Security
Table of Contents
Namespaces
- ApiClient
- Cors
- Http
- Jwt
- PersonalData
- RateLimit
- Rbac
- Upload
Interfaces
- AccountAnonymizationStepInterface
- One module's share of anonymizing a deleted account.
Classes
- AccountDeletion
- Account deletion requested by the user — the pure
rules shared by the Api manager, the cron and the tests. No I/O.
- AccountDeletionTicket
- Short-lived proof that the visitor has just signed in (password or OAuth) to an account whose
deletion is pending. It lets the "account awaiting deletion" page cancel the deletion without
a session (the sign-in itself is refused while the deletion is pending).
- ActivationKey
- Account activation key — the same contract as
{@see PasswordResetToken}, only with a longer validity.
- AdvertAccessSession
- Adverts for which the visitor has proven the password in this session (editing without an account).
- AdvertConfirmationKey
- Confirmation key of a Bazaar advert / Comcat company profile (`activation_key`, e-mails
`BZ_ADVERT_ACTIVATION_REQUEST` / `CC_ADVERT_ACTIVATION_REQUEST`, link `?do=confirm&key=…`).
- AdvertManageKey
- Link "Manage advert" from the e-mail sent after adding an advert without an account (Bazaar advert,
Comcat company profile). Replaces the readable management password the e-mail used to carry.
- AuthPayload
- Login payload from the Api (`data.payload` of login, OAuth and refresh), read by the admin and
front presenters ({@see \App\Core\Traits\Admin\Presenters\AuthStorageTrait},
{@see \App\Core\Traits\Front\Presenters\AuthStorageTrait}).
- EditorAutosaveScope
- Opaque per-user scope for the client-side TinyMCE autosave draft (`localStorage`).
- EmailConfirmationSetting
- Interprets the setting "content confirmed by the author via an e-mail link" in one place for
adverts (Bazaar, module 5), company profiles (Comcat, module 6) and discussion posts
(Discussion, module 8).
- ExternalEmailVerification
- Did the OAuth provider vouch for the e-mail address?
- ExternalLinkConfirmation
- Pairing an OAuth identity with an existing password account needs the account owner's
confirmation by e-mail ("pre-hijacking" protection).
- InitialApprovalSetting
- Setting key "automatic approval by the admin" of a new record, in one place for adverts
(Bazaar, module 5), company profiles (Comcat, module 6) and discussion posts (Discussion, module 8).
- LegacyPasswordHasher
- Verifies passwords hashed with the old algorithm: `crypt($password, '$2a$07$' . $salt)`.
- LoginDeviceCookie
- The "known device" proof for the password-login
throttle: a long-lived signed cookie that says "this browser has signed in to account X before".
- LoginResult
- LoginUser
- PasswordHasher
- PasswordPolicy
- Minimum password lengths: one source for the front forms and the Api checks.
- PasswordResetToken
- One-time password reset token — shared by the user account
and by adverts placed without an account.
- ReferralCode
- Referral code of the affiliate program: base36 of the user id plus a random suffix of
{@see self::SUFFIX_LENGTH} characters, lowercase `[0-9a-z]`.
- SecurityConfig
- Master switches of the Api layer security protections, with values from
`config/Shared/security.neon` (`parameters.security.*`).