📚 [DOC] Documentation of security relevant information

[simonschaufi]

• [ ] How to make extbase controller actions secure

[DavidBruchmann]

• include check for access rights (FE and / or BE)
• common type-checks / requirements / conversion
• parse & filter text if advisable (strip html, add quotes, htmlentities for html, sql, etc. from user input)
• for any keys like API keys create models that could be protected somehow to access the keys

some things could be candidates for being solved with AOP

[simonschaufi]

TYPO3 does not support AOP but I guess many people are unaware about the initalize* actions which is the right place to do that in my opinion

[DavidBruchmann]

yes as far as possible, that's correct. Wasn't sure if TYPO3 got or gets AOP, probably it won't be included was the statement I once got