check reflection

[ssproject1617.git] / report / v4_access.tex

diff --git a/report/v4_access.tex b/report/v4_access.tex
index 03052d2..8975299 100644 (file)
--- a/report/v4_access.tex
+++ b/report/v4_access.tex
@@ -1,6 +1,6 @@
 
 \noindent
-The CMS has the following access control mechanisms:
+The \CMS{} has the following access control mechanisms:
 
 \begin{itemize}
   \item A login mechanism, where logged in users are allowed to access the backend, and anonymous users are not.
@@ -35,7 +35,7 @@ These are the results of our check:
 
 \item
 \fail{}
-Verify that the principle of least privilege exists - users
+Verify that the principle of least privilege exists {-} users
 should only be able to access functions, data files, URLs,
 controllers, services, and other resources, for which they
 possess specific authorization. This implies protection
@@ -56,7 +56,9 @@ user (for example, protect against users tampering with a
 parameter to see or alter another user's account).
 
 \begin{result}
-There is no different access context for distinct users. In particular, they are allowed to access and edit each others' account info, including password. Taken one way, this could be said to be by design and thus OK. But in any reasonable design concept allowing for distinct user accounts, this is clearly not the desired setup.
+There is no different access context for distinct users. In particular, they
+       are allowed to access and edit each others' account info, including
+       password. Taken one way, this could be said to be by design and thus OK\. But in any reasonable design concept allowing for distinct user accounts, this is clearly not the desired setup.
 \end{result}
 
 \item
@@ -69,7 +71,7 @@ such as \code{Thumbs.db}, \code{.DS\_Store}, \code{.git} or \code{.svn} folders.
 \begin{result}
 \begin{itemize}[leftmargin=*]
   \item \code{.gitignore} accessible, as well as any other dot-preceded file (except \code{.htaccess} itself by default Apache rules), as well as files such as \code{Thumbs.db} and \code{.DS\_Store}.
-  \item Directory contents were listed in my simple setup. A global apache setting may disable by default, but the \code{.htaccess} file doesn't explicitly disable (with \code{Options -Indexes}), so that the CMS's codebase basically enables the listing by default.
+  \item Directory contents were listed in my simple setup. A global apache setting may disable by default, but the \code{.htaccess} file doesn't explicitly disable (with \code{Options -Indexes}), so that the \CMS{}'s codebase basically enables the listing by default.
 \end{itemize}
 \end{result}
 
@@ -122,7 +124,7 @@ No such decision logging present. There is only a minor amount of logging, and t
 \item
 \fail{}
 Verify that the application or framework uses strong
-random anti-CSRF tokens or has another transaction
+random anti-\CSRF{} tokens or has another transaction
 protection mechanism.
 
 \begin{result}