Blog post id enumeration can lead to unwanted information disclosure

Re:Blog post id enumeration can lead to unwanted information... by mschuster91 on Monday February 29, 2016 @03:25AM (#11194254)

> I did mention another common way to prevent this is to have a content staging site, where all your content is edited; this should ideally be _completely_ separate from the public site. When content is published, it's published to the main site from the staging site.

Modern non-enterprise CMSes make this very hard. Wordpress and Drupal mix configuration and content all over their databases, and there's no "sync this content from stage to prod" that works reliably (i.e. they fail as soon as there is a single non-standard plugin loaded).

I haven't evaluated Drupal 8 yet, but I'm not counting my hopes too high.

[ Parent | on HN ]

Re:Blog post id enumeration can lead to unwanted information... by geerlingguy on Monday February 29, 2016 @08:15AM (#11195229)

There are other systems (and a few open source modules/configurations) that do this for Drupal, at least, like https://www.acquia.com/products-services/acquia-content-hub

It's a lot easier in 8 since it has an API-driven design for content entities.

[ Parent | on HN ]