Skip to content

Comments

Option to manually add Content Filtering Custom hooks#427

Open
alextuan wants to merge 1 commit intorosell-dk:masterfrom
alextuan:custom-filtering-hooks
Open

Option to manually add Content Filtering Custom hooks#427
alextuan wants to merge 1 commit intorosell-dk:masterfrom
alextuan:custom-filtering-hooks

Conversation

@alextuan
Copy link
Contributor

This pull request adds a textra box to the Use custom filtering hooks setting where the user can add any theme or plugin custom filter hooks.
The textra box has Help text and is only enabled when the Use Custom Filtering Hooks option is selected.
See screenshot
Image from Gyazo

Copy link
Owner

@rosell-dk rosell-dk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, but it seems unsafe to allow custom hooks like that.

@alextuan
Copy link
Contributor Author

Sorry, but it seems unsafe to allow custom hooks like that.

Hi Rosell, i see other pull request on latest version of plugin, it's great
But about this pull request, can you tell me what you sees as issue ? Are you fear it will be able to be hacked ?

@rosell-dk
Copy link
Owner

Yes, my worry is regarding the security implications. My plugin has been taken down once because of security issues. The issue back then could only happen when a logged in user entered something nasty on the settings screen. So apperently, the policy is that we cannot trust that logged in users aren't hackers. I'm not sure it is a good idea to let hackers trigger custom hooks.

@ettoredn
Copy link

ettoredn commented Jan 1, 2021

Do not allow users without admin caps to access/change plugin settings.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants