Re: [xwiki-users] xwiki security

Dan Svoboda wrote:

My network admin asked the following question when I asked him to let his email server accept messages for forwarding from my xwiki server:

is your code secure? is there much chance that a malicious bot could harvest email and start injecting messages through your server?

What should I tell him?

The mailsender plugin is public, meaning that any if someone can edit wiki documents, it can write a script that uses the mailsender plugin API to compose messages. If you don't trust your users, you should consider disabling or deploying a modified version of this plugin. If you trust your users and the edit rights are restricted only to your users, XWiki is safe. -- Sergiu Dumitriu http://purl.org/net/sergiu/