|
|
|
|
4
|
|
4
|
|
5
|
## Major Changes
|
5
|
## Major Changes
|
6
|
|
6
|
|
7
|
-### Integrated Database Encryption
|
|
|
|
|
7
|
+#### Integrated Database Encryption
|
8
|
|
8
|
|
9
|
Using a database key [provided by staff](sections/tools/misc/database_key.php) and only ever stored as a hash in memory (via APC), the [integrated database encryption](classes/dbcrypt.class.php) is used to encrypt sensitive user data like IP addresses, emails, and private messages regardless of the underlying system gazelle is running on.
|
9
|
Using a database key [provided by staff](sections/tools/misc/database_key.php) and only ever stored as a hash in memory (via APC), the [integrated database encryption](classes/dbcrypt.class.php) is used to encrypt sensitive user data like IP addresses, emails, and private messages regardless of the underlying system gazelle is running on.
|
10
|
|
10
|
|
11
|
The rest of gazelle must be aware that some of the data it fetches from the DB is encrypted, and must have a fallback if that data is unavailable (the key is not in memory). You will see plenty of `if (!apc_exists('DBKEY')) {` in this codebase.
|
11
|
The rest of gazelle must be aware that some of the data it fetches from the DB is encrypted, and must have a fallback if that data is unavailable (the key is not in memory). You will see plenty of `if (!apc_exists('DBKEY')) {` in this codebase.
|
12
|
|
12
|
|
13
|
-### Expunge Requests
|
|
|
|
|
13
|
+#### Expunge Requests
|
14
|
|
14
|
|
15
|
Users are able to view the data kept on them and [issue requests for the deletion of old information](sections/delete) to staff through a simple interface.
|
15
|
Users are able to view the data kept on them and [issue requests for the deletion of old information](sections/delete) to staff through a simple interface.
|
16
|
|
16
|
|
17
|
-### Resource Proxying
|
|
|
|
|
17
|
+#### Resource Proxying
|
18
|
|
18
|
|
19
|
All external resources that may appear on a page are fetched and served by the server running gazelle. This prevents the leak of user information to third parties hosting content that has been included on a page through an image tag or similar.
|
19
|
All external resources that may appear on a page are fetched and served by the server running gazelle. This prevents the leak of user information to third parties hosting content that has been included on a page through an image tag or similar.
|
20
|
|
20
|
|
21
|
-### Scheduler
|
|
|
|
|
21
|
+#### Scheduler
|
22
|
|
22
|
|
23
|
The [scheduler](sections/schedule) has been broken up into more manageable parts and has additional selective runtime features for manual execution.
|
23
|
The [scheduler](sections/schedule) has been broken up into more manageable parts and has additional selective runtime features for manual execution.
|
24
|
|
24
|
|
25
|
-### Bonus Points
|
|
|
|
|
25
|
+#### Bonus Points
|
26
|
|
26
|
|
27
|
Like most gazelle forks, we've added a [bonus point system](sections/schedule/hourly/bonus_points.php) and [store](sections/store).
|
27
|
Like most gazelle forks, we've added a [bonus point system](sections/schedule/hourly/bonus_points.php) and [store](sections/store).
|
28
|
|
28
|
|
29
|
-### Modern password hashing
|
|
|
|
|
29
|
+#### Modern password hashing
|
30
|
|
30
|
|
31
|
We use new PHP password hashing features that automatically rehash your password when a better hashing algorithm is made available and employ prehashing to allow you to use a secure password of any length. Original gazelle would effectively truncate your password after around 72 characters (if the tracker even allowed you to use a password that long). This codebase does not have the same problem, and allows passwords of virtually unlimited length (over 30,000 characters by default) that remain useful after a few tens of characters.
|
31
|
We use new PHP password hashing features that automatically rehash your password when a better hashing algorithm is made available and employ prehashing to allow you to use a secure password of any length. Original gazelle would effectively truncate your password after around 72 characters (if the tracker even allowed you to use a password that long). This codebase does not have the same problem, and allows passwords of virtually unlimited length (over 30,000 characters by default) that remain useful after a few tens of characters.
|
32
|
|
32
|
|