MyFleet — Department Vehicle Booking System

SWE5208 Software Security Engineering | Secure Software Development Project

MyFleet is a secure web-based vehicle booking system built with Django 5.x and SQLite. It demonstrates secure software engineering principles including authentication, RBAC, input validation, CSRF protection, audit logging, and defence-in-depth architecture.

Security Features

• Secure login with password hashing (PBKDF2/bcrypt)
• Account lockout after 5 failed login attempts (15-minute lockout)
• Role-Based Access Control (Staff / Admin Officer / Supervisor)
• CSRF protection on all forms
• XSS prevention via template auto-escaping and Content-Security-Policy headers
• SQL Injection prevention via Django ORM (parameterised queries)
• Immutable audit trail logging all user actions
• Secure session management (15-minute idle timeout, HttpOnly cookies)
• Security headers middleware (CSP, X-Content-Type-Options, Referrer-Policy)

Tech Stack

• Backend: Django 5.x (Python 3.12)
• Database: SQLite (development) / MySQL 8 (production)
• Frontend: Django Templates with custom CSS

Quick Start

1. Clone the repository

git clone https://github.com/YOUR_USERNAME/MyFleet.git
cd MyFleet

2. Install dependencies

pip install django

3. Initialize the database

python manage.py migrate

4. Create a superuser account

python manage.py createsuperuser

5. Set up roles and sample data

python manage.py shell

Run the following in the shell:

from django.contrib.auth.models import User, Group

# Create roles
Group.objects.create(name='Staff')
Group.objects.create(name='AdminOfficer')
Group.objects.create(name='Supervisor')

# Assign superuser to AdminOfficer role
admin = User.objects.get(username='admin')  # use your superuser username
admin.groups.add(Group.objects.get(name='AdminOfficer'))

# Create sample vehicles
from core.models import Vehicle
Vehicle.objects.create(plate_number='WKL 3301', vehicle_type='Sedan', capacity=4)
Vehicle.objects.create(plate_number='WKL 5502', vehicle_type='Van', capacity=8)
Vehicle.objects.create(plate_number='WKL 7703', vehicle_type='Bus', capacity=20)

# (Optional) Create test users
staff1 = User.objects.create_user('staff1', 'staff1@myfleet.com', 'Staff@12345')
staff1.groups.add(Group.objects.get(name='Staff'))

super1 = User.objects.create_user('supervisor1', 'super1@myfleet.com', 'Super@12345')
super1.groups.add(Group.objects.get(name='Supervisor'))

print("Setup complete!")
exit()

6. Run the development server

python manage.py runserver

7. Open in browser

http://127.0.0.1:8000/

User Roles

Role	Permissions
Staff	Submit bookings, view/cancel own bookings
Admin Officer	Approve/reject bookings, manage vehicles, view all bookings
Supervisor	View audit logs, view reports

Test Accounts

Username	Password	Role
admin	(your password)	Admin Officer
staff1	Staff@12345	Staff
supervisor1	Super@12345	Supervisor

Project Structure

MyFleet/
├── manage.py                  # Django management tool
├── myfleet/
│   ├── settings.py            # Security configuration (SR-01 to SR-23)
│   ├── urls.py                # Root URL routing
│   └── wsgi.py                # WSGI entry point
├── core/
│   ├── models.py              # Data models (StaffProfile, Vehicle, Booking, AuditLog)
│   ├── views.py               # View functions with security controls
│   ├── forms.py               # Form validation (input sanitisation)
│   ├── middleware.py           # Custom security headers middleware
│   ├── urls.py                # App URL routing
│   └── admin.py               # Django admin registration
└── templates/
    ├── base.html              # Base template with RBAC sidebar
    ├── auth/login.html        # Login page with CSRF token
    ├── dashboard.html         # Role-based dashboard
    ├── bookings/              # Staff booking pages
    ├── admin/                 # Admin approval pages
    └── reports/               # Supervisor audit log page

Security Requirements Traceability

All security controls are traceable to the security requirements defined in Part 1:

Requirement	Implementation
SR-01	Password complexity validators in settings.py
SR-02	Account lockout logic in login_view()
SR-03/04	Session configuration (15-min timeout, HttpOnly, SameSite)
SR-05/06	@role_required decorator + queryset filtering
SR-09/10	Django ORM + Forms validation
SR-11	SecurityHeadersMiddleware + template auto-escaping
SR-13	PBKDF2 password hashing
SR-16/17	AuditLog model (append-only)
SR-22/23	DEBUG=False + secure logging configuration