SQL injection

[mudchucker]

Where does 68Classifieds stand on SQL injection and other security concerns ?
(yeah, I know "you're a'gin em")

[Eric Barnes]

We have hired a third party auditing firm which performed an initial audit on v3.1 and we feel pretty confident they found any series issues although I am sure things can change and it is a possibility that certain parts are not secure.

But we try to stay on top of it and if anything security related comes to our attention we try and fix it asap.

[mudchucker]

Good to hear !

Is there a report available which shows the type of issues checked, what tests were run, what validation programs may have been used, etc.

It might be nice to have some sort of statement for the FAQ page which describes the level of testing done, just to help people trust that their personal information is or can be protected.

Can a user "select" which pieces of information is made available to listing viewers. I know I can change settings in the registration and listing pages but wondered if the person making the listing could be allowed to override the admin settings to limit or expand on which pieces of information they are comfortable showing.

Obviously it is good to have as much information as possible collected at registration in order to contact or bill the listers. But each of us have varying levels of comfort with providing our personal information on public sites.

[Lhotch]

Originally Posted by mudchucker

Good to hear !

Is there a report available which shows the type of issues checked, what tests were run, what validation programs may have been used, etc.

It might be nice to have some sort of statement for the FAQ page which describes the level of testing done, just to help people trust that their personal information is or can be protected.

Can a user "select" which pieces of information is made available to listing viewers. I know I can change settings in the registration and listing pages but wondered if the person making the listing could be allowed to override the admin settings to limit or expand on which pieces of information they are comfortable showing.

Obviously it is good to have as much information as possible collected at registration in order to contact or bill the listers. But each of us have varying levels of comfort with providing our personal information on public sites.

I can understand your desire to what checks have been done but making that public also means that people looking to abuse the classifieds have a lot less work to do so I for one would be against making this information publicly available.

As for the user overriding admin settuings its currently not supported but it would be a nice feature if the ad poster could override current setting for their ads.

[ebee]

Sorry to dig this old post out but it could be related to my question. As you can understand I am still assessing and thinking of buying 68C, doing some research I came accross this, is this a likely concern to us all?

[Eric Barnes]

Yes it was a vulnerability in v4.0.1 and we have been audited since:
68 Classifieds is Secured by GulfTech

[ebee]

Originally Posted by Eric Barnes

Yes it was a vulnerability in v4.0.1 and we have been audited since:
68 Classifieds is Secured by GulfTech

Thanks for the assurance.