Textpattern CMS support forum

You are not logged in. Register | Login | Help

#11 2014-07-17 13:46:10

gaekwad
Member
From: People's Republic of Cornwall
Registered: 2005-11-19
Posts: 2,379

Re: Textpattern CMS demo site

etc wrote #282227:

But the ability to install plugins leaves the site (at least for 3 hours) at the mercy of bad guys.

It does. I have, I think, limited the amount of actual damage that can be done – you have more experience of plugins than I; what is possible?

Offline

#12 2014-07-17 14:11:21

etc
Developer
Registered: 2010-11-11
Posts: 2,949
Website

Re: Textpattern CMS demo site

gaekwad wrote #282228:

It does. I have, I think, limited the amount of actual damage that can be done … what is possible?

Without any protection, a plugin could empty, or maybe even drop a txp table. That’s enough to crash the site.


etc_[ query | search | pagination | date | tree | cache ]

Offline

#13 2014-07-17 14:28:35

gaekwad
Member
From: People's Republic of Cornwall
Registered: 2005-11-19
Posts: 2,379

Re: Textpattern CMS demo site

etc wrote #282229:

Without any protection, a plugin could empty, or maybe even drop a txp table. That’s enough to crash the site.

True. I’m still weighing up the risk/benefit for having plugin upload enabled. Potentially, the site(s) could be down/broken for 3 hours, then be restored and come back to life. Is that too much of a risk? The 3 hour window is trivial to change, of course – and perhaps a ‘report broken site’ link might be in order to have it restored ahead of time …which raises the question of getting around that and just shortening the rebuild interval to 1 or 2 hours.

Offline

#14 2014-07-17 14:40:14

etc
Developer
Registered: 2010-11-11
Posts: 2,949
Website

Re: Textpattern CMS demo site

gaekwad wrote #282231:

Potentially, the site(s) could be down/broken for 3 hours, then be restored and come back to life. Is that too much of a risk?

I’d say — wait and see — but plugins open the gate to php scripting, and who knows how much harm can be done to the server in 3 hours?


etc_[ query | search | pagination | date | tree | cache ]

Offline

#15 2014-07-17 14:57:01

Bloke
Developer
From: Leeds, UK
Registered: 2006-01-29
Posts: 8,458
Website

Re: Textpattern CMS demo site

etc wrote #282232:

plugins open the gate to php scripting

True, but inside an Article or Page or Form:

<txp:php>
safe_query('drop txp_users;');
</txp:php>

and boom, everyone’s gone. You can’t get round that unless you disable PHP in pages and articles and then remove access to Admin->Preferences so it can’t be changed. It’s beginning to sound like less of a demo and more of a ‘look at the interface… you just can’t do anything’ :-p

So, either:

  1. allow plugins and PHP, or
  2. block both and remove Prefs access

Like Pete says, a sandbox environment with no external access that rebuilds The Matrix every few hours. Where’s the incentive to do harm? And a report link is a great idea to initiate a premature rebuild… once the timer is in place since it’ll get out of sync with the schedule.

EDIT: Although not the strictest use of it as a demo site, one argument I can think of for keeping plugins is so users who want to upgrade to the latest version, but haven’t for fear of plugin incompatibility, can install legacy plugins and try them out to see if they run OK (or try new versions to check they still fulfil their needs). Same goes for the dev platform: a handy testbed to see what might break with existing plugins, which might also be used as a feedback loop to us so we can address potential problems earlier.


The smd plugin menagerie — for when you need one more gribble of power from Textpattern. Bleeding-edge code available on GitHub.

Txp Builders – finely-crafted code, design and Txp

Offline

#16 2014-07-17 15:29:45

etc
Developer
Registered: 2010-11-11
Posts: 2,949
Website

Re: Textpattern CMS demo site

Bloke wrote #282233:

True, but inside an Article or Page or Form: <txp:php>... and boom, everyone’s gone. … Like Pete says, a sandbox environment with no external access that rebuilds The Matrix every few hours. Where’s the incentive to do harm?

Wish Jukka were here :) Not sure, but 3-hours spamming could be enough to get blacklisted. Bad stuff uploading/distribution is probably possible too. I would totally disarm php() function (in the demo core) and disable plugin install. Or install a collection of “official” ones, maybe creating permanent accounts for authors. But let’s wait and see.


etc_[ query | search | pagination | date | tree | cache ]

Offline

#17 2014-07-17 15:31:09

gaekwad
Member
From: People's Republic of Cornwall
Registered: 2005-11-19
Posts: 2,379

Re: Textpattern CMS demo site

etc wrote #282234:

Not sure, but 3-hours spamming could be enough to get blacklisted.

Oh, I’m certain 3 hours is more than enough to get blacklisted – but there’s no MTA installed. Email is disabled.

Offline

#18 2014-07-17 15:38:28

gaekwad
Member
From: People's Republic of Cornwall
Registered: 2005-11-19
Posts: 2,379

Re: Textpattern CMS demo site

Bloke wrote #282233:

And a report link is a great idea to initiate a premature rebuild… once the timer is in place since it’ll get out of sync with the schedule.

Link added. Countdown timer to follow.

Offline

#19 2014-07-17 15:42:00

etc
Developer
Registered: 2010-11-11
Posts: 2,949
Website

Re: Textpattern CMS demo site

gaekwad wrote #282236:

Oh, I’m certain 3 hours is more than enough to get blacklisted – but there’s no MTA installed. Email is disabled.

One can post spam to websites.


etc_[ query | search | pagination | date | tree | cache ]

Offline

#20 2014-07-17 15:43:43

gaekwad
Member
From: People's Republic of Cornwall
Registered: 2005-11-19
Posts: 2,379

Re: Textpattern CMS demo site

etc wrote #282238:

One can post spam to websites.

Please excuse my ignorance, Oleg – you mean comment spam on other website articles with a URL link to the demo site?

Offline

Board footer

Powered by FluxBB