The Loop

« first day (2383 days earlier) ← previous day next day → last day (2557 days later) »

2:44 PM

Question about security...

Is it "good enough" to just validate... and Bail if fail? Make the user correct the information and reprocess? Or should you validate AND also sanitize?

kraftner

Depending on the situation validation may be way easier than sanitizing. And also safer. Because trying to "fix" the input is another thing that can go wrong.
I'd say this is also more a question of UX than of security. Are you even capable of sanitizing with keeping the intention of the user? On the other hand is forcing the user to correct his input if it may be obvious what was intended bad UX?

So for example if we're talking about a password and your validation rule is "does not contain html tags". Validation can just fail. But you can't sanitize this. Because just stripping the html will result in another password the user is not expecting.

Tom J Nowell

3:24 PM

@MichaelEcklund when the data comes in and the data is incorrect, can you provide more context? As well as what you'd want to do with it if you didn't bail?

validation and sanitisation aren't really the same thing

this is one of those things that isn't very well defined, it's a nebulous question

Michael Ecklund

So when do you validate and when do you sanitize then?

Tom J Nowell

on save/input processing

but it's not so simple

if data comes in I might sanitise it then validate the result

or i could validate, and if it fails, bail

afterall if i'm bailing and I know it's bad, why sanitise if there's no saving or output

but if I'm going to tell the user why it failed, it depends even more on context

I might say that URL is bad, or I might pre-fill the input with the bad URL

at which point, it's not sanitising, it's escaping that you want

kraftner

@MichaelEcklund Maybe you can tell us what exactly you're doing.

Tom J Nowell

fundamentally your question is very broad

the only real answer that would be correct is "it depends"

votes to close as offtopic. reason: too broad

kraftner

Michael Ecklund

3:29 PM

I've got my own "framework". MU Plugins, Plugins and Themes all communicate together. I'm just trying to secure the data which is passed around during communication.

Tom J Nowell

so you have input, and you don't know how it's going to be used?

Michael Ecklund

Functions have expectations. That's where I validate. However, that function might add to or manipulate the data. at which point, I'm currently sanitizing.

So nevermind, forget I said anything. I've got it figured out.

kraftner

It really depends on what that function is doing. If you need to continue, no matter what. Try to sanitize the data. If you have the option to just fail if validation fails you can do this. Maybe both. In whatever order. One can't generally answer this.

Michael Ecklund

You explained it well there.

Christine Cooper

3:46 PM

register_taxonomy() lets you register a taxonomy but doesn't have an argument for metabox priority. Makes sense.

kraftner

@ChristineCooper What?

Mark Kaplun

always makes sense, otherwise life would have been boring ;)

kraftner

You mean for the default Metabox UI?

Mark Kaplun

but user can rearnge so in real life not a big issue

Christine Cooper

When you register a taxonomy, you can't set the priority of how the meta box is displayed. For example, you can't push the meta box to the top ("high", "low" etc).

kraftner

3:48 PM

You can. Just not on registering the taxonomy and that is fine I think. The register call is huge already and this is not something always needed. E.g. I often register taxonomies without the default UI.

Christine Cooper

There is of course this solution: wordpress.stackexchange.com/questions/40701/… -- but my point being that we should be able to set this when registering the tax.

kraftner

I disagree for the above reasons.

Christine Cooper

We have to agree to disagree then. ;-)

Mark Kaplun

display should be disconnect with decleration

the problem is that core lets you set the metabox at decleration :(

kraftner

I think the mere fact that the registration of the default UI is tied to the call to register the taxonomy is already a mistake.

Mark Kaplun

3:53 PM

sure

Christine Cooper

I feel like complaining today my friends. Don't kill the buzz. :P

Mark Kaplun

lol, do we ever do anything else here :)

.... well at least me :)

(which reminds me that I haven't complained for few days.... should work on it at the weekend)

Michael Ecklund

4:53 PM

@ChristineCooper You can easily rearrange Meta Boxes in the global $wp_meta_boxes; variable. But yeah, that would be a nice feature to implement while registering the Taxonomy. Open a feature request.

2 hours later…

Mark Kaplun

6:52 PM

some days it is just such a joy around here

flag

A wordpress noob is literally a compliment. I work on enterprise websites with thousands of users and massive budgets, massive CMS using real CMS like Drupal and make twice as much money as you. Maybe three times. So yeah. I am a wordpress noob who doesn't know how to use this garbage proprietary anti-logic poorly coded PHP application. I figured out the solution BTW with some code, a hook into Wp_update_term. Wordpress is garbage. And you're butthurt lmaooo

lol drupal people, and I thought they are too busy doing sex to have time for platform arguments

anyway this guy reminded me that one of the greatest joys of being a freelance is the ability to have control over the people you work with

Feeds

Podcast #106: Data Team Assemble!

Jess Pardue on April 25, 2017

Welcome back to the Stack Overflow podcast episode #106 recorded live on Thursday, April 20th at SO headquarters in NYC. We are honored to have Anil Dash, CEO of Fog Creek, leading today’s antics while Joel is away. We are also joined by the entire SO Data Team; Kevin Montrose, Jason Punyon, Dr Julia Silge, Nick Larsen, and Dr Dave Robinson.

In today’s episode you will find: mystery, intrigue, and mangoes! As well as…

Kevin drinks two whole unicorn fraps.

Jay rants about the people who rant about babies on planes. …

2 hours later…

Michael Ecklund

9:03 PM

I tried Drupal one time and instantly went back to WordPress.

I got really mad at the upgrade process too. There was a major version update which required manual interaction. Couldn't be automatically updated. To my knowledge... WordPress has never done that.

That Brazilian Guy

I work at an university that has 200+ sites (and those are just the documented ones), after a migration that was supposed to happen to Drupal, and after more than one and a half years, the team basically said: "Please, let us ditch Drupal and use WordPress".

Well, we had a majority of Joomla sites and were ditching Drupal, there were not many other choices...

@MichaelEcklund Drupal 7 to Drupal 8 broke compatibility in exciting and amazing ways!

« first day (2383 days earlier) ← previous day next day → last day (2557 days later) »

all rooms

Transcript for

Apr24

Apr '1725

Apr26

Where humor doesn’t work.

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC