bueditor has a feature to exec php. We should block it.

CommentFileSizeAuthor
#3 2006500_block_bueditor_php_7x.patch1.36 KBgreggles
#1 2006500_block_bueditor_php.patch382 bytesgreggles

Comments

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Status: Active » Needs review
StatusFileSize
new 2006500_block_bueditor_php.patch382 bytes

See #2006502: does 7.x-1.x version allow admins to execute php? to determine if we need this for 7.x.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented

For 7.x we need "administer bueditor"

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Version: 6.x-1.x-dev » 7.x-1.x-dev
Status: Needs review » Fixed
StatusFileSize
new 2006500_block_bueditor_php_7x.patch1.36 KB

Killes reviewed in irc.

6.x-1.x committed/pushed http://drupalcode.org/project/paranoia.git/commit/362999e

7.x-1.x attached committed and pushed http://drupalcode.org/project/paranoia.git/commit/fbdf15c

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

killes@www.drop.org’s picture

killes@www.drop.org commented

and deployed