spelling

[ssproject1617.git] / report / v4_access.tex

diff --git a/report/v4_access.tex b/report/v4_access.tex
index 80358d8..1c0468f 100644 (file)
--- a/report/v4_access.tex
+++ b/report/v4_access.tex
@@ -3,7 +3,7 @@
 The \CMS{} has the following access control mechanisms:
 
 \begin{itemize}
-  \item A login mechanism, where logged in users are allowed to access the backend, and anonymous users are not.
+  \item A login mechanism, where logged in users are allowed to access the back-end, and anonymous users are not.
   \item For logged in users, a role system with three specified roles: admin, editor and regular user.
 \end{itemize}
 
@@ -17,7 +17,7 @@ Some typical objects of access control, in this case, are:
   \item Folders, files, info over these data
 \end{itemize}
 
-Our check reveales that the access control mechanisms are basically only a stub, and haven't been developed to their usually implied meaning, thus flattening the access control to the single aspect of being logged in or not. Hence, the main remaining security consideration deal with whether this login mechanism protects `backend' objects from anonymous users.
+Our check reveals that the access control mechanisms are basically only a stub, and haven't been developed to their usually implied meaning, thus flattening the access control to the single aspect of being logged in or not. Hence, the main remaining security consideration deal with whether this login mechanism protects `back-end' objects from anonymous users.
 
 These are the results of our check:
 
@@ -41,7 +41,7 @@ possess specific authorization. This implies protection
 against spoofing and elevation of privilege.
 
 \begin{result}
-Aside from the authentication issues as described in V2, the login system that is in place works as intended, and theoretically only allows registered users to access the backend.
+Aside from the authentication issues as described in V2, the login system that is in place works as intended, and theoretically only allows registered users to access the back-end.
 
 There is a role system, but it seems only to be a stub, for the role of a user has no effect whatsoever on their capabilities.
 \end{result}
@@ -70,7 +70,7 @@ such as \code{Thumbs.db}, \code{.DS\_Store}, \code{.git} or \code{.svn} folders.
 \begin{result}
 \begin{itemize}[leftmargin=*]
   \item \code{.gitignore} is freely accessible, as well as any other dot-preceded file (except \code{.htaccess}, which is hidden by default Apache rules), as well as files such as \code{Thumbs.db} and \code{.DS\_Store}.
-  \item Directory contents were listed in my simple setup. A global apache setting may disable by default, but the \code{.htaccess} file doesn't explicitly disable (with \code{Options -Indexes}), so that the \CMS{}'s codebase basically enables the listing by default.
+  \item Directory contents were listed in my simple setup. A global apache setting may disable by default, but the \code{.htaccess} file doesn't explicitly disable (with \code{Options -Indexes}), so that the \CMS{}'s code-base basically enables the listing by default.
 \end{itemize}
 \end{result}
 
@@ -159,7 +159,7 @@ No such mechanisms.
 \item
 \fail{}
 Verify that the application correctly enforces context-
-sensitive authorisation so as to not allow unauthorised
+sensitive authorization so as to not allow unauthorized
 manipulation by means of parameter tampering.
 
 \begin{result}