Coding/Development Mandatories

Development Rules & Regulations

The following document contains rules and regulations, which are entirely mandatory for all Parasol Island projects containing web/software development.

For Project Managers

Hold a kick-off meeting for every project

Every single project must begin with a technical kick-off before any development work can begin. The sole aim of the kick-off meeting with Mitarbeiter:Development Supervision is to align your development plan with the expectations of Parasol Island.

Topics that can/will be discussed include:

1. Repository
2. Web Hosting
3. Required features (e.g. database export functionality, project monitoring etc.)
4. Any questions that you may wish to ask

Please remember that David is here to support you with your project in regards to all development-related aspects. Therefore, if you have even the smallest question, please feel free to contact him directly and he will be more than happy to help you.

Read the following (incredibly helpful) page

As a project manager, you are not expected to be a world-class developer. However, knowing a few details regarding your developer's work is incredibly beneficial for yourself, your project and for Parasol Island. Therefore, you should give this page a read: https://wiki.parasol-island.com/Web_Development_Best_Practice_A-Z

Again, if you have any questions at all regarding any of the topics discussed on the aforementioned page, please do not hesitate to contact David Smith and he will be more than happy to help clear up any misunderstandings.

Send your developer a copy of this article

Before you brief your developer, make sure that you have already sent them a copy of this article; quickly create a PDF from this page (via File > Print > Save as PDF) and send it over to them so that, in the event of your developer having questions or queries, you can identify and answer these during your first briefing meeting.

Please note that this article is set to be updated on a regular basis. Therefore, you should endeavour to create a new PDF from this page before each of your projects start.

For Developers

Security Basics

In order to ensure that each project is planned, developed and executed in a safe and secure manner, the following basic rules must be adhered to:

Databases

When working with live databases (which contain real user information), it is forbidden to take a full or partial database dump (temporary or permanent) and to store it on a non-Parasol Island machine. No traces of real user data can ever be found on your local machines or servers.

All databases containing personally identifiable user information must be encrypted using a sufficient encryption method with an encryption key of at least 128-bits. Such key should never be stored in a publicly available location or on any Non-Parasol Island machine.

It should never be possible to decrypt a password back into clear-text.

Runtime / Execution Times

It should never be possible for a user to directly control the execution of your script(s); be it in terms of controlling the number of iterations a loop makes or in terms of the number of files permitted to be uploaded.

For example, all loops must be entirely under your control at all times and should utilise pagination where possible. Take the following as a perfect example of how not to handle posted data:

$userData = array();

foreach ($_POST as $thisIndex => $thisValue) {
    $userData[] = $thisValue;
}

echo $userData['firstName'];

Instead, you should opt to handle each posted value like so:

$expectedFields = array(
    'firstName',
    'lastName',
    'emailAddress'
);

$userData = array();

foreach ($expectedFields as $thisExpectedField) {

    if (isset($_POST[$thisExpectedField])) {

        $userData[$thisExpectedField] = filter_var(trim(strip_tags($_POST[$thisExpectedField])),FILTER_SANITIZE_STRING);

    } else {

        $userData[$thisExpectedField] = null;
    }
}

echo $userData['firstName'];

By handling only the fields that you should be expecting, you will be instantly improving both the security and performance of your code.

Repositories

Only Parasol Island-owned repositories are permitted. Absolutely no project code is permitted to be stored on any external repository service; be it your own internal repository server or a professional repository service.

You will be provided with a repository during your project’s kick-off before which you must provide Parasol Island with a copy of your public certificate (also known as public key, SSH key etc.). Please send your key to David Smith (david.smith@parasol-island.com) and your project manager.

Your local copy of the project (on your local machines) must be securely deleted within 7 days of your final invoice being paid.

You must commit your local code into the repository on a milestone-basis. This means that when a particular component or feature is complete, you must commit the relevant code into the repository. It is forbidden to simply push a single commit at the end of the project.

Servers

Only Parasol Island-owned servers are permitted. It is forbidden to upload project code to any other publicly accessible server.

Your project code must be written in a language that can be executed on a standard Linux server without any special or bespoke software (unless agreed during your project kick-off). Recommended languages and technologies include:

• PHP5.5 or later
• MySQL
• Nginx / Apache (nginx is preferred over Apache)

If one or more of your scripts unavoidably requires a considerable amount of time to execute, it is your responsibility to perform sufficient testing before the project goes live to ensure that your script(s) do not negatively affect the performance of the server.

Preview Servers

For each project, you must use the Parasol Island-owned preview server that is provided to you during your project kick-off. Hosting project code on any other server apart from Parasol Island’s preview and live servers is strictly prohibited.

Cross-Site Scripting (XSS / CSRF)

You must take every precaution to protect your project code from being abused/misused by XSS attacks and you must sufficiently test your code before the project goes live.

One of the most important precautions to take is to integrate a Cross-Site Request Forgery token into all user-centric/database-centric/file system-centric actions. It is mandatory for any project with such user/database/file system-centric actions to be protected against CSRF attacks.

Sanitisation of User Input

All user-inputted data must be sanitised before being handled. Additionally, you must always be very selective with which data you consider as being acceptable.

For example, if the field is containing a user’s date of birth, you should only accept a value following the pattern of DD.MM.YYYY. If you find anything else in the value, you should instantly reject the input without any further handling. Similarly, with a gender field, you must only accept two very specific values; male or female.

Naturally, all user input must be stripped of any tags unless the field is HTML-centric (e.g. with the HTML content of a CMS page).

HTTPS / SSL

If available, you must always proactively use secured connections for your project. If an SSL certificate is unavailable, please discuss this in your project kick-off as it is very unlikely for this to be the case.

Authorship

All author notes must be attributed to Parasol Island. You may mention your first and last name, however your personal/business details must never be visible in a repository or on a server.

Similarly, all commits in a repository must not contain your personal/business details and should adhere to the following pattern:

[FIRST_NAME] [LAST_NAME] <FIRST_NAME.LAST_NAME@parasol-island.com>

Open Source Rules

Only open source (meaning free and no special license needed) plugins, libraries and other dependencies are permitted to be included within project code. Any premium (not free) dependency must be provided to Parasol at no cost and be already confirmed with the PM beforehand. Any future updates to the dependency must be provided to Parasol by means of sharing the access credentials.

• When working with live databases (containing real user information), it is forbidden to take a database dump and to run it locally on your machine. No traces of real user data should ever be found on local developer machines.
• It should never be possible for a user to control the execution time of your script. For example, all loops must be entirely under control and should utilize pagination where possible. The number of iteractions that a loop is to perform must never be controllable by the user.
• Only Parasol Island-owned repositories are permitted to be used. It is forbidden to use any external repository services for Parasol Island projects.
• Only Parasol Island-owned servers are permitted to be used. It is forbidden to use any other server to host Parasol Island projects.
• If a backend script takes a considerable amount of time to run and the default PHP max execution time must be increased, the FMA must test for any detrimental server behaviour.

Verantwortlichkeiten (Kontrollpflicht)

Inhaltliche Verantwortung

Die inhaltliche Verantwortung liegt beim projektverantwortlichen Projektmanager. Er erstellt das inhaltliche Projekt-Briefing (Ziel: vollständiges Abbild aller projektbezogenen Erwartungen) Das Briefing enthält in der Regel ein technisches Konzept, ein Design-Konzept sowie ein Projekt-Timing Der Projektmanager ist ebenfalls verantwortlich für die Frontend-bezogenen Testings (inhaltliche und benutzerführende Vollständigkeit)

Technische Verantwortung

Die technische Verantwortung liegt beim Head of Development (Mitarbeiter:Development Supervision). Er übermittelt die technischen Anforderungen, die das Projekt erfordern. David ist ebenfalls für die dafür notwendige technische Infrastruktur verantwortlich.

Der Head of Development überprüft die technische Qualität des Developers und unterstützt den Projektmanager in allen technischen Belangen auch in der Testphase.

­IT- Infrastruktur und Kommunikationswege

Ausschliesslich unser Remote-Repository nutzen (FMA)

There is a Parasol Hosted GIT Repository for every Project. Ask your Producer for the url and credentials. It is mandatory to use our git repository and it’s strictly forbidden to use other repositories exept your local copy.

Personifizierte Schlüssel für Zugriff auf Repository und Serversysteme (PSL)

To gain you access to our repository or servers, please provide your private SSH key to David and your Producer

local Copy nach x-Monaten nach Projektabschluss löschen (FMA)

Your local git copy must be deleted in the week your final invoice is payed.

Richtline für PW und Schlüssel im Soucecode (PSL entw. Einhalten, Umsetzen FMA)

https://wiki.parasol-island.com/Passw%C3%B6rter#Passwortsicherheit

Daily commits im Entwicklungszeitraum

It is mandatory to commit your sourcecode with every milestone, at least once a day to the Parasol Island remote repository.

Entwicklung / Daten dürfen nur auf PSL-Systemen oder beim FMA lokal gespeichert sein (PW-Schutz)

It is not alowed to store data on any other machines than your local computer or a Parasol Island system.

LogIn & PW immer auf getrennten Kommunikationswegen übertragen (FMA/PSL)

https://wiki.parasol-island.com/Datenverarbeitung_durch_Parasol_Island

Datenschutz

Verfahren und involvierte IT-Systeme

Developer dürfen keinen Zugriff bekommen auf personenbezogene Daten

Kryptographie und Schlüsselmanagement

Schlüsselkomplexität mitgeben (PSL an FMA)

Datasheet

Email your developer everything he needs:

{Anschreiben}

Ticket-System (Redmine)
URL http://redmine.parasol-island.com/
Login {Your login name}
Password: {Was send to you upon account creation}

Repository
URL ssh://git@git.parasol-island.com/REPONAME
User git

Dev URL and credentials (It’s recommended to use the same DB name and user) are in Redmine as a Ticket (“Preview URL and Login credentials”)

Deploy
The “develop” Branch will be automatically deployed to the dev url (http://URL.preview.parasol-island.com).