Loading...
 
Skip to main content

Features / Usability

Forum List Topic List

 
Thread actions
Print this page
  • Print all pages

    • Security in TikiWiki

    Posted by biffer

    In a previous topic, Damain wrote:

    "In a wiki environment allowing HTML is a very dangerous option. You should convert all the HTML code to wiki syntax or write some wiki-plugins to generate your HTML forms.

    Why is this dangerous?

    Well I could post a img src based JS attack on your site. to give me the contents of the tiki login cookie, and then use that data to gain control of the TikiWiki site."

    I'm wondering if this is true of using the Admin -> HTML Pages feature. Currently what I have done is paste a site of html pages into the HTML Pages section with appropriate page names, and then access the site via ===http://www.tikisitename.com/tiki-page.php?pageName=indexPage.

    Only users with "tiki_p_edit_html_pages" permission may edit, however, regardless of this have I opened myself up a security flaw? Or is it only in a strictly WIKI environment?



    Reads: 1808
    Posted by Damian Parker

    Hiya

    Anywhere where HTML can be inserted you can do that trick.

    If you are security minded, you will also want to disable user avatars, (maybe other image uploads, ive not tested in other areas yet) you can attach javascript code to the end of the avatar gif file! (Thanks to MikeW for that one!). We need some cleaner to confirm what is uploaded is indeed a picture.

    --
    Damian
    DamosoftQuestion - TikiWiki Development/Hosting ServicesQuestion


    Posted by biffer

    Thanks Damian that would not have occurred to me

    You mentionned some kind of "cleaner". Do you know of something you could recommend or will I need some kind of custom code?

    Thanks


    Posted by biffer

    Just had a thought about the image gallerys

    If I resized the images ( or thumbnails) on upload to the gallery, then if they werent legit images an error would be thrown would it not?