diff --git a/app/Resources/public/css/base.css b/app/Resources/public/css/base.css index 8afd5e7610..fc6f0c612b 100644 --- a/app/Resources/public/css/base.css +++ b/app/Resources/public/css/base.css @@ -6791,6 +6791,10 @@ input.form-control[type="color"] { margin-top: 20px; } +.col-xs-6.course-tool:nth-child(2n+1) { + clear: left; +} + /* Extra small devices (phones, less than 768px) */ /* No media query since this is the default in Bootstrap */ @@ -6811,6 +6815,13 @@ input.form-control[type="color"] { /* Medium devices (desktops, 992px and up) */ @media (min-width: 992px) { + .col-xs-6.course-tool:nth-child(2n+1) { + clear: none; + } + .col-md-3.course-tool:nth-child(4n+1) { + clear: left; + } + div.navbar-collapse { padding-left: 0; } diff --git a/documentation/security.html b/documentation/security.html index 7839e29201..ee813eee5e 100755 --- a/documentation/security.html +++ b/documentation/security.html @@ -23,19 +23,20 @@
  • Using safe browsers
  • Moving your configuration file out of the web directory
  • Restricting files permissions
    • +
  • HTTP Headers Security

    • 1. Disclosing server info

    It is considered a safer behaviour not to disclose server information from your Chamilo page. In order to avoid both web server and PHP information disclosure, you might want to take the following actions: +

    -

    2. Keeping up to date

    @@ -62,31 +63,46 @@ access to your database if that one isn't well protected and many other stuff we move the configuration file out of your web directory. If your Chamilo installation is in /var/www/, move your configuration to /etc/chamilo/configuration.php, for example. Then create a new app/config/configuration.php file, open it, and write the following:

    -

     <?php
 require '/etc/chamilo/configuration.php';
    -

    This will prevent direct access to your settings and make it seem totally the same to Chamilo.

    5. Restricting files permissions

    - Making all the Chamilo files world-writable will help you install quickly, and it solves many +

    Making all the Chamilo files world-writable will help you install quickly, and it solves many issues for people without much admin experience. However, it's more secure to make a distinct user owner of all the chamilo files and folders, and only give read access to the web server to all files, and write access - only to the directories previously mentioned. This way, these files need + only to the directories previously mentioned.

    +

    This way, these files need only be readable and writable by the Apache process owner, not by the entire world. It would also be advisable to make all writable directory refuse the interpretation of PHP files (except for the root of the courses - directories). Don't hesitate to hire an experienced administrator to do that, + directories).

    +

    Don't hesitate to hire an experienced administrator to do that, it might be a bit more expensive now, but you'll be happy not to have to loose - all of your data to a hacker who attacked your site. + all of your data to a hacker who attacked your site.

    -
    +
    +

    HTTP Headers Security

    +

    A relatively recent development in web security, HTTP headers can be modified either + from the web server or from the application (like Chamilo) to increase the security + of your visitors.

    +

    These implies several aspects, from simple to complex, to deal with, from stuff like + indicating which websites you say media or libraries can be loaded from, to adding + extra info about your SSL certificate to make sure a hacked certification authority + will not immediately make your certificate useless.

    +

    In Chamilo 1.11.6, we have added several parameters, together with recommendations, + to main/install/configuration.dist.php, that you are free to use or ignore, + depending on the level of security you want to achieve.

    > +

    To check your portal for possible improvements in terms of headers security, + we highly recommend the securityheaders.io + website. If you want to read more about CSP and all related headers + security techniques, check Scott Helme's blog.

    Authors