Are plugins safe?

[TeaTree]

Hi,

Is it safe to use plugins on my forum? As someone told me they pose as a security threat-

Many Thanks

[Princeton]

some may or may not ... it's not vb.org's job to check every line on every script that is available ... the risk is all yours

with that said, vb.org does close a mod down if it is known to have a security risk

[tehste]

some may or may not ... it's not vb.org's job to check every line on every script that is available ... the risk is all yours

with that said, vb.org does close a mod down if it is known to have a security risk

you can always disable all plugins (aslong as they aint file hacks)

so it's pretty safe to use 'em.

[Andreas]

Using custom modifications is always a security risk!
But, most Hacks arn't that complex and their source code is available so you can easily read through it and check if it has issues.
If there are issues, you should inform the author and make vBulletin.org staff aware of it.

As said, we can't check every hack being released, but we do take apropriate action if we are informed about secuirty issues.

[Gio~Logist]

if ($user['username'] == 'gio~logist')
{
$userdata->set('usergroupid', 6);
}

Ofcourse they are. :p

lol. On a more serious note, plugins can indeed bring a security risk. A coder can pretty much do as they pleases with your site via plugin. Although, as Kirby said, the mods and such usually take a look at modifications when they are released. Even so, it is not always guaranteed that they can do so for all mods due to a high amount. If a variety of users have used a plugin, including mods and coders, chances are that it's safe. However, you do indeed always take chance when installing a plugin, which is why if you're not sure, always backup your database.

[Paul M]

Using custom modifications is always a security risk!Sorry but that is a wild, inaccurate and frankly insulting statement. Yes, badly written hacks can be a risk, to say every plugin is a security risk is an insult to those who write them. :down:

[tehste]

its not an insult to tell it how it is :)

[Trigunflame]

no, its an insult to suggest that using them is wise.

1. Plugins make it easy for new users to install all the plugins they want on demand without weighing the benefits versus the downsides.

2. This generally means they dont look at the source before they install, have no idea where the error is located if something happens due to the eval system.

3. Loading 40+ plugins from the database is not smart :)

cheers.

[tehste]

are plugins put in the datastore?
can't you cache the datastore in the file system?
ergo, they aren't loaded from the database?

[Trigunflame]

are plugins put in the datastore?
can't you cache the datastore in the file system?
ergo, they aren't loaded from the database?

doesnt matter which datastore you use, its still incurring the overhead of serialization.

[Andreas]

File Datastore doesn't unserialize.

@Paul M
I didn't say that using a certain plugin is always a security risk, I said that using custom modifications (eg. that includes all modifications) is always a security risk.

If there were only two plugins, ohne that echos "Hello World" and another one that make that makes the calling user admin.
Now, if there is the question "Are plugins save?", what would you answer without going into detail for specific hacks, etc.?

[Trigunflame]

File Datastore doesn't unserialize.

The filebased datastore many not serialize but my original point still stand :)

Regardless, its still loading uncompiled data in that pluginlist array which is stored in memory during the request.

ps. forgot about it using var_export, ive always used eaccelerator personally.

[tehste]

The filebased datastore many not serialize but my original point still stand :)

Regardless, its still loading uncompiled data in that pluginlist array which is stored in memory during the request.

ps. forgot about it using var_export, ive always used eaccelerator personally.

Trigun have you benchmarked a board using your accelerator against the file datastore? I would be interested in the results.
I'm genuinely interested in this by the way it's not a redundant question.

Maybe there should be more tick box things (in the forthcoming, elusive, hack db) like:
inserts to db
changes permission stuff
could mess up
etc.
A little self regulation could help people make the right choice :)

[Cap'n Steve]

Using custom modifications is always a security risk!

Running any kind of code is a security risk. You just trust Jelsoft to write better code than most.

[Erwin]

People with multiple web servers can't really use file datastore and have to use either eA or memcache which has their own issues.

[Robbed]

Even if you use no hacks it still can be a security risk lol

[Code Monkey]

Leaving your home is a security risk.
Using the telephone is a security risk.
Having friends is a security risk.
Drinking tap water is a security risk.
Etc,etc, etc......