Re: Plug-ins Support

It's really the nature of the beast when you start dealing with 
plugin/hooks type systems in web applications. As a security auditor for 
banks I can say with experience that the only way to -prevent- malicious 
code in plugins is to not implement plugins. The core application can only 
protect itself so much.

Plugin systems, by their very nature in web apps, come with risk and they 
force the user to trust the specific developer of the plugin.

On Sun, 14 Oct 2007, Vincent DEBOUT wrote:

> I raised a security point on the wiki about the possibility to hack 
> Mantis with plugins. A plugin could be a malicious code, we need to find 
> something to prevent that.

                *~*
---------------(O.o)--
. Van Tate Jr.
. Software Security && Production Release Manager
. van AT [AT=@] payquik.com

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/