AtoM Heratio — PR Review Checklist

Version: 1.0 Date: 2026-02-28 Author: The Archive and Heritage Group (Pty) Ltd

Overview

Use this checklist when reviewing pull requests for atom-framework and atom-ahg-plugins. Every PR must pass all applicable sections before merge.

[ ] All exec(), shell_exec(), system(), passthru() calls use escapeshellarg() on external input
[ ] No addslashes() used in shell contexts
[ ] Directory paths validated with realpath() before cd
[ ] Service names validated against allowlist for systemctl operations
[ ] Complex shell commands use ShellCommandService builders
[ ] No user input directly interpolated into shell command strings

Reference: SHELL_EXECUTION_POLICY.md

Reference: OUTBOUND_HTTP_POLICY.md

[ ] All POST/PUT/DELETE forms include <?php echo csrf_field() ?>
[ ] AJAX handlers either use csrf.js or manually send X-CSRF-TOKEN header
[ ] API endpoints using Bearer/API-Key auth are correctly exempt
[ ] Controllers that disable CSRF ($csrfProtection = false) have documented justification
[ ] No CSRF tokens exposed in URLs or GET parameters

Reference: CSRF_POLICY.md

[ ] All <script> tags include the CSP nonce snippet
[ ] All <style> tags include the CSP nonce snippet
[ ] No 'unsafe-inline' added to CSP directives
[ ] New external CDN domains added to config/app.yml allowlists (documented in PR)
[ ] Inline event handlers (onclick, onload, etc.) are avoided — use event listeners

Reference: SECURITY_MODEL.md

[ ] User input is validated before use (type, length, format)
[ ] SQL queries use Laravel Query Builder parameterized methods (no raw string concatenation)
[ ] HTML output uses htmlspecialchars() or Blade {{ }} escaping
[ ] File uploads validated via FileValidationService (MIME, extension, magic bytes)
[ ] No unserialize() on user-controlled data (use json_decode() instead)

[ ] No INSERT, UPDATE, DELETE, ALTER, DROP without documented justification
[ ] Plugin Manager code uses PDO/Propel (not Laravel Query Builder)
[ ] Everything else uses Laravel Query Builder (not raw PDO)
[ ] No core AtoM table schema modifications
[ ] install.sql does NOT contain INSERT INTO atom_plugin

[ ] New services follow namespace convention (AtomFramework\Services\* or AtomExtensions\*)
[ ] Plugin code stays within its own plugin directory (no cross-plugin imports)
[ ] Templates use direct property access, not render_title() or __toString()
[ ] URL generation uses named routes or url_for() helper
[ ] Form fields avoid name="action" (Symfony reserved parameter)

Reference: DOCUMENTATION_STANDARD.md