| ... |
... |
@@ -6,34 +6,89 @@ |
| 6 |
6 |
|
| 7 |
7 |
The menu //General// allows the configuration of general FORMCYCLE settings like cache configurations or upload limits. |
| 8 |
8 |
|
| 9 |
|
-== Referrer policy == |
|
9 |
+== Security == |
| 10 |
10 |
|
| 11 |
|
-{{lightbox image="system_general_referrer_en.png" title="Referrer policy"}} |
|
11 |
+=== HTTP Strict Transport Security (HSTS) === |
|
12 |
+ |
|
13 |
+{{figure image="system_general_hsts_en.png" width="600" clear="h3"}} |
|
14 |
+You can enable HSTS to |
|
15 |
+{{/figure}} |
|
16 |
+ |
|
17 |
+HTTP Strict Transport Security (HSTS) is a security mechanism for HTTPS connections that prevents the connection encryption from being disabled by downgrade attacks, and also guards against session hijacking. If you need to support HTTP, enter //0// as the value. |
|
18 |
+ |
|
19 |
+=== Iframe integration === |
|
20 |
+ |
|
21 |
+{{figure image="system_general_iframe_en.png" clear="h3" width="600"}} |
|
22 |
+ You can optionally whitelist third-party pages that should be allowed to include backend pages via iframes. |
|
23 |
+{{/figure}} |
|
24 |
+ |
|
25 |
+By default, {{formcycle/}} blocks any attempts by third-party pages to include backend pages as iframes due to security concerns. In case it becomes necessary to include backend pages as an iframe, you can whitelist allowed third-party pages in this menu. The values you enter here are used for the //frame-ancestors// directive of the //Content-Security-Policy// HTTP header, see for example [[mdn web docs>>url:https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors||target="_blank"]] for an in-depth descrption of the allowed values. |
|
26 |
+ |
|
27 |
+=== Password policies === |
|
28 |
+ |
|
29 |
+{{figure image="PasswordPolicies.PNG" width="600" clear="h3"}} |
|
30 |
+ |
|
31 |
+{{/figure}} |
|
32 |
+ |
|
33 |
+The strength of all user passwords can be configured here. Passwords may not be shorter than a minimum length of 8 characters, but a higher minimum length can be configured. Different character sets (like letters in general, lowercase letters, uppercase letters, digits or special characters) can be forced to be contained in all passwords. After setting password policies, all new and all changed passwords must follow these. Existing passwords will not be changed, even if they do not conform the new password policies. |
|
34 |
+ |
|
35 |
+=== Referrer policy === |
|
36 |
+ |
|
37 |
+{{figure image="system_general_referrer_en.png" width="600" clear="h3"}} |
| 12 |
12 |
Referrer policy |
| 13 |
|
-{{/lightbox}} |
|
39 |
+{{/figure}} |
| 14 |
14 |
|
| 15 |
15 |
This header entry can be used to control which referrer information is passed on when performing a redirect to an external page. The referrer informs the external page about which page a user came from. Please note that privacy and security issues may arise when passing on the URL to the external page. |
| 16 |
16 |
|
| 17 |
|
-== HTTP Strict Transport Security (HSTS) == |
|
43 |
+=== Session cookie settings === |
| 18 |
18 |
|
| 19 |
|
-{{lightbox image="system_general_hsts_en.png" title="HTTP Strict Transport Security (HSTS)"}} |
| 20 |
|
-HTTP Strict Transport Security (HSTS) |
| 21 |
|
-{{/lightbox}} |
|
45 |
+{{figure image="system_general_session_cookie_en.png" clear="h3" width="600"}} |
|
46 |
+ If possible, we recommend you make the settings for the session cookie as strict as possible and require HTTPS. |
|
47 |
+{{/figure}} |
| 22 |
22 |
|
| 23 |
|
-HTTP Strict Transport Security (HSTS) ist ein Sicherheitsmechanismus für HTTPS-Verbindungen, der sowohl vor Aushebelung der Verbindungsverschlüsselung durch eine Downgrade-Attacke als auch vor Session Hijacking schützen soll. Für einen Betrieb unter HTTP wählen Sie für die Dauer 0. |
|
49 |
+The session cookie identifies a user session and keeps track of the user while they are logged in. Here you can change whether the session cookie should be limited to HTTPS connections (Secure) and whether it should be transmitted to third-party sites (SameSite). We recommend you activate the Secure flag when you solely use HTTPS. Allowing the session cookie on third-party pages is necessary for some use cases such as embedding forms via AJAX into external pages. |
| 24 |
24 |
|
| 25 |
|
-== Password policies == |
|
51 |
+=== Content-Security-Policy === |
| 26 |
26 |
|
| 27 |
|
-[[image:PasswordPolicies.PNG||alt="Passwort-Richtlinien.PNG"]] |
|
53 |
+{{figure image="system_general_csp_en.png" clear="h3" width="600"}} |
|
54 |
+You can add additional policies to the Content-Security-Policy header. |
|
55 |
+{{/figure}} |
| 28 |
28 |
|
| 29 |
|
-The strength of all user passwords can be configured here. Passwords may not be shorter than a minimum length of 8 characters, but a higher minimum length can be configured. Different character sets (like letters in general, lowercase letters, uppercase letters, digits or special characters) can be forced to be contained in all passwords. After setting password policies, all new and all changed passwords must follow these. Existing passwords will not be changed, even if they do not conform the new password policies. |
|
57 |
+{{version major="7" minor="2" patch="1"/}} Lets you add additional policies to the Content-Security-Policy header. Different values can be stored for backend (administration interface, designer, inbox) and for frontend (web forms). |
| 30 |
30 |
|
| 31 |
|
-== Cache == |
|
59 |
+Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross-Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft, to site defacement, to malware distribution. A primary goal of CSP is to mitigate and report XSS attacks. CSP makes it possible for server administrators to reduce or eliminate the vectors by which XSS can occur by specifying the domains that the browser should consider to be valid sources of executable scripts. |
| 32 |
32 |
|
| 33 |
|
-{{lightbox image="system_general_cache_en.png" title="Form and file cache"}} |
| 34 |
|
-Form and file cache |
| 35 |
|
-{{/lightbox}} |
|
61 |
+For a list of available policies, see e.g. this [[Mozilla page>>url:https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy||_target="blank"]]. |
| 36 |
36 |
|
|
63 |
+== Protocol == |
|
64 |
+ |
|
65 |
+=== Automatic deletion of protocol entries === |
|
66 |
+ |
|
67 |
+{{figure image="system_delete_protocoll_en.png" width="600" clear="h3"}} |
|
68 |
+You can delete old protocol entries automatically, which may also help prevent the database from growing too large. |
|
69 |
+{{/figure}} |
|
70 |
+ |
|
71 |
+Protocol entries (from processes, clients, system) that are outdated can be deleted automatically. At a specified time of the day all protocol entries are deleted that are older than the specified number of days. By using the "clear now" button all protocol entries can also be deleted instantly. After the automatic deletion of protocol entries, a new protocol entry is created containing information about the amount of automatically deleted protocol entries. |
|
72 |
+ |
|
73 |
+=== Generated protocol entries === |
|
74 |
+ |
|
75 |
+{{figure image="system_general_generated_protocol_entries_en.png" clear="h3" width="600"}} |
|
76 |
+ These settings let you enable or disable certain types of protocol entries. |
|
77 |
+{{/figure}} |
|
78 |
+ |
|
79 |
+; Add protocol entry when an automatic form submission by a bot was detected |
|
80 |
+: {{formcycle/}} tries to detect attempts by machines (bots) to submit forms automatically. When a bot was detected, the submission is blocked. If this option is enabled, a processing [[protocol entry>>doc:Formcycle.UserInterface.Protocol]] is created. |
|
81 |
+; Add protocol entry when attempting to submit a form with an invalid submit button |
|
82 |
+: You can add [[buttons>>doc:Formcycle.Designer.Form.FormElements.Button]] to a form that allows users to submit the form. Within the workflow, you can [[check whether a certain buttons was pressed>>doc:Formcycle.Designer.Workflow.Events.SubmitButton]] and run certain actions depending on which button was pressed. Starting with version 7, it is possible to validate whether the submit button actually existed in the form, which helps prevent form records from being manipulated. If this option is enabled, a processing [[protocol entry is created>>doc:Formcycle.UserInterface.Protocol]] when a form was submitted with an invalid submit button. |
|
83 |
+ |
|
84 |
+== Limits == |
|
85 |
+ |
|
86 |
+=== Form and file cache === |
|
87 |
+ |
|
88 |
+{{figure image="system_general_cache_en.png" width="600" clear="h3"}} |
|
89 |
+You can change the form and file cache size, which may be necessary when you have got many forms , or you can deactivate the cache for testing purposes. |
|
90 |
+{{/figure}} |
|
91 |
+ |
| 37 |
37 |
The file cache stores files used by the system, the form cache stores rendered HTML forms. |
| 38 |
38 |
|
| 39 |
39 |
{{table dataTypeAlpha="0" preSort="0-asc" caption="Settings regarding the form cache"}} |
| ... |
... |
@@ -50,11 +50,11 @@ |
| 50 |
50 |
|Time to idle|0|Time interval in seconds until an item in the form cache is removed when it is never accessed during that time interval. Set to {{code language="none"}}0{{/code}} to disable. |
| 51 |
51 |
{{/table}} |
| 52 |
52 |
|
| 53 |
|
-== System limits == |
|
108 |
+=== System limits === |
| 54 |
54 |
|
| 55 |
|
-{{lightbox image="system_general_limits_en.png" title="System limits"}} |
|
110 |
+{{figure image="system_general_limits_en.png" width="600" clear="h3"}} |
| 56 |
56 |
System limits |
| 57 |
|
-{{/lightbox}} |
|
112 |
+{{/figure}} |
| 58 |
58 |
|
| 59 |
59 |
{{table dataTypeAlpha="0" preSort="0-asc" caption="Settings regarding various limits"}} |
| 60 |
60 |
|= Property|= Default value|= Explanation |
| ... |
... |
@@ -65,16 +65,22 @@ |
| 65 |
65 |
|database field size limit|0|Maximum size in bytes when retrieving columns of type //character// (eg. char or varchar) or //binary//. Set to {{code language="none"}}0{{/code}} to disable. |
| 66 |
66 |
{{/table}} |
| 67 |
67 |
|
| 68 |
|
-== Loopback URL == |
|
123 |
+== Configuration == |
| 69 |
69 |
|
| 70 |
|
-{{lightbox image="system_general_loopback_en.png" title="Loopback URL"}} |
|
125 |
+=== Loopback URL === |
|
126 |
+ |
|
127 |
+{{figure image="system_general_loopback_en.png" width="600" clear="h3"}} |
| 71 |
71 |
Loopback URL |
| 72 |
|
-{{/lightbox}} |
|
129 |
+{{/figure}} |
| 73 |
73 |
|
| 74 |
74 |
Some features (such as form preview images or PDF print) require the server to open a form. In cluster configurations or environments in which the internal and external domains are different, this parameter is used to configure the internal availability (e.g. http://localhost:8080/formcycle). |
| 75 |
75 |
|
| 76 |
|
-== Automatic deletion of protocol entries == |
|
133 |
+=== License === |
| 77 |
77 |
|
| 78 |
|
-[[image:Screenshot_delete_protocoll.PNG||alt="Screenshot_ProtokollLöschen.PNG"]] |
|
135 |
+{{figure image="system_general_license_en.png" clear="h3" width="600"}} |
|
136 |
+ Here you can change certain settings related to the license. |
|
137 |
+{{/figure}} |
| 79 |
79 |
|
| 80 |
|
-Protocol entries (from processes, clients, system) that are outdated can be deleted automatically. At a specified time of the day all protocol entries are deleted that are older than the specified number of days. By using the "clear now" button all protocol entries can also be deleted instantly. After the automatic deletion of protocol entries, a new protocol entry is created containing information about the amount of automatically deleted protocol entries. |
|
139 |
+; Allow automatic license update through external notifications |
|
140 |
+: When this option is enabled, one can trigger a license update via an HTTP request to {{code language="text"}}http://example.com/formcycle/license/notify?key=LICENSE_KEY{{/code}}, where {{code language="text"}}http://example.com/formcycle{{/code}} should be replaced with the actual URL of the {{formcycle/}} server and //LICENSE_KEY// should be replaced with the license key of the license to update. |
|
141 |
+ |
