[security] Escape expression inputs for the case of PHP-proxies (foreign or domestic) using the extract variable

[chl0e3e]

Code

All inputs to CLI systems should be escaped for security reasons. Also recommended to add blacklists for CLI functions and/or remove them.

[gizmore]

GDOv7 is not really planned as a multi-user system, but it should and (?:could)* be? +asap

Thanks for this!

[gizmore]

A milestone here is to have two linux user accounts to share the same gdo installation (this is actually a speedup as the pathes are in opcache)

Thx for your input!

• giz

[gizmore]

One could write a phpgdo-multiuser module that switches configs based on usernames? O.o (brrr)

[gizmore]

Escaping should only be done to untrusted user input. For example you can mark GDTs Traiting WithTitle as being ->escaped().

@TODO: Automaticall mark GDO having GDT_Title as being escaped. (I bet there are XSS lurking atm)

As a user you might want to add plain html.

Actually GDOv7 GDT_Message - (user content OUCH!) - is based on a simple that allows plain html to style your posts.</p> <p>It uses htmlpurifier to sanitize the user input.</p> <p>There are gdo modules available to change the GDT_Message editor to a wysiwyg editor (currently only some <a href="https://github.com/gizmore/phpgdo-markdown">Module_Markdown</a> (without file support atm).</p> <ul> <li>giz</li> </ul> </div> </div> <div class="page-bar-simple"> </div> <div class="footer"> <ul class="body"> <li>© <script> document.write(new Date().getFullYear()) </script> Githubissues.</li> <li>Githubissues is a development platform for aggregating issues.</li> </ul> </div> <script src="https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js"></script> <script src="/githubissues/assets/js.js"></script> <script src="/githubissues/assets/markdown.js"></script> <script src="https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/highlight.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/languages/go.min.js"></script> <script> hljs.highlightAll(); </script> </body> </html>