OpenTechStrategies / torque

A flexible web-based open source system for collaboratively evaluating proposals.
1 stars 2 forks source link

TeamComments Extension allows arbitrary wiki markup - Investigation needed? #7

Open frankduncan opened 4 years ago

frankduncan commented 4 years ago

While it should fall under the same security precautions as any of the wiki pages, it may require locking down in some way with regard to sensitive information, especially with regard to the level for change data. Things like external links, spoofing, image loading, etc, etc are all possible in the same way that the wikis are susceptible to, but the permission set may be more open and may need to be locked down.

If it proves to be ta concern, allowing arbitrary wiki markup may need to be banned.