Webforms and Security: Three things worth repeating

"Security" by Henri Berguis

“Security” by Henri Berguis

Webforms are among the most powerful tools in the WMS, but with great power comes great responsibility.

Here are 3 things to bear in mind when using a webform on your site.

1. It’s never too late to authenticate.

Wherever possible require users to sign in – this is your first and best defence against spam.

This can be done by unchecking “anonymous user” from the Submission Access settings and selecting only the role(s) that should be allowed to submit the form.

2. It’s worth your while to use Private Files.

If you are using a File component to enable your users to send files, set the Upload destination to “Private files.”

This ensures that files reside in a secure, private directory on your site that can only be accessed by people with the correct permissions.

3. No sign in? Don’t let spam in.

If your form needs to be available without a sign in (e.g., to users from outside the McGill community), make sure to avoid certain components to ensure that your site and users are protected:

  • File Upload fields which can be used to upload malicious files to the site
  • Text Area fields which can be used to disseminate spam content
  • Email Address fields which can also be exploited for spam

You should also avoid sending submission confirmation emails that contain sensitive or personal information such as McGill IDs and other personal information. You can always glean this information from the Submissions tab.

These three things to remember when you are working with webforms should go a long way towards ensuring that your WMS site remains secure and your visitors protected from spam or other malicious content.

For more information, see KB Article #2711: Create Forms in the Web Management System

 

Iteration 87

Iteration 87 will run from Feb 14th until March 3rd. Work undertaken includes:

Highlights include:

  • Updating WordPress
  • Maintenance

summary

status

type

priority

milestone

pts

Prep for Comms Huddle presentation

iteration_backlog

support task

highest

Site Management 7.1

3

Creating pages for UG Skills: – Review requirements of levels, streams, competencies

iteration_backlog

support task

highest

Site Management 7.1

1

OSS site review: Planning phase 2 updates

iteration_backlog

support task

highest

Site Management 7.1

2

Engineering: Focus group workshop 2 [Feb 17]

iteration_backlog

support task

highest

Site Management 7.1

0.5

Kryzalid Review of wireframes

closed

support task

highest

3

UG Skills: Focus Group Workshop

iteration_backlog

support task

highest

Site Management 7.1

0.5

Fix view unpublished content perms

iteration_backlog

bug

high

Infrastructure 7.1

3

update l10n_update module

closed

security update

high

Infrastructure 7.1

1

Install solr environment on websearch3.it.mcgill.ca

iteration_backlog

support task

high

Infra Evergreening 7.1

5

Create php 7 ras environment

iteration_backlog

support task

high

Infra Evergreening 7.1

5

[Spike] Fix formatting on imported blog items

iteration_backlog

bug

high

WMS Blogging 7.0

2

Migrate Trac wiki to Confluence

iteration_backlog

support task

high

Infrastructure 7.1

3

Update ctools module

iteration_backlog

support task

high

Infrastructure 7.1

1

Update entityreference module

iteration_backlog

support task

high

Infrastructure 7.1

1

Update file_entity module

iteration_backlog

support task

high

Infrastructure 7.1

1

Update libraries module

iteration_backlog

support task

high

Infrastructure 7.1

1

Update logintoboggan module

closed

support task

high

Infrastructure 7.1

1

Update modernizr module

iteration_backlog

support task

high

Infrastructure 7.1

1

Update multiform module

iteration_backlog

support task

high

Infrastructure 7.1

1

Update plupload module

iteration_backlog

support task

high

Infrastructure 7.1

1

Update taxonomy_access_fix module

iteration_backlog

support task

high

Infrastructure 7.1

1

Update token module

iteration_backlog

support task

high

Infrastructure 7.1

1

Update webform module

iteration_backlog

support task

high

Infrastructure 7.1

1

Upgrade wordpress instances

iteration_backlog

support task

high

WordPress 3.0

3

Site Review: Convocation site

iteration_backlog

support task

high

Site Management 7.1

2

Enable access to Article Categories

closed

enhancement/new feature

high

WMS Blogging 7.0

2

Mediawiki moderator unable to update user roles

closed

support task

high

Site Management 7.1

1

Enable Site managers + Beta testers to see the Articles block in Structure > Blocks

iteration_backlog

bug

high

WMS Blogging 7.0

1

Please review: External Developer onboarding process map

closed

support task

high

Documentation

0.5

Fix login notice in moriarty

closed

bug

medium

Theme 7.1

1

Remove ical stuff from channels_importantdates

iteration_backlog

bug

medium

Channels 7.1

1

Fix notices in channels_content_types

iteration_backlog

bug

medium

Channels 7.1

2

[Spike] Mediawiki audit and alternative solutions

iteration_backlog

support task

medium

Infrastructure 7.1

3

Update environment_indicator module

iteration_backlog

support task

medium

Infrastructure 7.1

1

Update scheduler module

iteration_backlog

support task

medium

Infrastructure 7.1

1

Communications planning

iteration_backlog

support task

medium

Documentation

2

Malformed HTML in a few places

iteration_backlog

bug

medium

Theme 7.1

1

Make wpsdevbot talk to Jira

closed

bug

medium

Jira

2

[Spike] Tool to create responsive and accessible infographics on the WMS

iteration_backlog

enhancement/new feature

medium

Responsive 7.1

3

eCal: Adding a Courses menu item displays the Summer Studies menu on All Courses page

iteration_backlog

bug

medium

E-calendar 7.3

2

Blog post: Featured website, February 2017

iteration_backlog

support task

medium

Documentation

0.5

Fix notices in mcgill_search

iteration_backlog

bug

medium

Search 7.2

1

[Remove] Obsolete modules

iteration_backlog

support task

low

Infrastructure 7.1

0.5

Blog post: How to crop images with a consistent ratio

iteration_backlog

support task

low

Documentation

1

[Spike] Investigate Inline Entity Form and Paragraphs

iteration_backlog

enhancement/new feature

low

Site Management 7.1

2

Article Block: Add pagination

iteration_backlog

bug

low

WMS Blogging 7.0

1

Blogpost: Webforms and security

iteration_backlog

support task

low

Documentation

1

 

Call ‘em better columns

New updates will soon be rolled out in the WMS to improve column template formatting. The updates will affect all column templates – Two column layout, Three column layout, Four column layout and Five column layout – and will help address a few layout bugs that occur on some WMS sites.

A run-down of the improvements

  •  Currently, column templates do not take up the full width of the container (area of the page layout) in which they are placed . For example, a Two column layout template takes up 96% of the container. This leaves a narrow space on the side that sometimes causes issues with text wrapping and element alignment. After the update, column templates will take up 100% of the container.
  • Margin padding in the last column of each template will be removed. This will make it possible for an image placed in the last column to be aligned flush with the right edge of the column.

Don’t mix and match and templates

Column templates are designed to work as complete sets. For example, The Two column layout is comprised of 2 “two column” elements and the Five column layout is comprised of five “five column” elements. Taking a mix-and-match approach to putting these elements together is not recommended – for example, you shouldn’t put one “five column” element beside one “two column” element followed by another “five column” element.

*Important note: If your site mixes columns in this manner, these layouts may break when the updates are implemented.

While mixing column formats isn’t commonly employed on WMS sites, a few sites may be affected. Site managers are encouraged to check column formatting on their sites as soon as possible to ensure all columns have been implemented as complete sets.

Example of incorrect usage (layouts may break)

Incorrect usage example

 

Example of correct usage

Correct usage

For more information on proper formatting of column templates read our article in the IT Knowledge Base, Two, Three, Four and Five column layouts in the WMS.

Blog authors are solely responsible for the content of the blogs listed in the directory. Neither the content of these blogs, nor the links to other web sites, are screened, approved, reviewed or endorsed by McGill University. The text and other material on these blogs are the opinion of the specific author and are not statements of advice, opinion, or information of McGill.