# Security Checklist -- Mitgliederverwaltung

## Input Validation Audit

### Controllers Reviewed
All controllers use parameterized queries via Nextcloud's QBMapper -- no raw SQL anywhere.

| Controller           | Status | Notes                                          |
|----------------------|--------|-------------------------------------------------|
| MemberController     | OK     | Validates required fields, dates, duplicates    |
| FamilyController     | OK     | Validates required name field                   |
| FeeController        | OK     | Validates year, amounts, rule existence          |
| LagerController      | OK     | Validates required fields, date ordering         |
| InjuryController     | OK     | Validates required fields                        |
| ReportController     | OK     | Type parameter validated against whitelist       |
| ExportController     | OK     | Password validation for encrypted exports        |
| PermissionController | OK     | Validates level enum, NC user existence          |
| AuditController      | OK     | Read-only, pagination validated                  |
| DsgvoController      | OK     | Admin-only, validates member existence           |
| MilestoneController  | OK     | Settings validated, read-only detection          |
| StufeController      | OK     | Validates required name and age range            |

### SQL Injection Prevention
- All database access uses `QBMapper` or `IQueryBuilder` with named parameters
- No `$db->executeQuery($rawSql)` calls found
- Field names in queries are hardcoded constants, never user input

### XSS Prevention
- Frontend: Vue 3 auto-escapes all interpolated values (`{{ }}`)
- Backend: `InputSanitizer` available for stripping HTML from inputs
- Rich text fields (Beschreibung, Notizen) stored as-is but escaped on display

### CSRF Protection
- All state-changing endpoints (POST/PUT/DELETE) require CSRF token
- Only GET endpoints use `#[NoCSRFRequired]` attribute
- Nextcloud framework enforces CSRF by default

## Rate Limiting

| Endpoint Group | Limit          | Rationale                         |
|----------------|----------------|-----------------------------------|
| Search         | 60 req/min     | Prevent member data scraping      |
| Export         | 10 req/min     | Prevent bulk data extraction      |
| Reports        | 10 req/min     | CPU-intensive PDF generation      |
| Import         | 5 req/min      | Prevent upload flooding           |
| Default        | 120 req/min    | General API protection            |

Implementation: `RateLimitMiddleware` using NC distributed cache.

## Permission Enforcement

| Resource              | Read Access        | Write Access       | Delete Access       |
|-----------------------|--------------------|--------------------|--------------------|
| Members               | Viewer+            | Editor+            | Editor+             |
| Member banking data   | can_see_banking    | Editor+            | Editor+             |
| Families              | Viewer+            | Editor+            | Editor+             |
| Fee records           | Viewer+            | Admin              | Admin               |
| Fee rules             | Viewer+            | Admin              | Admin               |
| Permissions           | Admin              | Admin              | Admin               |
| Audit log             | Viewer+            | -                  | -                   |
| Settings              | Admin              | Admin              | -                   |
| DSGVO (hard delete)   | Admin              | Admin              | Admin               |
| Encrypted exports     | Editor+            | -                  | -                   |
| Import                | Admin              | Admin              | -                   |

## Encrypted Data

| Field                 | Encryption Method          | Visibility                  |
|-----------------------|----------------------------|-----------------------------|
| IBAN                  | NC ICrypto (AES-256-CTR)   | can_see_banking users only  |
| Kontoinhaber          | NC ICrypto (AES-256-CTR)   | can_see_banking users only  |
| Allergien             | NC ICrypto (AES-256-CTR)   | Masked in audit log         |
| Export ZIPs           | ZIP AES-256 encryption     | Password required           |

## Dependency Security

Run these commands regularly:

```bash
# PHP dependencies
composer audit

# JS dependencies
npm audit
```

Pin all dependency versions in `composer.json` and `package.json`.

## Penetration Testing Checklist

### Automated
- [ ] Run OWASP ZAP automated scan against running instance
- [ ] Run `composer audit` -- no critical/high vulnerabilities
- [ ] Run `npm audit` -- no critical/high vulnerabilities

### Manual Testing
- [ ] SQL injection on search endpoint with payloads: `' OR 1=1--`, `'; DROP TABLE--`
- [ ] Permission bypass: Viewer accessing Admin endpoints
- [ ] Permission bypass: Stufenzugriff user accessing other Stufe's members
- [ ] Banking field visibility: user without `can_see_banking` sees no IBAN/Kontoinhaber
- [ ] Encrypted export without password returns error
- [ ] CSRF: POST/PUT/DELETE without token returns 401/403
- [ ] Session fixation: verify session ID rotates on login
- [ ] File path traversal: `../../etc/passwd` in file integration paths
- [ ] XSS: `<script>alert(1)</script>` in member name, notes, beschreibung

### Audit Log Verification
- [ ] All state-changing operations create audit entries
- [ ] Encrypted fields show `[verschluesselt]` not plaintext
- [ ] Deleted member sensitive data shows `[geloescht]`

## Deployment Hardening

1. Enable Nextcloud 2FA for all admin users
2. Set `config.php` `loglevel` to 1 (Warn) in production
3. Enable Nextcloud Brute Force Protection
4. Restrict app to MySQL/MariaDB (SQLite not recommended for production)
5. Enable HTTPS with valid TLS certificate
6. Set `Strict-Transport-Security` header
7. Configure CSP headers (Nextcloud handles this by default)
8. Regular database backups with encryption at rest
9. Restrict file permissions: web server user only needs read access to app directory
