Safe themes and plugins?

[Ricsca]

How can I be sure that the themes and plugins on

https://community.mybb.com/mods.php are safe?

For example if I go to see the last theme uploaded

https://community.mybb.com/mods.php?acti...w&pid=1466

if I click on the Author I see that he is waiting for an email confirmation so he hasn't even clicked on the validation email but he has been able to insert a theme.

Couldn't this theme have files accessing the database or server?


Thanks

[Matt]

All uploads are reviewed, although we can never guarantee there are no issues with them regardless of who's uploaded them. I have raised internally about requiring account activation first though. I've also checked this one out and it's just theme XML files and I can't see any issues with anything inside them.

[Crazycat]

Unless it has changed, the submissions from untrusted users are reviewed and need team approval.

@Matt : what about having a review team, volunteer-based*, to approve (or refuse) submissions in extend part ?

* not from the team, I think they already lack time to spent

[sarisisop]

There is a list of Vulnerable Submissions at the bottom for plugins: https://community.mybb.com/mods.php?acti...erablesubs

[lkop]

Unless it has changed, the submissions from untrusted users are reviewed and need team approval.

@Matt : what about having a review team, volunteer-based*, to approve (or refuse) submissions in extend part ?

* not from the team, I think they already lack time to spent

+1. extension could be in "Under development" forum section and user can download the file. extension creator will submit his extension for review if creator thinks it's ready for mybb staff team review. when staff will have time and approve the extension it will be listed on mybb official download page.

[obeyafriday]

I just love the support team here.

You guys are doing a very good work.
May God bless you all.

[xXMoeXx]

This user has been denied support.

Code is constantly changing. Even MyBB has to patch there exploits. Just going to have to take a risk. Your lucky to get a xml bomb lol. Its great the staff here manually check for sploits on the code. But, if you have an UN-experienced coder, it could be an issue.

[xilou]

You will never be sure.
The base code of MyBB is constantly evolving, which might break older Plugins and or themes

If you are in doubt, then always test on a second forum

[xXMoeXx]

This user has been denied support.

You will never be sure.
The base code of MyBB is constantly evolving, which might break older Plugins and or themes

If you are in doubt, then always test on a second forum

He's right. You can get software like acunetix and run a scan and it will find known vulnerabilities in your site. Like cross site scripting, or disclosure information and more.