[xwiki-users] xwiki security
My network admin asked the following question when I asked him to let his email server accept messages for forwarding from my xwiki server: is your code secure? is there much chance that a malicious bot could harvest email and start injecting messages through your server? What should I tell him? Dan Svoboda Research Assistant Professor U Pitt Center for HIV Protein Interactions (412)648-7262 [email protected]
Dan Svoboda wrote:
My network admin asked the following question when I asked him to let his email server accept messages for forwarding from my xwiki server:
is your code secure? is there much chance that a malicious bot could harvest email and start injecting messages through your server?
What should I tell him?
That he can read the code, it's open source :D More seriously, this has already been discussed. You can read this thread for example http://markmail.org/message/bze7cgqei6ftzn62 Hope this helps. Jerome.
Dan Svoboda Research Assistant Professor U Pitt Center for HIV Protein Interactions (412)648-7262 [email protected]
_______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users
Dan Svoboda wrote:
My network admin asked the following question when I asked him to let his email server accept messages for forwarding from my xwiki server:
is your code secure? is there much chance that a malicious bot could harvest email and start injecting messages through your server?
What should I tell him?
The mailsender plugin is public, meaning that any if someone can edit wiki documents, it can write a script that uses the mailsender plugin API to compose messages. If you don't trust your users, you should consider disabling or deploying a modified version of this plugin. If you trust your users and the edit rights are restricted only to your users, XWiki is safe. -- Sergiu Dumitriu http://purl.org/net/sergiu/
participants (3)
-
Dan Svoboda -
Jerome Velociter -
Sergiu Dumitriu