4 ms·
Is it impossible to make a secure CMS? I'd think step 1 would be to not have the admin stuff with the same access as the public website, and step 2 would be to
by mavhc 5y ago
Is it impossible to make a secure CMS? I'd think step 1 would be to not have the admin stuff with the same access as the public website, and step 2 would be to have a way to sandbox plugins, but are those things possible?
- lmm 5y agoStep 1 is possible nowadays (with SNI) but was hard until recently, and I don't think practices have really caught up with that yet. Step 2 is difficult to even define properly. What is a plugin supposed to be able to do, and what is a plugin supposed to not be able to do? If you can answer that question precisely, then you can solve the problem, but if you can answer that question precisely then you probably don't need plugins in the first place.