Some core function as plugins

[treeandcoffee]

Hi
I have the idea that it could be a chance to move some today core functions into separate plugins.

• template editor
• htaccess manager

Both mentioned are changing files on the server, in case of htaccess also server config. I know htaccess Manager was my idea, but up to now a compromised admin meant content and php, but not server conf. With the htaccess manager anyone could compromise the webservers/webinstances config through htaccess.

[synaptikcms]

I love that htaccess manager because it personally saves me some extra work on a couple of sites after updating, but I'll admit I'm not happy with having that kind of potential vulnerability in the CMS (although I've reinforced it for the next version).
Turning htaccess manager into a plugin wouldn't make it safer, it would only make it optional instead of default, as plugins run with the same trust level as the core, no sandbox.

Debating with myself here: either I keep htaccess manager and users accept that it's a risky sort of feature, or I remove it and they accept that they will need to re-add whatever rules they need upon each update.
But it doesn't make much sense for me to turn it into a plugin. it's extra work for me to maintain yet another plugin that very few people will probably use, and which serves only Apache users because it does nothing for Nginx users.

For what it's worth, most WordPress htaccess editors I've seen (Yoast's file editor, dedicated htaccess-editor plugins) write whatever you paste with zero content validation (no denylist, no rollback if it breaks the site). Mine blocks handler hijacking, php_admin_*, security-header stripping, and mod_rewrite's proxy flag, and auto-reverts the file if a save makes the site give a 500 error.

One thing is for sure, if I roll back on this feature I'm removing it entirely, not making it a plugin.

[treeandcoffee]

Thank you for your comments. I can certainly see that converting this into a plugin wouldn’t really be a benefit for the project, since it would involve both more work and separate maintenance, as you mentioned.

As I mentioned, my suggestion was just an idea. For me, it wasn’t about immediately removing a piece of code, but rather about discussing whether a move toward a plugin would make sense at this point in time. Precisely because this piece of code could have an impact—but doesn’t necessarily have to. That is and remains my starting point.

Personally, I think the .htaccess Manager is great, too, because it helps me with my own sites as well. And if you’ve already hardened the .htaccess Manager for future versions, then there’d be no reason to change anything.