Merge branch 'reflection_bottlenecks' into 'master'

[ssproject1617.git] / report / v4_access.tex

diff --git a/report/v4_access.tex b/report/v4_access.tex
index 45b7515..8975299 100644 (file)
--- a/report/v4_access.tex
+++ b/report/v4_access.tex
@@ -94,13 +94,15 @@ Fail, because the role and distinct user systems are stubs.
 \end{result}
 
 \item
-\pass{}
+\fail{}
 Verify that all user and data attributes and policy
 information used by access controls cannot be
 manipulated by end users unless specifically authorized.
 
 \begin{result}
-This item is the main remaining security concern. I haven't found any obvious fail in the login system, but given the architecture and security status of the whole \CMS{}, I'm not very sure of it.
+This item is the main remaining security concern, as the login form allows SQL
+injections that are capable to alter any information stored in the database.
+This is described in more detail in item V2.6 on page~\pageref{auth:6}.
 \end{result}
 
 \notapplicable{