Instiki users - Oct 2005 - [Instiki] rhtml in Insstiki?

>
> Is there a reason why allowing rhtml (perhaps as an option)
> would be a Bad Idea?

It would be an extremely bad idea, as it will allow users to run code on the
server. There is no way to absolutely secure such code (it is very easy to
''leak'' malicious code) and you can get random users to
remotely run things
like FileUtils.rm_rf(''/'') on the server. Not something you
probably want.

Cheers,
Assaph
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
http://rubyforge.org/pipermail/instiki-users/attachments/20051015/b1232399/attachment.htm

At 2:42 AM +1000 10/15/05, Assaph Mehr wrote:
>Is there a reason why allowing rhtml (perhaps as an option)
>would be a Bad Idea?
>
>It would be an extremely bad idea, as it will allow users ...
Point taken.  Obviously, I''m not paranoid enough!

-r
-- 
email: rdm at cfcl.com; phone: +1 650-873-7841
http://www.cfcl.com        - Canta Forda Computer Laboratory
http://www.cfcl.com/Meta   - The FreeBSD Browser, Meta Project, etc.

Rich

Of course, if you just run your own personal Wiki tightly bound to 
localhost, running rhtml would not be as terrible an idea as it may 
sound in a multi-user configuration (to add to Assaph''s point, if your 
server that ran Instiki with rhtml enabled sat behind a firewall, 
anyone with Ruby network programming experience could use it to poke 
around behind your firewall, connecting as the Instiki server).

I have not investigated, but if it were easily possible to enable rhtml 
in this manner for a personal Wiki, I''d still like to know how, 
consequences be damned.  Anyone?

Tam?s

On Oct 14, 2005, at 12:51 PM, Rich Morin wrote:

At 2:42 AM +1000 10/15/05, Assaph Mehr wrote:
> Is there a reason why allowing rhtml (perhaps as an option)
> would be a Bad Idea?
>
> It would be an extremely bad idea, as it will allow users ...
Point taken.  Obviously, I''m not paranoid enough!

-r
-- 
email: rdm at cfcl.com; phone: +1 650-873-7841
http://www.cfcl.com        - Canta Forda Computer Laboratory
http://www.cfcl.com/Meta   - The FreeBSD Browser, Meta Project, etc.
_______________________________________________
Instiki-users mailing list
Instiki-users at rubyforge.org
http://rubyforge.org/mailman/listinfo/instiki-users