search

projectestac / moodle-atto_fontfamily

Font Family plugin for the Moodle Atto Editor
2 stars 8 forks source link

Inserting any code into the plugin #12

Open 9D3F opened 1 year ago

9D3F commented 1 year ago

The weak point of the plugin is: Any code, even from external sources, can be integrated into the pages unfiltered. This code is executed on the end devices of the users (students and teachers). (Category: Remote Code Execution - critical) The risk lies with the administrator. He alone must judge whether the code is problematic or not. (Risk: Very high). Students cannot modify the content.

Is it possible to make adjustments for this to make the plugin more secure?

Screenshot 2023-02-08 095654 @crazyserver @Projectes TAC Dep. Educació Catalunya

eledia commented 1 year ago

We also encounter this. The solution seems simple, just add a restrictive parameter type to the admin_setting_configtextarea for this element. You did not set any, and the default is PARAM_RAW. Which allows anything. If you put PARAM_TEXT in there explicit, no code can be saved there. Or is there anything speaking against this?