thank you very much for your feedback, I am very grateful to you for studying the script in detail, I have not had such detailed criticism from anyone before. I will gradually take your comments into account, because what I do is very important to me, and I also want it to be useful for others. useful and painless. If you can help me at least a little with solutions - I will really look forward to your letter downgra…
Replying with a ChatGPT response doesn't quite convey sincerity I'd say.
I prefer to post issues to the public because that benefits more people in general. Not always true for security issues, but somehow miraculously, I didn't spot any severe issue to warrant that yet. So the following is a bit more detailed explanation for each item. "No error handling." You need to check absolutely any unexpected situation in general. For example, I can easily trigger a PHP warning with a null charact…
did you test the version on the site, what about the version on github? the difference between them is half a year, and several releases. the site has the very first version of the script, naturally there were errors then, but I thought you were looking at the latest
I only looked at Github and didn't realize the website used an older version until you said so. (I wondered why admin.php didn't seem to exist.) These issues are so well-known enough that I didn't even have to run the script at all.
did you test the version on the site, what about the version on github? the difference between them is half a year, and several releases. the site has the very first version of the script, naturally there were errors then, but I thought you were looking at the latest
I only looked at Github and didn't realize the website used an older version until you said so. (I wondered why admin.php didn't seem to exist.) These issues are so well-known enough that I didn't even have to run the script at all.
the admin panel can be renamed. this does not affect the functionality. they are not linked. it may not exist at all
another addition - the system is single-user, it was created for a business card site, not for a blog or a corporate site, there can't be more than one user here. that's the idea, it's made for small net, it's not another wordpress with frameworks, it's created for the simplest tasks
I only looked at Github and didn't realize the website used an older version until you said so. (I wondered why admin.php didn't seem to exist.) These issues are so well-known enough that I didn't even have to run the script at all.
the admin panel can be renamed. this does not affect the functionality. they are not linked. it may not exist at all another addition - the system is single-user, it was created for a business card site, not for a blog or a corporate site, there can't be more than one user here. that's the idea, it's made for small net, it's not another wordpress with frameworks, it's created for the simplest tasks
Yes that was what I assumed, but it ideally should be safe without the renaming. Security by obscurity only works to the limited extent.
the admin panel can be renamed. this does not affect the functionality. they are not linked. it may not exist at all another addition - the system is single-user, it was created for a business card site, not for a blog or a corporate site, there can't be more than one user here. that's the idea, it's made for small net, it's not another wordpress with frameworks, it's created for the simplest tasks
Yes that was what I assumed, but it ideally should be safe without the renaming. Security by obscurity only works to the limited extent.
and by the way - thank you very much for your comments, you really help, I will try to take into account all these points, it is impossible to take everything into account at once, this is a human factor, in general I thought to expand the functionality a little, but you showed me the problems that need to be (and can be) solved. nevertheless, if you have a solution to the problems, you know my email, I will be very grateful. although you have already saved me a lot of time without this. thank you
XSS in action: alert('xss') " rel="nofollow">http://old.net.eu.org/index.php?p= alert('xss...
There is a newer version on GitHub, and the very first version is on this site. Compare them and you will see the difference.
I compared them - and you're still not sanitising the $_POST inputs amongst some other bad practices. So it's great that you've made this and put a substantial number of hours into creating themes for it - but in it's current state (looking at all the branches in your github) it's not fit for purpose.
If you hosted this online, you're simply providing a platform for malicious users to gather targets or worse.
What was/is the goal of this project? To make the smallest CMS? To try your hand at making a CMS and to learn from it? This is unclear.
There is a newer version on GitHub, and the very first version is on this site. Compare them and you will see the difference.
I compared them - and you're still not sanitising the $_POST inputs amongst some other bad practices. So it's great that you've made this and put a substantial number of hours into creating themes for it - but in it's current state (looking at all the branches in your github) it's not fit for purpose. If you hosted this online, you're simply providing a platform for malicious users to gather targets or worse. What wa…
On github under the first two screenshots I very clearly expressed why I created this, the root cause was and remains the same, I want to continue to improve this script, but the most important task for me was backward compatibility, and simplicity. I love old time-tested technologies, this script (but improved) with additional functionality works as an admin panel on the hosting. I indicated this in the topic. on the hosting site there is our common goal - we are creating a community
if you have a solution - I will be happy to consider it and use it
P.S. the script does not collect cookies and works on text files. That's probably why this method