BeBot - An Anarchy Online and Age Of Conan chat automaton
Development => Coding and development discussion => Topic started by: Glarawyn on January 29, 2008, 06:55:01 am
-
When I originally developed Security.php I planned on making the cache and other functions private so that other modules could not directly modify the Security cache. I then realized that the documentation I was looking at was for PHP5, and what I was doing would not work in PHP4.
Thus the design had to change, and security functions and the entire cache is exposed to any module that wants to poke at it.
Now that we're going to PHP5 Security could be done as originally envisioned, however it may have consequences if any modules are directly accessing the security cache, using cache_mgr, etc.
The question is, should Security be updated to take advantage of the new options for private class functions and variables in PHP5, or should we leave it as is and call it secure enough for our purpose?
-
Glarawyn, Before I ask this. I do know a little bit about bebot but not enough to know the impacts of this.
If we left it as is, what are the possible scenarios that could happen?
Not sure if anyone else would really ask this, so I figured I would give it a shot. this was the first thing that I thought of.
I know it is possible to make some devastating security holes by putting in modules that you do not even look at. But what would be the worse case scenarios if you left it as is?
-
The biggest worry for security is someone coding a module that would parse your bot.conf and send them your AO username/password. There is nothing the security module can really do about that one. ;)
Possibly the worst thing someone could do is:
$this -> bot -> security -> cache = array();
Which would basically ban everyone until the bot was restarted or the 12 hour cron job came around and refreshed the security cache.
I'm leaning to the leave it as is myself, but I haven't decided yet.
-
I'd classify this as "it'd be nice, but not really a priority".