Possible security issue - comments wanted
Earlier this week I had a discussion with Patrick McElhaney about a possible security issue with BlogCFC. Patrick pointed out that the Pod Manager lets you add any CFM code you want to your pods. Patrick felt this was a danger as a blog author could put malicious code up on their blog.
Now my feeling is that this is no different then the file manager. Also - you have to trust your blog authors somewhat. I mean, if I'm a blog author and wanted to screw your box over, I could always post porn or other damaging material.
While I see the risk - I just see it as more of an edge case. Anyway, you can easily disable the File Manager via an INI setting, as well as disabling the ability for blog writers to change their settings. Scott Pinkston sent me a mod to give the same ability for the Pod Manager. It would completely turn it off - not just the edit ability.
Thoughts?
del.icio.us
| 
Digg It!
| 
Linking Blogs
| 1214 Views
There are possible options here. You could create an authorization system for Pods that simply prevents a Pod from being used until it is approved by someone with the proper trust level. You could write security that is so tight that your product becomes cumbersome.
Also, since I am a very new user of (2 weeks or so) blogCFC I do not know if it has roll based logins and access permissions. I didn't see anything that looked like that as I work on the code (I made mods to get blogCFC working with PostgreSQL and BD JX 7.xx). I did see a table that stored logins, but not user types or rolls. It would be possible to create a few predefined user rolls that had certain permissions. This could take a lot of coding depending on the desired implementation. And it could limit the risk to the owner of the blog from an author gone bad.
For myself since I am the only one working on my code I do not need this. I can usually trust myself.
Wil
@Wilgeno: Right now there is only one level of user - a blog author. For v6 I'll probably expand that so you can give people rights to do blog entries, but not touch anything else.
I realize this is a little off topic but since File Manager was mentioned in this entry I thought I would add my suggestion here. Have you considered adding an INI setting for a starting point for File Manager? I trust our editors to post appropriate content but I would rather they not have the ability to add/delete blog application files. I've created a sub-folder under "/blog-name/client" named "userfiles" and made a change to /blog-name/client/admin/filemanager.cfm to be the starting point so no files above that in the directory tree can be modified.
It seems like the GetEm Query is to heavy or something like it. I have several time out errors.
Thanks