Dev: added plugin whitelist config

LimeSurvey · Oct 2, 2018 · 78f6c1b · 78f6c1b
1 parent 8661693
commit 78f6c1b
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 1 deletion.
diff --git a/application/config/config-defaults.php b/application/config/config-defaults.php
@@ -695,5 +695,20 @@
 // This is useful when developing a theme, so changes to XML files are immediately applied without the need to uninstall and reinstall the theme.
 $config['force_xmlsettings_for_survey_rendering'] = false;
 
+$config['usePluginWhitelist'] = false;
+
+$config['pluginCoreList'] = [
+    'AuditLog',
+    'ExportR',
+    'ExportSTATAxml',
+    'extendedStartPage',
+    'oldUrlCompat',
+    'AuthLDAP',
+    'Authdb',
+    'Authwebserver'
+];
+
+$config['pluginWhitelist'] = [];
+
 return $config;
 //settings deleted
diff --git a/application/libraries/PluginManager/PluginManager.php b/application/libraries/PluginManager/PluginManager.php
@@ -207,7 +207,7 @@ public function scanPlugins($forceReload = false)
                         // Directory name Example most contain file ExamplePlugin.php.
                         $pluginName = $fileInfo->getFilename();
                         $file = Yii::getPathOfAlias($pluginDir.".$pluginName.{$pluginName}").".php";
-                        if (file_exists($file)) {
+                        if (file_exists($file) && $this->_checkWhitelist($pluginName)) {
                             $result[$pluginName] = $this->getPluginInfo($pluginName, $pluginDir);
                         }
                     }
@@ -410,4 +410,16 @@ public function readConfigFiles()
         $this->loadPlugins();
     }
 
+
+    private function _checkWhitelist($pluginName){
+        if(App()->getConfig('usePluginWhitelist')) {
+
+            $whiteList = App()->getConfig('pluginWhitelist');
+            $coreList = App()->getConfig('pluginCoreList');
+            $allowedPlugins =  array_merge($coreList, $whiteList);
+            return array_search($pluginName, $allowedPlugins) !== false;
+        }
+        return true;
+    }
+
 }