Many people think that if someone has access to the website's control panel (admin panel), they can be trusted 100%. This is a dangerous misconception. The RK-CMS system implements many roles and permissions, and access to the admin panel is not a reason to consider a user completely trustworthy.
Why do we think this?
Let's look at a simple example. We have a role called "SEO Specialist." This employee needs access to description texts and image uploads to perform their work. It might seem like a no-brainer. However, it's precisely through text fields and files that attackers or inattentive employees can most often sneak malicious code.
We cannot guarantee that the password to the SEO Specialist account won't be stolen or that the specialist won't accidentally (or intentionally) insert a dangerous script into a product description.
How do we protect ourselves?
Our operating principle is simple: we don't trust anyone or anything that comes from outside the site, even if it comes from our own admin panel.
Therefore, we process absolutely all incoming data.
1. Text filtering (XSS protection)
We don't allow data to be entered into the database as is.
Removing HTML headers: We strip out anything that could change the page structure. If there are tags in the text, we ruthlessly remove them. Why? To prevent anyone from inserting ads or invisible blocks on the page.
Neutralizing scripts: Any attempts to insert JavaScript are blocked. This protects your visitors from cookie theft and redirects to fraudulent sites.
2. Cleaning downloaded files
Even an image can be dangerous, unless it's just an image.
We check file headers (signatures): We don't trust file extensions. Every uploaded file is checked against its internal headers—the first bytes that uniquely identify the data type. A true JPEG always begins with a specific sequence of bytes, a PNG with a different sequence, and a PDF with a third. If the header doesn't match the declared type or looks suspicious, the file is rejected. This eliminates the possibility of downloading a virus disguised as an image, where malicious code is hidden right at the beginning of the file.
We clean SVG: The SVG format is essentially code. It can hide a malicious script that will execute when opened. We run SVG through a special "vacuum cleaner" that removes all executable junk, leaving only safe graphics.
Content inspection: We also analyze the entire file, not just its header, to ensure there are no hidden attachments or malicious code embedded within the data.
Security on the modern web is a layered defense. Even if you're inside the system (in the admin panel), you're still considered a potential threat. This isn't paranoia, but a dire necessity to protect client data and the site's functionality.
