Last night saw the popular EU Cookie Compliance module fall from grace, as the Drupal community discovered that numerous inputs in the admin form were not being sanitised.
To me, this shows some serious failings in how our community is handling security awareness. Let's do some fixing :)
1) We need to make this OBVIOUS, with clear examples
One of the most important things when trying to get people to write secure code is making them aware of the issues. We need Drupalers of all levels of experience to know and understand the risks posed by unsanitised input, where they...
Drupal empowers site builders and editors to configure their sites in settings forms. Configuration management lets developers push changes up to live sites to be imported. But developers have to be considerate to ensure imports will not wipe out those changes made directly through the live sites' settings forms. At the least, they have to export the changes before making further tweaks. But admins may make further changes in the meantime too, so developers can end up frequently pulling irrelevant changes back from live, which seems unnecessary.
Here's some examples of the kind of config that I'm thinking of:
ABJS is a contrib Drupal module, and, without any requirements or ties to paid services, is as low cost as you can get. As we’ll see, it’s pretty basic but it really lets you get down to building your own understanding of how A/B testing works. The beauty of ABJS is in its simplicity. The settings pages are fairly self-explanatory, which is really helpful. Let’s set up a basic A/B test to show how things work.
Setting up our first experience
In our test, we’re going to split the site 50:50 in order to test an alternate homepage design. Go...
If you need to do some A/B testing at minimal cost, this is our quick overview of the available options that we found.
There are some powerful free options, and some free trials for some superb products. As with all things, the free options come with limitations that mean that for some circumstances it may be totally worth paying up for the right product/service. Free is not always better, and paid is not always better! We leave the final decision and hard negotiation to you :)
Optimizely has a 30 day trial, then paid plans. No public pricing. Has...