From a790edbb7e041bea7cbad394d6e48534fb9e68f9 Mon Sep 17 00:00:00 2001 From: Tim Starling Date: Thu, 4 May 2006 06:12:47 +0000 Subject: [PATCH] security concerns --- includes/cbt/README | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/includes/cbt/README b/includes/cbt/README index 1f565e0d1e..cffcef2f21 100644 --- a/includes/cbt/README +++ b/includes/cbt/README @@ -43,6 +43,10 @@ The problems I saw were: * Syntax. The syntax is minimalistic and easy to parse, but can be quite ugly. Will generations of MediaWiki users curse my name? +* Security. The code produced by TemplateCompiler is best stored in memcached + and executed with eval(). This allows anyone with access to the memcached port + to run code as the apache user. + Template syntax --------------- -- 2.20.1