Worst security breach ever.

  • podpirate

    (@podpirate)


    12 years, 2 months ago

    The plugin offers a widget where users can enter PHP code that gets executed instantly in the frontend.
    Every user with the the privilege ‘edit_theme_options’ (and at least every blog admin) will be able to execute arbitrary PHP code on your server. In a multisite environmelt this may apply to some hunded persons.
    With this plugin you’re not going to be hacked, you ARE already hacked.

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Author Josh

    (@josh401)

    12 years, 2 months ago

    That is quite the assumption. Is this your professional opinion.. or just a random guess?

    I will certainly take a look at the PHP widget, and check the implications of a multisite environment.

    Remember though… some people like this feature.. and use it regularly. They may be single sites, where they are the only admin… or multisites, where everyone is trusted.

    Just because you don’t ‘like’ the feature.. doesn’t mean the plugin is broken. It simply means you don’t need to use the plugin, because it is not for you.

    Regardless.. I will take a look at the feature.. and see what can be done.

    Thank you for bringing this to my attention.

    Thread Starter podpirate

    (@podpirate)

    12 years, 2 months ago

    Wow, that was a quick reaction. Thanks for caring!

    I stumbled upon your plugin at a clients’ suggestion. He is running a multisite install where some hundred educational institutes can run their own homepages. The project is still a work in progress, and it is within my responsibility to hand over a bulletproof system in the end. Allowing (at least) every blog admin to execute arbitrary php code is an absolute no-go in this project.

    I don’t even think that bad intent of the wp users is the main problem here. It is naivety. Fun fact: like 10—15 years ago php code snippets like include $_REQUEST['filename'];, mysql_query($_REQUEST['sql']); or eval($_REQUEST['code']); were pretty common, even in professional projects, and I guess there are enough people out there who won’t see anything wrong in it.
    IMHO it should be the job of a responsible plugin author (espacially when he is selling a pro version) to prevent people from opening such potential holes.
    From my point of view the PHP-widget is only loosely related with Ultimate TinyMCEs core functionality (extending and altering WPs TinyMCE), and should better be put in a separate plugin, targeting only people who know what they are doing.

    (Having some plugins out there myself, I know one-star-reviews are frustrating.)

    Plugin Author Josh

    (@josh401)

    12 years, 2 months ago

    Wow, that was a quick reaction. Thanks for caring!

    Wow – Certainly not the first reaction I was expecting… Thank you.

    I understand. I have recently tackled the multi-site environment of WP, and it’s quite challenging. There are so many what/if scenarios running a plugin in multisite… it’s daunting.

    IMHO it should be the job of a responsible plugin author (especially when he is selling a pro version) to prevent people from opening such potential holes.

    I couldn’t agree with your more… even in the lite version. Again, with the original intent of the plugin; only admins could adjust the plugin settings (add the php widget ability).

    NOTE: This functionality DOES have to be enabled by an admin who has access to the plugin settings page. It is NOT an auto-loaded feature of the plugin.

    However, that does not negate the validity of your remark. And I will be checking into this to see if I can make it any more secure, without ruining the functionality of the plugin.

    From my point of view the PHP-widget is only loosely related with Ultimate TinyMCEs core functionality (extending and altering WPs TinyMCE), and should better be put in a separate plugin, targeting only people who know what they are doing.

    Again… true. But… (there is always a but…) when multiple people request the same feature.. and mention they don’t like multiple plugins installed when one could do the same thing… it makes it difficult to not incorporate the feature.

    You have to balance “why is he not taking my feature request” with, as you already mentioned, “is this practical to include in the plugin”.

    WP users are a meticulous bunch. If there is one thing I have learned for certain… it’s that you can please some of the people all of the time; all of the people some of the time; but you can NEVER please ALL of the people ALL of the time 😉

    (Having some plugins out there myself, I know one-star-reviews are frustrating.)

    Nah.. it goes with the territory. Some of the best feedback comes from disgruntled users!

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘Worst security breach ever.’ is closed to new replies.