Question regards security

New Member Joined: Jun 19, 2006 Posts: 5

Can someone hack your web-site trough a theme? I just downloaded a free theme and I just worry that maybe if the person who made the theme did not know how to code it properly than someone could hack my site?

Thanks,
John

Posted: Mon Aug 14, 2006 11:19 pm

There is no known exploit to my knowledge but this does not mean there never will be.

Jaded-designs.com is owned by a member of this site and from my own personal look at the work, It is VERY well scripted and I would recomend you look at those themes. That is not to say other themes are not coded well, just that I know those themes are well coded.

registered · Posted: Tue Aug 15, 2006 5:39 am

Well, there actually have been patched versions of the base PHP-Nuke themes and other themes in the past. Yes, it is possible that a theme could open up a security hole. Basically, ANY code that is executed within PHP-Nuke can become the source of an exploit. Most common issues are simply variables that are not given default values (i.e., "initialize") first before using them (because some coders forget that they hadn't initialized them to a particular value first) and issues with not sanitizing GET and POST variables.

Unfortunately, unless you review the code and know what you are looking for, you won't know for certain.

Darklord is definitely right on when he says this:

Quote:

There is no known exploit to my knowledge but this does not mean there never will be.

Not trying to scare you. If the theme designer is "reputable", I think you can rest more easy. But, we're just making sure that you understand that in reality ALL code you implement can have problems. We just make our judgements, make sure we have good backups always, and enjoy what we do... Wink