{"action":"closed","issue":{"url":"https://api.github.com/repos/unclebob/fitnesse/issues/702","repository_url":"https://api.github.com/repos/unclebob/fitnesse","labels_url":"https://api.github.com/repos/unclebob/fitnesse/issues/702/labels{/name}","comments_url":"https://api.github.com/repos/unclebob/fitnesse/issues/702/comments","events_url":"https://api.github.com/repos/unclebob/fitnesse/issues/702/events","html_url":"https://github.com/unclebob/fitnesse/issues/702","id":65580159,"number":702,"title":"Customization via FitNesseRoot/files - Security Risk? ","user":{"login":"six42","id":5906592,"avatar_url":"https://avatars.githubusercontent.com/u/5906592?v=3","gravatar_id":"","url":"https://api.github.com/users/six42","html_url":"https://github.com/six42","followers_url":"https://api.github.com/users/six42/followers","following_url":"https://api.github.com/users/six42/following{/other_user}","gists_url":"https://api.github.com/users/six42/gists{/gist_id}","starred_url":"https://api.github.com/users/six42/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/six42/subscriptions","organizations_url":"https://api.github.com/users/six42/orgs","repos_url":"https://api.github.com/users/six42/repos","events_url":"https://api.github.com/users/six42/events{/privacy}","received_events_url":"https://api.github.com/users/six42/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/unclebob/fitnesse/milestones/14","html_url":"https://github.com/unclebob/fitnesse/milestones/Next%20release","labels_url":"https://api.github.com/repos/unclebob/fitnesse/milestones/14/labels","id":1495734,"number":14,"title":"Next release","description":"","creator":{"login":"amolenaar","id":96249,"avatar_url":"https://avatars.githubusercontent.com/u/96249?v=3","gravatar_id":"","url":"https://api.github.com/users/amolenaar","html_url":"https://github.com/amolenaar","followers_url":"https://api.github.com/users/amolenaar/followers","following_url":"https://api.github.com/users/amolenaar/following{/other_user}","gists_url":"https://api.github.com/users/amolenaar/gists{/gist_id}","starred_url":"https://api.github.com/users/amolenaar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/amolenaar/subscriptions","organizations_url":"https://api.github.com/users/amolenaar/orgs","repos_url":"https://api.github.com/users/amolenaar/repos","events_url":"https://api.github.com/users/amolenaar/events{/privacy}","received_events_url":"https://api.github.com/users/amolenaar/received_events","type":"User","site_admin":false},"open_issues":4,"closed_issues":24,"state":"open","created_at":"2016-01-10T21:41:17Z","updated_at":"2016-03-30T00:14:18Z","due_on":null,"closed_at":null},"comments":3,"created_at":"2015-04-01T01:18:08Z","updated_at":"2016-03-30T00:14:18Z","closed_at":"2016-03-30T00:14:18Z","body":"FitNesse can be customized by placing files in the below folders. These folders are read and writable via the Wiki by any FitNesse user.\r\nIs this not a security leak?\r\n\r\nCustomization is good. But should this not better be limited to users which can access the folders directly on the server?\r\n  \r\n\r\nFitNesseRoot/files/fitnesse/javascript\r\nFitNesseRoot/files/fitnesse/templates\r\nFitNesseRoot/files/fitnesse/css\r\n\r\nSee also: FitNesseRoot/files/fitnesse/README.txt"}}