Coding/Development Mandatories - Revision history

Joachim Kammer: /* Datasheet */

2019-02-13T11:11:01Z

Datasheet

← Older revision		Revision as of 11:11, 13 February 2019
Line 172:		Line 172:
	{Anschreiben}		{Anschreiben}

	Ticket-System (~~Redmine~~)		Ticket-System (asana)
	URL ~~http~~://~~redmine.parasol-island~~.com/		URL https://asana.com/
	Login {Your ~~login name}~~		Login {Your Google-Suite-Login}
	~~Password: {Was send to you upon account creation~~}

	Repository		Repository

David Smith at 11:00, 3 November 2016

2016-11-03T11:00:55Z

New page

=Development Rules & Regulations=
The following document contains rules and regulations, which are entirely mandatory for all Parasol Island projects containing web/software development.

= For Project Managers =

==== Hold a kick-off meeting for every project ====
Every single project must begin with a technical kick-off before any development work can begin. The sole aim of the kick-off meeting with {{:Mitarbeiter:Development_Supervision}} is to align your development plan with the expectations of Parasol Island.

Topics that can/will be discussed include:
# Repository
# Web Hosting
# Required features (e.g. database export functionality, project monitoring etc.)
# Any questions that you may wish to ask
Please remember that David is here to support you with your project in regards to all development-related aspects. Therefore, if you have even the smallest question, please feel free to contact him directly and he will be more than happy to help you.

==== Read the following (incredibly helpful) page ====
As a project manager, you are not expected to be a world-class developer. However, knowing a few details regarding your developer's work is incredibly beneficial for yourself, your project and for Parasol Island. Therefore, you should give this page a read: https://wiki.parasol-island.com/Web_Development_Best_Practice_A-Z

Again, if you have any questions at all regarding any of the topics discussed on the aforementioned page, please do not hesitate to contact David Smith and he will be more than happy to help clear up any misunderstandings.

==== Send your developer a copy of this article ====
Before you brief your developer, make sure that you have already sent them a copy of this article; quickly create a PDF from this page (via File > Print > Save as PDF) and send it over to them so that, in the event of your developer having questions or queries, you can identify and answer these during your first briefing meeting.

Please note that this article is set to be updated on a regular basis. Therefore, you should endeavour to create a new PDF from this page before each of your projects start.

= For Developers =

==Security Basics==
In order to ensure that each project is planned, developed and executed in a safe and secure manner, the following basic rules '''must be''' adhered to:

==== Databases ====
When working with live databases (which contain real user information), it is forbidden to take a full or partial database dump (temporary or permanent) and to store it on a non-Parasol Island machine. No traces of real user data can ever be found on your local machines or servers.

All databases containing personally identifiable user information must be encrypted using a sufficient encryption method with an encryption key of at least 128-bits. Such key should never be stored in a publicly available location or on any Non-Parasol Island machine.

It should never be possible to decrypt a password back into clear-text.

==== Runtime / Execution Times ====
It should never be possible for a user to directly control the execution of your script(s); be it in terms of controlling the number of iterations a loop makes or in terms of the number of files permitted to be uploaded.

For example, all loops must be entirely under your control at all times and should utilise pagination where possible. Take the following as a perfect example of how not to handle posted data:
$userData = array();

foreach ($_POST as $thisIndex => $thisValue) {
$userData[] = $thisValue;
}

echo $userData['firstName'];
Instead, you should opt to handle each posted value like so:
$expectedFields = array(
'firstName',
'lastName',
'emailAddress'
);

$userData = array();

foreach ($expectedFields as $thisExpectedField) {

if (isset($_POST[$thisExpectedField])) {

$userData[$thisExpectedField] = filter_var(trim(strip_tags($_POST[$thisExpectedField])),FILTER_SANITIZE_STRING);

} else {

$userData[$thisExpectedField] = null;
}
}

echo $userData['firstName'];
By handling only the fields that you should be expecting, you will be instantly improving both the security and performance of your code.

==== Repositories ====
Only Parasol Island-owned repositories are permitted. Absolutely no project code is permitted to be stored on any external repository service; be it your own internal repository server or a professional repository service.

You will be provided with a repository during your project’s kick-off before which you must provide Parasol Island with a copy of your public certificate (also known as public key, SSH key etc.). Please send your key to David Smith (david.smith@parasol-island.com) and your project manager.

Your local copy of the project (on your local machines) '''must''' be securely deleted within 7 days of your final invoice being paid.

You must commit your local code into the repository on a milestone-basis. This means that when a particular component or feature is complete, you must commit the relevant code into the repository. It is forbidden to simply push a single commit at the end of the project.

In order to ensure consistency and to minimise conflicts and confusion, please use the following naming convention for local URLs:

http://[PROJECT_IDENTIFIER].local --> http://penny16_int25.local

==== Servers ====
Only Parasol Island-owned servers are permitted. It is forbidden to upload project code to any other publicly accessible server.

Your project code must be written in a language that can be executed on a standard Linux server without any special or bespoke software (unless agreed during your project kick-off). Recommended languages and technologies include:
* PHP5.5 or later
* MySQL
* Nginx / Apache (nginx is preferred over Apache)
If one or more of your scripts unavoidably requires a considerable amount of time to execute, it is your responsibility to perform sufficient testing before the project goes live to ensure that your script(s) do not negatively affect the performance of the server.

==== Preview Servers ====
For each project, you must use the Parasol Island-owned preview server that is provided to you during your project kick-off. Hosting project code on any other server apart from Parasol Island’s preview and live servers is strictly prohibited.

==== Cross-Site Scripting (XSS / CSRF) ====
You must take every precaution to protect your project code from being abused/misused by XSS attacks and you must sufficiently test your code before the project goes live.

One of the most important precautions to take is to integrate a Cross-Site Request Forgery token into all user-centric/database-centric/file system-centric actions. It is mandatory for any project with such user/database/file system-centric actions to be protected against CSRF attacks.

==== Sanitisation of User Input ====
All user-inputted data '''must''' be sanitised before being handled. Additionally, you must always be very selective with which data you consider as being acceptable.

For example, if the field is containing a user’s date of birth, you should only accept a value following the pattern of DD.MM.YYYY. If you find anything else in the value, you should instantly reject the input without any further handling. Similarly, with a gender field, you must only accept two very specific values; male or female.

Naturally, all user input must be stripped of any tags unless the field is HTML-centric (e.g. with the HTML content of a CMS page).

==== HTTPS / SSL ====
If available, you must always proactively use secured connections for your project. If an SSL certificate is unavailable, please discuss this in your project kick-off as it is very unlikely for this to be the case.

==== Authorship ====
All author notes must be attributed to Parasol Island. You may mention your first and last name, however your personal/business details must never be visible in a repository or on a server.

Similarly, all commits in a repository must not contain your personal/business details and should adhere to the following pattern:

[FIRST_NAME] [LAST_NAME] <FIRST_NAME.LAST_NAME@parasol-island.com>

==== Open Source Rules ====
Only open source (meaning free and no special license needed) plugins, libraries and other dependencies are permitted to be included within project code. Any premium (not free) dependency must be provided to Parasol at no cost and be already confirmed with the PM beforehand. Any future updates to the dependency must be provided to Parasol by means of sharing the access credentials.

* When working with live databases (containing real user information), it is forbidden to take a database dump and to run it locally on your machine. No traces of real user data should ever be found on local developer machines.
* It should never be possible for a user to control the execution time of your script. For example, all loops must be entirely under control and should utilize pagination where possible. The number of iteractions that a loop is to perform must never be controllable by the user.
* Only Parasol Island-owned repositories are permitted to be used. It is forbidden to use any external repository services for Parasol Island projects.
* Only Parasol Island-owned servers are permitted to be used. It is forbidden to use any other server to host Parasol Island projects.
* If a backend script takes a considerable amount of time to run and the default PHP max execution time must be increased, the FMA must test for any detrimental server behaviour.

==== Captcha ====
{{:Recaptcha}}

=Verantwortlichkeiten (Kontrollpflicht)=
==Inhaltliche Verantwortung==
Die inhaltliche Verantwortung liegt beim projektverantwortlichen Projektmanager. Er erstellt das inhaltliche Projekt-Briefing (Ziel: vollständiges Abbild aller projektbezogenen Erwartungen) Das Briefing enthält in der Regel ein technisches Konzept, ein Design-Konzept sowie ein Projekt-Timing
Der Projektmanager ist ebenfalls verantwortlich für die Frontend-bezogenen Testings (inhaltliche und benutzerführende Vollständigkeit)
==Technische Verantwortung==
Die technische Verantwortung liegt beim Head of Development ({{:Mitarbeiter:Development_Supervision}}). Er übermittelt die technischen Anforderungen, die das Projekt erfordern. David ist ebenfalls für die dafür notwendige technische Infrastruktur verantwortlich.

Der Head of Development überprüft die technische Qualität des Developers und unterstützt den Projektmanager in allen technischen Belangen auch in der Testphase.

=IT- Infrastruktur und Kommunikationswege=
==Ausschliesslich unser Remote-Repository nutzen (FMA)==
There is a Parasol Hosted GIT Repository for every Project. Ask your Producer for the url and credentials. It is mandatory to use our git repository and it’s strictly forbidden to use other repositories exept your local copy.

==Personifizierte Schlüssel für Zugriff auf Repository und Serversysteme (PSL)==
To gain you access to our repository or servers, please provide your private SSH key to David and your Producer
==local Copy nach x-Monaten nach Projektabschluss löschen (FMA)==
Your local git copy must be deleted in the week your final invoice is payed.
==Richtline für PW und Schlüssel im Soucecode (PSL entw. Einhalten, Umsetzen FMA)==
https://wiki.parasol-island.com/Passw%C3%B6rter#Passwortsicherheit
==Daily commits im Entwicklungszeitraum==
It is mandatory to commit your sourcecode with every milestone, at least once a day to the Parasol Island remote repository.
==Entwicklung / Daten dürfen nur auf PSL-Systemen oder beim FMA lokal gespeichert sein (PW-Schutz)==
It is not alowed to store data on any other machines than your local computer or a Parasol Island system.
==LogIn & PW immer auf getrennten Kommunikationswegen übertragen (FMA/PSL)==
https://wiki.parasol-island.com/Datenverarbeitung_durch_Parasol_Island
==Kommunikationswege; nur verschlüsselte eMails? (StartTLS)==
=Datenschutz=
==Verfahren und involvierte IT-Systeme==
Developer dürfen keinen Zugriff bekommen auf personenbezogene Daten
==Gewährleistung der Rechte der Betroffenen==
==Technische und organisatorische Maßnahmen==
=Organisation bei PSL=
=Kennwortverwaltung=
=Kryptographie und Schlüsselmanagement=
Schlüsselkomplexität mitgeben (PSL an FMA)

=Datasheet=
Email your developer everything he needs:

{Anschreiben}

Ticket-System (Redmine)
URL http://redmine.parasol-island.com/
Login {Your login name}
Password: {Was send to you upon account creation}

Repository
URL ssh://git@git.parasol-island.com/REPONAME
User git

Dev URL and credentials (It’s recommended to use the same DB name and user) are in Redmine as a Ticket (“Preview URL and Login credentials”)

Deploy
The “develop” Branch will be automatically deployed to the dev url (http://URL.preview.parasol-island.com).

David Smith at 14:49, 11 February 2016

2016-02-11T14:49:17Z

@@ Line 122: / Line 122: @@
 * Only Parasol Island-owned servers are permitted to be used. It is forbidden to use any other server to host Parasol Island projects.
 * If a backend script takes a considerable amount of time to run and the default PHP max execution time must be increased, the FMA must test for any detrimental server behaviour.
 =Verantwortlichkeiten (Kontrollpflicht)=

David Smith at 11:02, 11 February 2016

2016-02-11T11:02:57Z

← Older revision		Revision as of 11:02, 11 February 2016
Line 130:		Line 130:
	==Cross-Site Scripting (XSS)==		==Cross-Site Scripting (XSS)==
	* A CSRF (cross-site request forgery) token must be generated upon the user’s first visit to the website and must be stored in their session. All user actions that interact with a database or file system must be authenticated by comparing the session CSRF token and the token provided in the request.		* A CSRF (cross-site request forgery) token must be generated upon the user’s first visit to the website and must be stored in their session. All user actions that interact with a database or file system must be authenticated by comparing the session CSRF token and the token provided in the request.
	==~~Sanatising~~==		==Sanitisation==
	* Cleaning any user-provided variables to be as specific as possible. For example, if the field is the DOB, only accept numerical digits in the format of DD.MM.YYYY.		* Cleaning any user-provided variables to be as specific as possible. For example, if the field is the DOB, only accept numerical digits in the format of DD.MM.YYYY.
	* Be selective in the acceptable values		* Be selective in the acceptable values

David Smith at 09:49, 11 February 2016

2016-02-11T09:49:34Z

@@ Line 70: / Line 70: @@
   echo $userData['firstName'];
 By handling only the fields that you should be expecting, you will be instantly improving both the security and performance of your code.
 * When working with live databases (containing real user information), it is forbidden to take a database dump and to run it locally on your machine. No traces of real user data should ever be found on local developer machines.

David Smith at 09:43, 11 February 2016

2016-02-11T09:43:33Z

← Older revision		Revision as of 09:43, 11 February 2016
Line 2:		Line 2:
	The following document contains rules and regulations, which are <u>entirely mandatory</u> for all Parasol Island projects containing web/software development.		The following document contains rules and regulations, which are <u>entirely mandatory</u> for all Parasol Island projects containing web/software development.

	== For Project Managers ==		= For Project Managers =

	==== Hold a kick-off meeting for every project ====		==== Hold a kick-off meeting for every project ====
Line 24:		Line 24:
	Please note that this article is set to be updated on a regular basis. Therefore, you should endeavour to create a new PDF from this page before each of your projects start.		Please note that this article is set to be updated on a regular basis. Therefore, you should endeavour to create a new PDF from this page before each of your projects start.

	== For Developers ==		= For Developers =

	==Security Basics==		==Security Basics==
Line 60:		Line 60:
	if (isset($_POST[$thisExpectedField])) {		if (isset($_POST[$thisExpectedField])) {

	$userData[$thisExpectedField] = $_POST[$thisExpectedField];		$userData[$thisExpectedField] = filter_var(trim(strip_tags($_POST[$thisExpectedField])),FILTER_SANITIZE_STRING);

	} else {		} else {

David Smith at 09:38, 11 February 2016

2016-02-11T09:38:32Z

@@ Line 26: / Line 26: @@
 == For Developers ==
-==IT-Sicherheitsprüfungen (Basics)==
+==Security Basics==
 * When working with live databases (containing real user information), it is forbidden to take a database dump and to run it locally on your machine. No traces of real user data should ever be found on local developer machines.
 * It should never be possible for a user to control the execution time of your script. For example, all loops must be entirely under control and should utilize pagination where possible. The number of iteractions that a loop is to perform must never be controllable by the user.

David Smith at 09:30, 11 February 2016

2016-02-11T09:30:42Z

← Older revision		Revision as of 09:30, 11 February 2016
Line 13:		Line 13:
	# Any questions that you may wish to ask		# Any questions that you may wish to ask
	Please remember that David is here to support you with your project in regards to all development-related aspects. Therefore, if you have even the smallest question, please feel free to contact him directly and he will be more than happy to help you.		Please remember that David is here to support you with your project in regards to all development-related aspects. Therefore, if you have even the smallest question, please feel free to contact him directly and he will be more than happy to help you.

			==== Read the following (incredibly helpful) page ====
			As a project manager, you are not expected to be a world-class developer. However, knowing a few details regarding your developer's work is incredibly beneficial for yourself, your project and for Parasol Island. Therefore, you should give this page a read: https://wiki.parasol-island.com/Web_Development_Best_Practice_A-Z

			Again, if you have any questions at all regarding any of the topics discussed on the aforementioned page, please do not hesitate to contact David Smith and he will be more than happy to help clear up any misunderstandings.

	==== Send your developer a copy of this article ====		==== Send your developer a copy of this article ====

David Smith at 09:25, 11 February 2016

2016-02-11T09:25:16Z

← Older revision		Revision as of 09:25, 11 February 2016
Line 12:		Line 12:
	# Required features (e.g. database export functionality, project monitoring etc.)		# Required features (e.g. database export functionality, project monitoring etc.)
	# Any questions that you may wish to ask		# Any questions that you may wish to ask
	Please remember that David is here to support you with your project in regards to all development-related aspects. Therefore, if you have even the smallest question, please feel free to contact him directly		Please remember that David is here to support you with your project in regards to all development-related aspects. Therefore, if you have even the smallest question, please feel free to contact him directly and he will be more than happy to help you.

	d he will be more than ~~happto~~ help you.n

	==== Send your developer a copy of this article ====		==== Send your developer a copy of this article ====

David Smith at 09:24, 11 February 2016

2016-02-11T09:24:20Z

@@ Line 5: / Line 5: @@
 ==== Hold a kick-off meeting for every project ====
-Every single project must begin with a technical kick-off before any development work can begin. The sole aim of the kick-off meeting with {{:Mitarbeiter:Development_Supervision}} is to align your development plan with the expectations of Parasol Island in terms of your development environment, frameworks, plugins etc.
+Every single project must begin with a technical kick-off before any development work can begin. The sole aim of the kick-off meeting with {{:Mitarbeiter:Development_Supervision}} is to align your development plan with the expectations of Parasol Island.
 == For Developers ==