Re: Plug-ins Support

Van Tate Jr. wrote:
> Another approach would be to explicity control all the superglobals via 
> the app and force plug-ins to use pre-cleaned, application level globals 
> for input, etc.
> 
> To force this you could introduce an array called $a_cleaned and grab all 
> $_POST && $_GET input, clean it, escape it, and push it into the 
> $a_cleaned array then blow away the values in $_POST && $_GET so that they 
> cannot be accessed by plug-ins. Same principle can be applied to output 
> with a little thought.

Except there's no way to actually limit the plug-in to only use the 
preferred variables.  Any PHP code can simply access the $_GLOBALS 
variable array, which includes every variable in the script's namespace. 
  Unfortunately, PHP is not a language meant for running untrusted code, 
and as such, there is no ways of securing the code against malicious 
intent, other than knowing exactly what code you're using, and exactly 
what it does (ie, code inspection).

-- 
John Reese
LeetCode.net

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/