Multisite Security

  • Hi,

    I’m working on a new site which uses Multisite to allow members to create their own blog but I have a few security related questions. The main one is how can I replace the HTML editor with BBCode as I feel that I could use this to prevent malicious iframes .etc from being embeded. Also, are there any other security precautions I should take?

    Thanks in advance,
    Cameron Gray

Viewing 7 replies - 1 through 7 (of 7 total)

  • They can’t embed iframes anyway; they get stripped by default. Multisite is actually more secure than regualr WordPress in that way.

    Thread Starter camerongray1515

    (@camerongray1515)

    So am I safe to just leave it as-is and there will be no way for users to integrate virus downloads/malicious java applets/javascript.etc?

    Is there a way to define a list of blocked tags?

    Look in the kses.php file and see what it blocks – by default, it works exactly like how scripts get stripped at wordpress.com blogs.

    Go try it for yourself. ??

    Is there a way to define a list of blocked tags?

    Yes, by (re)defining the lists of allowed tags. This can be done with a “mu-plugin”:

    add_filter('edit_allowedposttags', 'ds_allowedposttags');
add_filter('edit_allowedtags', 'ds_allowedtags');

function ds_allowedposttags() {
   $allowedposttags = array(
//fill this array with post tags as in wp-includes/kses.php
);
   return $allowedposttags;
}
function ds_allowedtags() {
   $allowedtags = array(
//fill this array with comment tags as in wp-includes/kses.php
);
   return $allowedtags;
}
    Thread Starter camerongray1515

    (@camerongray1515)

    Thanks for that – So I am safe to release the site without risk of viruses?

    One last thing – How can I set it up so that each user can setup their own site but so that they only have one each?

    Yes you;re safe.

    https://www.ads-software.com/extend/plugins/limit-blogs-per-user/

    Thread Starter camerongray1515

    (@camerongray1515)

    Thanks for that!

Viewing 7 replies - 1 through 7 (of 7 total)
  • The topic ‘Multisite Security’ is closed to new replies.