I'll be more clear. Only the administrator can accessing to login-config.xml ... in which scenario you're thinking administrator wants to hack himself ? I think has no sence ... this machine has access to some database, administrator has grants to connect from this computer, they don't need jboss-login.xml changes it has grants directly to database.
SQL injection is something diferent, the normal scenario is web ( or other kind of applications, but the idea is the same ), some web form collects data (field_X) that's used in second form as a part of query as:
Code: Select allselect * from table where table_row = $filed_X ( here's is possible make sql injection)
but if programers does queries right like as a
Code: Select allps = preparedStatement(select * from table where table_row =?) ...
ps.setString(1,$field_X)
then the injection is not possible
OpenKM is more secure than you're thinking and all operations made in repository are logged ( we complish fully with spanish data law proteccion ) any operation since a user is logged and has logged out are totally registered. But if you want a high security level, first must configure connections as HTTPS to prevent sniffers in the network ...
90% of security problems comes from a bad password policy, if you test a brute force in your school probably you'll be surprised with results ( depending if have or not some password restrictions ... it's good idea made some mandatory patterns to passwords ). Really for version 5.0 we'll implement some external configurable password pattern validators in concordance with some ISO.
There's no system totally secure, but some minor good practices made it less accessible. I'm 14 years working in computer environment, I've been in both sides, hack a system is not easy as sometimes seeing in cinema, but have a bad practices is really easy, tipical postik in screen with user and pass, etc... sometime I listen a phrase of one of the majors ... "the only secure computer in buried on desert without energy".
I'm feeling young again
