Security Procedures

Passwords will not be stored directly in database. Only their MD5 signature will be stored. Each time user will try to log in, MD5 will be computed from his password and compared with the value in the database. This way, potential leak of database backup will not compromise user passwords.

There will be user levels: unknown (lowest), tr1, admin (highest)

Database login will depend on user type. Page header will establish the database connection using an account for given user type (db_unknown, db_tr1, db_admin - account specifications). Each user type will have a dedicated account with rights restricted to those which are needed to perform actions for given user type. For example, unknown user will have db_unknown account allowing only selects over database, updates or inserts to translations table and nothing more.

Before calling the header, each page should set value $s_user_level, the minimal user level required to access this page. Header will check if current logged user has level equal or higher and continue with page display or redirect user back to main.php if user level is incorrect. If value will not be not set, unknown will be used as default.

Installed server modules will be restricted only to those which are needed to run SimuTranslator to prevent attacks through buggy modules.