WordPress plugin security enhancements
|Reported by:||moonman239||Owned by:|
Let me just suggest a few things to enhance the security of the WordPress CMS:
1) Change the file extension for plugins. That way, WordPress can monitor the plugins to ensure they are doing no harm.
2) Once that is done, make it so that the only way the plugins can "mess" with the blog is through the Plugin API.
3) Implement a code-signing system. Tell the user if the plugin has not been signed by a trusted authority, or if the signature is invalid.
4) (maybe) Implement a permissions-based system. Let the user set what each plugin is allowed to do. For example, he can allow or deny a plugin permission to write on his blog.