7 ms·

God I love the idea of ownCloud so much but secretly hope it's not written in PHP. I run a wordpress site for 3 years, and one day a hacker took my site over w

by est 13y ago

God I love the idea of ownCloud so much but secretly hope it's not written in PHP. I run a wordpress site for 3 years, and one day a hacker took my site over with a bug from a plugin.

deleted 13y ago
[deleted]
rabino 13y ago
Indeed, that's proof that PHP is bad. And that all other frameworks in other languages don't have bugs that can be exploited.
- krapp 13y ago
  (cough yaml parser cough) ... indeed.
SunboX 13y ago
Something like this will happen with any bad written code. It's not PHP related. But you are right, PHP makes it easy to write bad code. There's no "security" layer build in. I hope ownCloud gets public enought to be secure. If more eyes look at the source they will hopfully do a good job.
camus2 13y ago
well, you had a problem with a badly written wordpress plugin ,not PHP. or are you saying PHP is insecure and no insecure code can be written in other plateforms ? for a project to be popular amongs developers and hobbyists , it has to be written in PHP, because PHP is easy to deploy even if you dont know PHP. By the way, most CMSes on other plateforms assume you know the language , PHP CMSes dont, so maybe there is some effort to be made on these plateform to make thing easier or write better docs. Wordpress would not be popular if it was in Python,Ruby or Java. Anyway the issue is with Wordpress plugin architecture , not PHP. A clean plugin architecture would require some kind of DSL instead of plain PHP.
- est 13y ago
  > you had a problem with a badly written wordpress plugin The plugin is top 10 popular one > because PHP is easy to deploy even if you dont know PHP. Wordpress has clean URL, but under the hood many .php files are directly accessible via URL, so hacker found a exploit, crafted a parameter aginst one particular .php, and got in. The solution? Limit URL entry to only one .php file (like index.php), more rewrite configs and mod_security. So you lost the benefit of copy-to-update, it becomes just as hard like other language/frameworks. As ownCloud community grows, I think this problem will surf again and it will end up like many PHP forum/CMS today. You can put up a usable site very quickly, but once or few months you have to patch the system, and many plugins you need most are abandon-ware.
  - krapp 13y ago
    What plugin was it, and did you report the issue, and was this recent?
  - dspillett 13y ago
    * > > you had a problem with a badly written wordpress plugin > The plugin is top 10 popular one* Popular !== Good (where in this case good is in the context of being well written) > so hacker found a exploit, crafted a parameter aginst one particular .php, and got in That could happen with almost any laguage/framework though. While PHP makes it easy to write bad code (as do other options) it doesn't make it impossible to write secure code and you can't blame PHP and/or Wordpress for every bad plugin out there, even the massively popular ones.
mverwijs 13y ago
> hope it's not written in PHP. It is though.
carsonreinke 13y ago
What are you talking about? You have written off PHP because of a WordPress plugin issue.
laumars 13y ago
I hate PHP as a language, I really do, but bugs can happen in any language (eg C++ bugs are exploited all the time to gain machine access). Plus when you get a platform as popular as Wordpress, you'll find that it will constantly be under attack from 'hackers' who bank on people being slow to update their plugins. With regards to ownCloud, that is PHP by the way.

by est 13y ago

God I love the idea of ownCloud so much but secretly hope it's not written in PHP. I run a wordpress site for 3 years, and one day a hacker took my site over with a bug from a plugin.

deleted 13y ago

[deleted]

rabino 13y ago

Indeed, that's proof that PHP is bad. And that all other frameworks in other languages don't have bugs that can be exploited.

krapp 13y ago
(cough yaml parser cough) ... indeed.

SunboX 13y ago

Something like this will happen with any bad written code. It's not PHP related. But you are right, PHP makes it easy to write bad code. There's no "security" layer build in. I hope ownCloud gets public enought to be secure. If more eyes look at the source they will hopfully do a good job.

camus2 13y ago

well, you had a problem with a badly written wordpress plugin ,not PHP. or are you saying PHP is insecure and no insecure code can be written in other plateforms ? for a project to be popular amongs developers and hobbyists , it has to be written in PHP, because PHP is easy to deploy even if you dont know PHP. By the way, most CMSes on other plateforms assume you know the language , PHP CMSes dont, so maybe there is some effort to be made on these plateform to make thing easier or write better docs. Wordpress would not be popular if it was in Python,Ruby or Java. Anyway the issue is with Wordpress plugin architecture , not PHP. A clean plugin architecture would require some kind of DSL instead of plain PHP.

est 13y ago
> you had a problem with a badly written wordpress plugin The plugin is top 10 popular one > because PHP is easy to deploy even if you dont know PHP. Wordpress has clean URL, but under the hood many .php files are directly accessible via URL, so hacker found a exploit, crafted a parameter aginst one particular .php, and got in. The solution? Limit URL entry to only one .php file (like index.php), more rewrite configs and mod_security. So you lost the benefit of copy-to-update, it becomes just as hard like other language/frameworks. As ownCloud community grows, I think this problem will surf again and it will end up like many PHP forum/CMS today. You can put up a usable site very quickly, but once or few months you have to patch the system, and many plugins you need most are abandon-ware.
- krapp 13y ago
  What plugin was it, and did you report the issue, and was this recent?
- dspillett 13y ago
  * > > you had a problem with a badly written wordpress plugin > The plugin is top 10 popular one* Popular !== Good (where in this case good is in the context of being well written) > so hacker found a exploit, crafted a parameter aginst one particular .php, and got in That could happen with almost any laguage/framework though. While PHP makes it easy to write bad code (as do other options) it doesn't make it impossible to write secure code and you can't blame PHP and/or Wordpress for every bad plugin out there, even the massively popular ones.

mverwijs 13y ago

> hope it's not written in PHP. It is though.

carsonreinke 13y ago

What are you talking about? You have written off PHP because of a WordPress plugin issue.

laumars 13y ago

I hate PHP as a language, I really do, but bugs can happen in any language (eg C++ bugs are exploited all the time to gain machine access). Plus when you get a platform as popular as Wordpress, you'll find that it will constantly be under attack from 'hackers' who bank on people being slow to update their plugins. With regards to ownCloud, that is PHP by the way.