adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-11-03 07:22:22 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

make allow_html_descriptions false by default #1986

New Issue
Open
opened 2026-10-05 01:03:11 +02:00 by adam · 4 comments
adam commented 2026-10-05 01:03:11 +02:00
Owner
Copy link
Copy source

9 out of 10 "security" issues we received are the same: logged in as an administrator, you can insert HTML (thus loading remote javascript) in a photo title/description.

This is not a security issue. I have been repeating it for years. Nevertheless, students in software security don't seem to accept that and keep posting about this "security issue" (which is not one).

Let's deactivate $conf['allow_html_descriptions']by default and we should get less of these "security reports" and focus on the real ones, when they're discovered.

I know it's going to be a problem for FCK Editor or Editor Plus users.

See #1936 or #1829 or #1148 (but so many more, every new week)

9 out of 10 "security" issues we received are the same: logged in as an administrator, you can insert HTML (thus loading remote javascript) in a photo title/description. This is not a security issue. I have been repeating it for years. Nevertheless, students in software security don't seem to accept that and keep posting about this "security issue" (which is not one). Let's deactivate `$conf['allow_html_descriptions']`by default and we should get less of these "security reports" and focus on the real ones, when they're discovered. I know it's going to be a problem for FCK Editor or Editor Plus users. See #1936 or #1829 or #1148 (but so many more, every new week) <!-- github-sync-id:2698193991 -->
adam commented 2026-10-05 01:03:12 +02:00
Author
Owner
Copy link
Copy source

What about using https://github.com/ezyang/htmlpurifier ? cc @LintyDev

What about using https://github.com/ezyang/htmlpurifier ? cc @LintyDev <!-- github-comment-id:2563087878 -->
adam commented 2026-10-05 01:03:12 +02:00
Author
Owner
Copy link
Copy source

I found a cool use for HTML in descriptions; in this gallery, I have links to highscore/leaderboards, with HTML to open in new tabs (notes).

I'd be somewhat concerned about random users on my instance being able to use HTML freely like that, but I think it'd be good op-sec practice to require users to learn about this topic and disable the HTML themselves.

I found a cool use for HTML in descriptions; [in this gallery](https://media.realmofespionage.xyz/index/category/4), I have links to highscore/leaderboards, with HTML to open in new tabs ([notes](https://wiki.realmofespionage.xyz/servers;windows;nginx;piwigo#old_school_runescape)). I'd be somewhat concerned about random users on my instance being able to use HTML freely like that, but I think it'd be good op-sec practice to require users to learn about this topic and disable the HTML themselves. <!-- github-comment-id:2600276101 -->
adam commented 2026-10-05 01:03:13 +02:00
Author
Owner
Copy link
Copy source

FCK Editor or Editor Plus users can handle it, displaying a warning message with a link to activate it, then the plugin change that conf itself

FCK Editor or Editor Plus users can handle it, displaying a warning message with a link to activate it, then the plugin change that conf itself <!-- github-comment-id:2600280346 -->
adam commented 2026-10-05 01:03:14 +02:00
Author
Owner
Copy link
Copy source

I'd be somewhat concerned about random users on my instance being able to use HTML freely like that

Who said any random user could inject some HTML on your pages? I didn't :-) Only administrators can do that. That's the whole point of the "issue". Newbie hackers consider that being able to insert HTML as an administrator is a serious security issue. I don't. But they come over and over saying it's a security issue and when I say it's not a security issue, they say Piwigo don't consider security as a serious matter and communicate about it. We don't have the ressources to fight against this low level of understanding (or maybe that's me who don't understand the real problem) so a simple way to "fix" this issue is to block HTML by default.

> I'd be somewhat concerned about random users on my instance being able to use HTML freely like that Who said any random user could inject some HTML on your pages? I didn't :-) Only administrators can do that. That's the whole point of the "issue". Newbie hackers consider that being able to insert HTML as an administrator is a serious security issue. I don't. But they come over and over saying it's a security issue and when I say it's not a security issue, they say Piwigo don't consider security as a serious matter and communicate about it. We don't have the ressources to fight against this low level of understanding (or maybe that's me who don't understand the real problem) so a simple way to "fix" this issue is to block HTML by default. <!-- github-comment-id:2601012387 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#1986