
  • Import CMS SDK into your workspace as an Android project.
  • Ensure "Is Library" is checked in the CMS SDK's "Android" properties tab.
  • Add CMS SDK as a dependent library in your project's properties.
  • Clean and rebuild your project.

View

Question What are some key concepts related to mobile app development with Composr?
Answer Essential concepts include:
  • SDK (Software Development Kit): An API implementation, typically as a library.
  • API (Application Programming Interface): A set of rules for software interaction.
  • JSON (JavaScript Object Notation): A common language for structured data transfer over REST.
  • REST (Representational State Transfer): An architectural style for web services.
  • Push notification: A notification sent to a mobile device.

View

Question What other approaches exist for mobile integration with Composr?
Answer Other approaches, in various stages of development, include:
  • Tapatalk: A third-party forum app with an official Composr addon, offering a high-quality "out-of-the-box" Composr app experience.
  • Further Composr Mobile SDK development: Plans and issues relating to the SDK's evolution can be found on the Composr tracker, driven by commercial projects and feature sponsorship.

View

Question What are some of the default endpoints available in the server-side API?
Answer Default endpoints cover various functionalities, including:
  • Account: join, login, lost_password, setup_push_notifications
  • Misc: contact_us
  • Content: commandr_fs

Specific details on parameters and response data for each endpoint can be found in the documentation.

View

Question How does authentication work with the server-side API?
Answer Authentication is handled automatically using cookies, similar to regular website requests. If cookies are not feasible, the response parameters device_auth_member_id_cn/device_auth_pass_hashed_cn/device_auth_member_id_vl/device_auth_pass_hashed_vl from the login endpoint can be resent as POST parameters in subsequent requests.

View

Question How do I access the server-side API for my mobile app?
Answer The server-side API can be accessed via HTTP calls to http://yourbaseurl/data/endpoint.php. Results are returned in JSON format. The API utilizes endpoints with a 'hook' name and a 'hook type' categorization. Both REST-style and GET-parameter style requests are supported, with the latter recommended for simplicity.

View

Question What is the purpose of the Composr Mobile SDK Toolkit?
Answer The Toolkit, part of the composr_mobile_sdk addon, aids in mirroring Composr website resources into a mobile app. It includes tools for generating iOS/Android string resources from language files and exporting theme images in a directory structure suitable for iOS/Android app image assets.

View

Question How can I obtain Composr Mobile SDK?
Answer The iOS/Android SDK can be found on GitLab at: Composr ecosystem / Composr Mobile SDK · GitLab.

To connect to a Composr site, you will need to install the composr_mobile_sdk addon, which is not bundled. This addon provides scripting to generate app assets from the Composr site.

View

Question What is Composr Mobile SDK?
Answer Composr Mobile SDK (CMS SDK) is a toolkit designed for experienced iOS and Android developers to build mobile apps that integrate with a Composr-powered website. It offers both Composr-specific integrations and a collection of standalone utilities for building apps, providing a common base between iOS and Android akin to the PHP and Composr APIs, enabling easier code porting while maintaining a native experience.

View

Question What is the Composr maintenance policy?
Answer Composr follows a rolling release model. This means:
  • New major/minor versions are released as they are ready.
  • Patch releases, primarily containing bug fixes, are only released for the latest supported major/minor version branch.
Users are responsible for staying updated to the latest release or applying necessary hotfixes.

This policy allows developers to focus resources on the latest versions and encourages users to leverage the ongoing improvements. You can find the release status on the Composr maintenance status page.

View