Request - Framework for Secure Legacy Plugins

[vbresults]

From this:

PHP Code:

($hook = vBulletinHook::fetch_hook('global_start')) ? eval($hook) : false; 


To this:

PHP Code:

foreach (vBulletinHook::fetch_hook_includes("global_start") as $filename) {
    include_once $filename;
} 


In other words, drop each plugin's phpcode to the filesystem. From there, we can generate md5 sums corresponding to each plugin of each product and distribute them with a md5 sum php file, and add it to the built in file integrity checking tool.

We'd be dropping the plugin table's phpcode column, putting the php code in files, and the execution order as a prefix to the filenames. This requires plugins to be formatted differently, and a conversion tool for old plugins.

That said, conversion is simple, non-destructive, and there's not a lot of room for bugs, except references to the deleted phpcode column. It eliminates the use of the datastore that keeps sites infected, increases performance, and enables the use of file scanning tools.