Coding/Development Mandatories

Development Rules & Regulations

The following document contains rules and regulations, which are entirely mandatory for all Parasol Island projects containing web/software development.

For Project Managers

Hold a kick-off meeting for every project

Every single project must begin with a technical kick-off before any development work can begin. The sole aim of the kick-off meeting with Mitarbeiter:Development Supervision is to align your development plan with the expectations of Parasol Island in terms of your development environment, frameworks, plugins etc.

IT-Sicherheitsprüfungen (Basics)

• When working with live databases (containing real user information), it is forbidden to take a database dump and to run it locally on your machine. No traces of real user data should ever be found on local developer machines.
• It should never be possible for a user to control the execution time of your script. For example, all loops must be entirely under control and should utilize pagination where possible. The number of iteractions that a loop is to perform must never be controllable by the user.
• Only Parasol Island-owned repositories are permitted to be used. It is forbidden to use any external repository services for Parasol Island projects.
• Only Parasol Island-owned servers are permitted to be used. It is forbidden to use any other server to host Parasol Island projects.
• If a backend script takes a considerable amount of time to run and the default PHP max execution time must be increased, the FMA must test for any detrimental server behaviour.

Verschlüsselung Daten in DB

• All user-centric data must only exist in the database in an encrypted manner. Non-user-centric data must not be encrypted due to performance reasons.
• All encryption keys must be stored outside of the webroot.
• All encryption keys must be at least 128-bit - preferably 256-bit.

Cross-Site Scripting (XSS)

• A CSRF (cross-site request forgery) token must be generated upon the user’s first visit to the website and must be stored in their session. All user actions that interact with a database or file system must be authenticated by comparing the session CSRF token and the token provided in the request.

Sanatising

• Cleaning any user-provided variables to be as specific as possible. For example, if the field is the DOB, only accept numerical digits in the format of DD.MM.YYYY.
• Be selective in the acceptable values
  • If the field is “Gender”, only accept “Male” or “Female”
• Stripping tags should be applied to almost every type of user input (with the exception of HTML-related inputs).

HTTPS

• If possible, run your entire app using https://. Mandatory is to encrypt every private user data, e.g. forms, logins, etc. using https://. Send Data only via POST, never use GET.

Authorship

• All author notes must be attributed to Parasol Island.
• Only the first and last name of the FMA is permitted to be in the repository.
• All repository commits must have the author set to FIRST_NAME LAST_NAME <FIRST_NAME.LAST_NAME@parasol-island.com>

Open Source Rules

If possible, only open-source (free / no license needed) plugins, libraries and other dependencies are permitted to be used within a Parasol Island project. Any premium (not free) dependency must be discussed with Mitarbeiter:Development Supervision, have the license provided to Parasol at no extra cost or be confirmed with the PM beforehand.

Verantwortlichkeiten (Kontrollpflicht)

Inhaltliche Verantwortung

Die inhaltliche Verantwortung liegt beim projektverantwortlichen Projektmanager. Er erstellt das inhaltliche Projekt-Briefing (Ziel: vollständiges Abbild aller projektbezogenen Erwartungen) Das Briefing enthält in der Regel ein technisches Konzept, ein Design-Konzept sowie ein Projekt-Timing Der Projektmanager ist ebenfalls verantwortlich für die Frontend-bezogenen Testings (inhaltliche und benutzerführende Vollständigkeit)

Technische Verantwortung

Die technische Verantwortung liegt beim Head of Development (Mitarbeiter:Development Supervision). Er übermittelt die technischen Anforderungen, die das Projekt erfordern. David ist ebenfalls für die dafür notwendige technische Infrastruktur verantwortlich.

Der Head of Development überprüft die technische Qualität des Developers und unterstützt den Projektmanager in allen technischen Belangen auch in der Testphase.

­IT- Infrastruktur und Kommunikationswege

Ausschliesslich unser Remote-Repository nutzen (FMA)

There is a Parasol Hosted GIT Repository for every Project. Ask your Producer for the url and credentials. It is mandatory to use our git repository and it’s strictly forbidden to use other repositories exept your local copy.

Personifizierte Schlüssel für Zugriff auf Repository und Serversysteme (PSL)

To gain you access to our repository or servers, please provide your private SSH key to David and your Producer

local Copy nach x-Monaten nach Projektabschluss löschen (FMA)

Your local git copy must be deleted in the week your final invoice is payed.

Richtline für PW und Schlüssel im Soucecode (PSL entw. Einhalten, Umsetzen FMA)

https://wiki.parasol-island.com/Passw%C3%B6rter#Passwortsicherheit

Daily commits im Entwicklungszeitraum

It is mandatory to commit your sourcecode with every milestone, at least once a day to the Parasol Island remote repository.

Entwicklung / Daten dürfen nur auf PSL-Systemen oder beim FMA lokal gespeichert sein (PW-Schutz)

It is not alowed to store data on any other machines than your local computer or a Parasol Island system.

LogIn & PW immer auf getrennten Kommunikationswegen übertragen (FMA/PSL)

https://wiki.parasol-island.com/Datenverarbeitung_durch_Parasol_Island

Datenschutz

Verfahren und involvierte IT-Systeme

Developer dürfen keinen Zugriff bekommen auf personenbezogene Daten

Kryptographie und Schlüsselmanagement

Schlüsselkomplexität mitgeben (PSL an FMA)

Datasheet

Email your developer everything he needs:

{Anschreiben}

Ticket-System (Redmine)
URL http://redmine.parasol-island.com/
Login {Your login name}
Password: {Was send to you upon account creation}

Repository
URL ssh://git@git.parasol-island.com/REPONAME
User git

Dev URL and credentials (It’s recommended to use the same DB name and user) are in Redmine as a Ticket (“Preview URL and Login credentials”)

Deploy
The “develop” Branch will be automatically deployed to the dev url (http://URL.preview.parasol-island.com).