| ... |
... |
@@ -19,7 +19,7 @@ |
| 19 |
19 |
=== Iframe integration === |
| 20 |
20 |
|
| 21 |
21 |
{{figure image="system_general_iframe_en.png" clear="h3" width="600"}} |
| 22 |
|
-Per Whitelist kann es Drittseiten erlaubt werden, Backend-Seiten als IFrame einbinden zu dürfen. |
|
22 |
+ You can optionally whitelist third-party pages that should be allowed to include backend pages via iframes. |
| 23 |
23 |
{{/figure}} |
| 24 |
24 |
|
| 25 |
25 |
By default, {{formcycle/}} blocks any attempts by third-party pages to include backend pages as iframes due to security concerns. In case it becomes necessary to include backend pages as an iframe, you can whitelist allowed third-party pages in this menu. The values you enter here are used for the //frame-ancestors// directive of the //Content-Security-Policy// HTTP header, see for example [[mdn web docs>>url:https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors||target="_blank"]] for an in-depth descrption of the allowed values. |
| ... |
... |
@@ -42,8 +42,12 @@ |
| 42 |
42 |
|
| 43 |
43 |
=== Session cookie settings === |
| 44 |
44 |
|
| 45 |
|
-WIP |
|
45 |
+{{figure image="system_general_session_cookie_en.png" clear="h3" width="600"}} |
|
46 |
+ If possible, we recommend you make the settings for the session cookie as strict as possible and require HTTPS. |
|
47 |
+{{/figure}} |
| 46 |
46 |
|
|
49 |
+The session cookie identifies a user session and keeps track of the user while they are logged in. Here you can change whether the session cookie should be limited to HTTPS connections (Secure) and whether it should be transmitted to third-party sites (SameSite). We recommend you activate the Secure flag when you solely use HTTPS. Allowing the session cookie on third-party pages is necessary for some use cases such as embedding forms via AJAX into external pages. |
|
50 |
+ |
| 47 |
47 |
== Protocol == |
| 48 |
48 |
|
| 49 |
49 |
=== Automatic deletion of protocol entries === |
| ... |
... |
@@ -56,8 +56,15 @@ |
| 56 |
56 |
|
| 57 |
57 |
=== Generated protocol entries === |
| 58 |
58 |
|
| 59 |
|
-WIP |
|
63 |
+{{figure image="system_general_generated_protocol_entries_en.png" clear="h3" width="600"}} |
|
64 |
+ These settings let you enable or disable certain types of protocol entries. |
|
65 |
+{{/figure}} |
| 60 |
60 |
|
|
67 |
+; Add protocol entry when an automatic form submission by a bot was detected |
|
68 |
+: {{formcycle/}} tries to detect attempts by machines (bots) to submit forms automatically. When a bot was detected, the submission is blocked. If this option is enabled, a processing [[protocol entry>>doc:Formcycle.UserInterface.Protocol]] is created. |
|
69 |
+; Add protocol entry when attempting to submit a form with an invalid submit button |
|
70 |
+: You can add [[buttons>>doc:Formcycle.Designer.Form.FormElements.Button]] to a form that allows users to submit the form. Within the workflow, you can [[check whether a certain buttons was pressed>>doc:Formcycle.Designer.Workflow.Events.SubmitButton]] and run certain actions depending on which button was pressed. Starting with version 7, it is possible to validate whether the submit button actually existed in the form, which helps prevent form records from being manipulated. If this option is enabled, a processing [[protocol entry is created>>doc:Formcycle.UserInterface.Protocol]] when a form was submitted with an invalid submit button. |
|
71 |
+ |
| 61 |
61 |
== Limits == |
| 62 |
62 |
|
| 63 |
63 |
=== Form and file cache === |
