{"action":"opened","issue":{"url":"https://api.github.com/repos/silverstripe/silverstripe-admin/issues/831","repository_url":"https://api.github.com/repos/silverstripe/silverstripe-admin","labels_url":"https://api.github.com/repos/silverstripe/silverstripe-admin/issues/831/labels{/name}","comments_url":"https://api.github.com/repos/silverstripe/silverstripe-admin/issues/831/comments","events_url":"https://api.github.com/repos/silverstripe/silverstripe-admin/issues/831/events","html_url":"https://github.com/silverstripe/silverstripe-admin/issues/831","id":412212678,"node_id":"MDU6SXNzdWU0MTIyMTI2Nzg=","number":831,"title":"Remove thirdparty/jstree demo code","user":{"login":"chillu","id":111025,"node_id":"MDQ6VXNlcjExMTAyNQ==","avatar_url":"https://avatars3.githubusercontent.com/u/111025?v=4","gravatar_id":"","url":"https://api.github.com/users/chillu","html_url":"https://github.com/chillu","followers_url":"https://api.github.com/users/chillu/followers","following_url":"https://api.github.com/users/chillu/following{/other_user}","gists_url":"https://api.github.com/users/chillu/gists{/gist_id}","starred_url":"https://api.github.com/users/chillu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chillu/subscriptions","organizations_url":"https://api.github.com/users/chillu/orgs","repos_url":"https://api.github.com/users/chillu/repos","events_url":"https://api.github.com/users/chillu/events{/privacy}","received_events_url":"https://api.github.com/users/chillu/received_events","type":"User","site_admin":false},"labels":[{"id":577495320,"node_id":"MDU6TGFiZWw1Nzc0OTUzMjA=","url":"https://api.github.com/repos/silverstripe/silverstripe-admin/labels/affects/v4","name":"affects/v4","color":"5319e7","default":false},{"id":587716139,"node_id":"MDU6TGFiZWw1ODc3MTYxMzk=","url":"https://api.github.com/repos/silverstripe/silverstripe-admin/labels/change/patch","name":"change/patch","color":"fef2c0","default":false},{"id":587716147,"node_id":"MDU6TGFiZWw1ODc3MTYxNDc=","url":"https://api.github.com/repos/silverstripe/silverstripe-admin/labels/effort/easy","name":"effort/easy","color":"c2e0c6","default":false},{"id":587716222,"node_id":"MDU6TGFiZWw1ODc3MTYyMjI=","url":"https://api.github.com/repos/silverstripe/silverstripe-admin/labels/impact/high","name":"impact/high","color":"eb6420","default":false},{"id":557308894,"node_id":"MDU6TGFiZWw1NTczMDg4OTQ=","url":"https://api.github.com/repos/silverstripe/silverstripe-admin/labels/type/bug","name":"type/bug","color":"d93f0b","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2019-02-20T02:19:30Z","updated_at":"2019-02-20T02:19:30Z","closed_at":null,"author_association":"MEMBER","body":"https://github.com/silverstripe/silverstripe-admin/tree/1/thirdparty/jstree/_demo. This includes PHP files. They're exposed either through the direct folder path, or by copying them into the public webroot via `vendor-expose`. We disallow access to `vendor/*` by default via .htaccess if you're not running with public folder. But this rule doesn't apply when the files are copied via `vendor-expose`, so it actually executes the PHP.\r\n\r\nThere's no known vulnerability by which you can exploit the code in `config.php` or `server.php`, but it's still bad form, and we should remove this code.\r\n\r\nIt's not tracked through NPM (see `package.json`), so there's no risk about automatically re-adding the code when we update the package. The package (jstree) is so ancient that we're unlikely to ever touch it again - it'll be replaced with a React library.\r\n\r\nThis was introduced in what seems like an accident (\"upgrade translations\" commit at https://github.com/silverstripe/silverstripe-admin/commit/ad18c29866b21fc244822e317175f6c0bfdc9cb9#diff-c4ce140c95fddfc5197c64781c04cc69)"}}
{"actor":{"display_login":"chillu"}}