MPOS/php-mpos — pull request #1621 by xisi (2014-01-28 12:33:46+00:00)
Title: [UPDATE] Security updates and fixes

* Config changes
* Moves csrf, twofactor and maxfailed sections + 2 new config sections from global config into security.dist.inc.php
* The defaults are sane enough that everyone can use them without annoyance
* Simple config checker that will run for admins unless disabled in the global config

* Strict mode, which is enabled by default:
* Shims mysqli and run php filters against incoming data
* Validates client requests (IP, session, useragent - configurable)
* Uses the Memcache request limiter; see below

* Strict mode, disabled by default:
* Validating server on requests
* Redirect to ssl pages sitewide

* Rate limiting requests, which is enabled by default:
* Adds the ability to limit the number of requests from the same IP down to X requests per Y time
* Uses Memcache; no DB hits
* This should cut down on some of the resource intensive pages being abused
* Defaults protect everything and limit requests to 30 per 1 minute for site, 20 per 1 minute for api
* Allows you to set a custom error page