webp-express icon indicating copy to clipboard operation
webp-express copied to clipboard

Option to manually add Content Filtering Custom hooks

Open alextuan opened this issue 4 years ago • 3 comments

This pull request adds a textra box to the Use custom filtering hooks setting where the user can add any theme or plugin custom filter hooks. The textra box has Help text and is only enabled when the Use Custom Filtering Hooks option is selected. See screenshot Image from Gyazo

alextuan avatar Jul 16 '20 10:07 alextuan

Sorry, but it seems unsafe to allow custom hooks like that.

Hi Rosell, i see other pull request on latest version of plugin, it's great But about this pull request, can you tell me what you sees as issue ? Are you fear it will be able to be hacked ?

alextuan avatar Aug 13 '20 03:08 alextuan

Yes, my worry is regarding the security implications. My plugin has been taken down once because of security issues. The issue back then could only happen when a logged in user entered something nasty on the settings screen. So apperently, the policy is that we cannot trust that logged in users aren't hackers. I'm not sure it is a good idea to let hackers trigger custom hooks.

rosell-dk avatar Aug 13 '20 08:08 rosell-dk

Do not allow users without admin caps to access/change plugin settings.

ettoredn avatar Jan 01 '21 09:01 ettoredn