This is by Carnuke!!! I agree completely tho
Docs proposal update:
The latest version of smartsection is now available and ready for using as the XOOPS documents library. The purpose of this post is to update administrators of proposed security measures and request that FTP admins upload smartsection and the accompanying library module to xoops.org modules. I will then ready the modules for input before going online to the XOOPS public area.
Security is a hot subject at the moment, so I am laying out the working protocols for the document library for approval or improvements. Please comment as required.
1- The documents library will contain existing material that has previously been displayed on xdocman.
2- This material will be inputed as wrapped pages similar to TinyContent to form the new library list.
3- Wrapped pages will be uploaded through the browse/upload feature to smartsection from my own PC.
4- I will enlist help from other trusted volunteers to do this, who will be listed as library administrators.
5- Library administrators will require admin access to smartsection only.
6- the wrap feature is only available to module administrators.
7- The concept of the Document library is that it should be community driven and populated, not just by administrators, but also by anyone who has a useful contribution to documentation for xoops. This will include:
8- Module developers, theme designers, core developers to submit their own user/admin documentation for their own projects, XOOPS enthusiasts who have some skills in educative/information writing.
9- Who can access the 'submit' page? XOOPS Administrators, Document library administrators should have initial access to submit documents via the submit page. However the module will be configured to treat all material subject to moderation.
10- How do other genuine submitters get access? This needs to be decided on bases on what level of security is required.
a) We could allow all registered members to access the submit page, given that all content will be subject to moderation anyway.
b) Alternativley, we should require prospective submitters to apply for permission to submit, in order to present their reasons first and verify their credentials.
c) In the case of b) above, we should create a new 'Documenters group' allowing smartsection module submit access.
11- What can be submitted? The documents library needs to be configured to allow HTML markup in the content page. This should be through koivi editor that needs to be installed. Submitters also need the option to be able to attach files to their submission. This is surely the most contraversial request, but is required in order to submit the most presentable documents which are supported by formatting and images.
12- Mimetypes: Smartsection uses a mimetype filter to accept only selected files attached to any document. The purpose of attachements is to allow the following:
a) Images to be uploaded to the XOOPS server as part of the submitted document. (Gif, Png, Jpg)
b) Compressed Archive files of language translation to support the main document.
13- It is important to allow image uploads of images used within any document. This is to ensure that any submitter does not call images from another remote server. If we allow images as part of the submissions we can be sure to retain document integrity independently.
14- We considered useing language sub-categories, but this created too many categories for the module to be useful and easily navigated. File attachements is a better option, as they are connected to the documents.
15- SUBMISSION and MODERATION
Regardeless of any submission, no publication will take place untill an approved XOOPS or libray administrator has viewed and scrutinised the content as follows:
a)- Both summary and main body fields need to be fully read
b)- Markup should be verified to include only text and image and table formatting only.
c)- No other scripting language will be accepted.
d)- No imgscr calls to any other servers should be accepted (these can be gateways to malicious alternatives)
e)- No inclusion of external pages from other servers will be accepted. (as above)
f)- Any atachements of images should be viewed in isolation of the page first
g)- Following the above checks, the submission must be previewd and checked for visual correctness.
h) Any Compressed archives should be D/L and virus scanned.
i)- Following a safe result, archives should be decompressed and checked as a-g above.
j)- No extra atachements are permitted within archives.
k)- If the moderator is completly happy with the content, he may publish the document to the public side
l)- The moderator my reject any document outright or contact the submitter to query the content.
m)- The moderator may reject the document, if it is felt that the content repeats existing material, or is superfluous.
ALL rejected material should be PLACED OFFLINE NOT DELETED. If suspect content is found, the submission becomes potential evidence. Consult a XOOPS administrator for further action.
n)- Moderators will ensure that each document is correctly numbered, categorised and contains enough meta information to be traceable to the author/ originator.
16- What is The library module? It's a single blank page dummy module. It's purpose is only as a display page for smartsections blocks. This enables users to browse the library without distraction from other page content.
17- Where are files uploaded?
Attached files ../uploads/smartsection/
General images ../uploads/smartsection/images/
Category images ../uploads/smartsection/images/category/
Articles images ../uploads/smartsection/images/item/
Page wrap files ../uploads/smartsection/content/
The best working permissions I have achieved on my server is 666 for all directories listed here.
17- To Do!
a) Upload smartsection to xoops.org
b) Upload the library module to xoops.org
c) Install koivi editor and configure for use with smartsection.
d) Decide on security for submission strategy (See point 9 &10 above)
e) Input existing content
f) Appoint library moderators/administrators
g) Open XOOPS Documents library to users.
PLEASE feedback on this now, if you have questions, improvements, criticisms.
Thanks.
Richard
