WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]
1–10 of 127 posts
Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]
#2What was the quirk?
Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]
#3What was the quirk?
> A feature known as the Download Monitor plug-in created a webpage with the clear URL which provided a link to the live version, which bypassed the need for authentication. This rendered the protections on the ‘future’ function of WordPress redundant as it bypassed the required authentication needed to gain access to the pre-uploaded document.
WordPress is a nice piece of software, but the plugin situation is getting worse and worse. (Too many pending updates, premium features and constant upselling, selling of plugins to new sketchy owners...)
Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]
#4Why are government organisations which handle sensitive information using Wordpress?
Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]
#5Why are government organisations which handle sensitive information using Wordpress?
There's not anything obviously wrong with using WordPress for publishing documents like this - they are meant to be public after all.
The problem was essentially that, through a misconfiguration, they published it early.
Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]
#6What was the quirk?
> A feature known as the Download Monitor plug-in created a webpage with the clear URL which provided a link to the live version, which bypassed the need for authentication. This rendered the protections on the ‘future’ function of WordPress redundant as it bypassed the required authentication needed to gain access to the pre-uploaded document. WordPress is a nice piece of software, but the plugin situation is gettin…
The main issue is that there isn't any governance to the plugin store. Once you have a plugin in there, you have free reign to do whatever you want with it. Getting it in there is a PITA though. For example, a library author and I created a plugin, but they wouldn't let me submit it because I wasn't the other author, and they wouldn't let him submit it because he wasn't me. True story.
Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]
#7What was the quirk?
> A feature known as the Download Monitor plug-in created a webpage with the clear URL which provided a link to the live version, which bypassed the need for authentication. This rendered the protections on the ‘future’ function of WordPress redundant as it bypassed the required authentication needed to gain access to the pre-uploaded document. WordPress is a nice piece of software, but the plugin situation is gettin…
> which provided a link to the live version
Even if that is the case, the backend must validate.
Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]
#8There's a couple of passing mentions of Download Monitor, but also the timeline strongly implies that a specific source was simply guessing the URL of the PDF long before it was uploaded
I'm not clear from the doc which of these scenarios is what they're calling the "leak"
Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]
#9For those of you not closely following UK politics: the Office for Budget Responsibility (OBR) mistakenly published their Economic and Fiscal Outlook (EFO) document 40 minutes early, pre-empting the announcements by the Chancellor.
This is being treated as an incredibly big deal here: https://www.bbc.co.uk/news/articles/cd74v35p77jo
Re: WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]
#10What was the quirk?
> A feature known as the Download Monitor plug-in created a webpage with the clear URL which provided a link to the live version, which bypassed the need for authentication. This rendered the protections on the ‘future’ function of WordPress redundant as it bypassed the required authentication needed to gain access to the pre-uploaded document. WordPress is a nice piece of software, but the plugin situation is gettin…
My favorite current plugin woe is where it completely changes what it does but keeps the same name and it's all a part of its 'update'