Christophe Simonis
7636b510a2
* make CSRF protection the default on all non-SAFE methods note: there currently is no way to call a CSRF-protected endpoint without a form-encoded entity-body as that's the only place we get the CSRF token from. * simple CSRF token generation: just use the HMAC'd session id, no generating a new random token per session then HMAC it * use constant-time equal function to avoid timing attacks * assert that a database secret is configured before hashing/validating the CSRF token * opt-out database manager from CSRF: The super-admin password serves the purpose of a CSRF token in the database manager screens. There is no request database to obtain the secret and generate a CSRF token.
Send Quotes Online
Create polished, professional quotes in minutes
Use templates to create polished, professional quotes in minutes. Send these quotes by email and let your customer sign online. Use cross-selling and discounts to push boost your sales.
Electronic Signature
No more fax or scans in emails
Let your customers sign proposals online. Use up-selling techniques to propose them some options.
Spend the extra time focusing on selling, not recording data.
Communicate Efficiently
Have clear pricing strategies.