Security hole in TextformatterHannaCode?

[MarkE]

Just posting this here as I raised an issue some time ago about TextformatterHannaCode module, which has not been responded to or addressed (see https://processwire.com/talk/topic/3745-hanna-code/page/18/?tab=comments#comment-217245  and https://github.com/ryancramerdesign/ProcessHannaCode/issues/26). I have also recently raised a PR (https://github.com/ryancramerdesign/ProcessHannaCode/pull/27) to fix it.

Essentially the problem is that, if you have a PHP Hanna Code which is namespaced (ProcessWire), then the module will remove the namespace (irritating in itself), but also (and maybe more seriously) it will omit the line

if(!defined("PROCESSWIRE")) die("no direct access");

which is potentially a security weakness.

The PR is a simple one-word fix.

[WillyC]

not security hole
  files  .in /site/assets/cache/HannaCode not
web access-ible so      
no need to die() 

[MarkE]

1 hour ago, WillyC said:

no need to die() 

That’s good (although @ryanobviously wanted to include it for some reason). The namespacing issue is still a problem, though, so I think the fix is needed.