Eventually commons could consider shipping with http://drupal.org/project/paranoia but for now just disabling php filter seems like a good idea, unless there is any php in block visibility, views headers/fields, etc.

CommentFileSizeAuthor
#3 add-and-enable-paranoia-1569574-3.patch1.33 KBDevin Carlson
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

ezra-g’s picture

ezra-g CreditAttribution: ezra-g commented
Title: disable php filter by default » Add and enable Paranoia module by default
Version: 6.x-2.x-dev »
Issue tags: +Commons 7.x-3.3 radar

Retitling, bumping to 7.x, and tagging for 3.3 radar.

ezra-g’s picture

ezra-g CreditAttribution: ezra-g commented

Also, we should verify that commons_admin_permissions() doesn't undo the work of the Paranoia module on user permissions.

Devin Carlson’s picture

Devin Carlson CreditAttribution: Devin Carlson commented
Assigned: Unassigned » Devin Carlson
Status: Active » Needs review
FileSize
add-and-enable-paranoia-1569574-3.patch1.33 KB

A patch to include the Paranoia module with Commons with an update hook to enable the module.

ezra-g’s picture

ezra-g CreditAttribution: ezra-g commented
Version: » 7.x-3.x-dev
Status: Needs review » Fixed

I updated the update # and committed.

Thanks!

http://drupalcode.org/project/commons.git/commit/fa41d04

Automatically closed -- issue fixed for 2 weeks with no activity.