07_11_2011

[haoqili]

TODO:

• ask Michael what to do with CSP
  --> allow eval for setInterval?
  --> allow inline?
  --> make our own to get around setInterval?
  --> make our own to get around in-body script?

• start on Access Control

  ACCESS CONTROL
  Presentation, Business, Data Layer Access Control
      Presentation and Data layers use decorators
      Read about presentation layer protection 
  (Possible) Two tier design for admin account separation
      The picture of separate control of changing passwords 
  

---

• 24 start to separate richtext and url

• 7 HTTP Only fix

• 16 SQL injection can't include script

DONE:

• solved How come amo register does not have "setInterval blocked by CSP" problem? #45 --> learned about CSP_REPORT_ONLY
• made CSP image appear by bypassing in-body script and setInterval
• opened Recaptcha audio does not work with CSP #47, CSP audio doesn't work

[haoqili]

#43 <-- --> #48