I want to know that if the Joomla's (3.6.5) default server-side validation (for forms' fields) is secure enough to rely on it only? In other words, is it necessary to make changes to Joomla's server-side validation codes or it is secure and good enough for setting up a website? (What decision you have made or are going to make about this?)
1 Answer
If the data you are protecting doesn't contain personally identifiable information I would say that the joomla's stock server-side validation should be plenty for you to use and feel safe. The validation rules may not have everything you need though. If you truly worry I would say use joomla's rules and possible add on to or make your own rule sets for the validation. There is also database validation as well to be considered.
When it comes to security I always ask myself the following:
- What kind of data am I protecting?
- Is it worth protecting with anything other than stock protection? I.E.
- How big of a target am I or will I be in the future?
- Could my company recover if this data was stolen?
If its is just names and email I would use stock protection.
If it is the above plus addresses and phone numbers I would probably add a bit more extra as that can really make people mad if it is obtained
Below is the resource on making your own validation rules if you didn't already know. https://docs.joomla.org/Server-side_form_validation
For a list of security vulnerabilities and news please see below: https://www.cvedetails.com/vulnerability-list/vendor_id-3496/product_id-16499/Joomla-Joomla-.html
