4 ms·
Take what you're describing, make it secure and legal. Then what you have is called automatic updates. Which is exactly what Drupal should do and Wordpress did
by hannob 9y ago
Take what you're describing, make it secure and legal. Then what you have is called automatic updates.
Which is exactly what Drupal should do and Wordpress did many years ago. It works.
- chrismorgan 9y agoThat auto-updating is even possible from the web server process is itself a very severe security vulnerability. I haven’t used Drupal since the 6 days, but back then and earlier the recommended deployment policy had the files directory (for uploads) as the only directory that the server process could write to—the code was definitely to be read-only. I think this was also checked by the system so that it would produce a warning were it not so. In such a world, RCE isn’t quite so scary. Not quite. (Yeah, PHP code in the database and all that.) In practice, shared hosting doesn’t tend to take kindly to genuine read-only-ness, and so the grand ideal of not being able to inject persistent code doesn’t work quite so well. I really don’t like the way Wordpress does it, but the way Drupal does it also isn’t great. I don’t like the security models of any of these PHP things.
- blowski 9y agoI use WordPress CLI and do the automatic updates with cron. I host on Digital Ocean, and the www-data user can’t write to any WordPress directory.